Using the launch() function to execute a command normally brings up a box entitled 'Security Risk', saying what the command is, and asking whether to deny, or allow. However, if the command contains an ampersand the box is blank, except for the icon and the buttons. If the 'Allow' button is pressed, the command is still executed.
I haven't extensively tested this - only using a command along the lines of:
launch("firefox http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem\&item=160140944800")
In this state the command functions, but the permission box is blank; '...ViewItem&item...' doesn't function correctly, and the permission box is blank; '...ViewItemitem...' gives a correct permission box.
This brings up another point. I'm not sure whether this is a bug, or just the way commands are launched in Gnome. The first URL above is necessary to launch the page from gDesklets. However, only the second URL above will open the page in the Python urllib2 module. Should this be treated as a bug? If not, do you have any ideas how to get round it so I don't have to define the same url twice?
One way to fix this, would be to escape the ampersand. I'm not sure if that's the correct fix. We should find a solution for 0.36final. I don't know if it's necessary to hold back the beta.