fixed escaping the path (it's no cmdline argument anymore)

src/Composer/Downloader/HgDownloader.php

@@ -26,9 +26,8 @@ class HgDownloader extends VcsDownloader
     {
         $url = escapeshellarg($package->getSourceUrl());
         $ref = escapeshellarg($package->getSourceReference());
-        $path = escapeshellarg($path);
         $this->io->write("    Cloning ".$package->getSourceReference());
-        $command = sprintf('hg clone %s %s', $url, $path);
+        $command = sprintf('hg clone %s %s', $url, escapeshellarg($path));
         if (0 !== $this->process->execute($command, $ignoredOutput)) {
             throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
         }
@@ -45,7 +44,6 @@ class HgDownloader extends VcsDownloader
     {
         $url = escapeshellarg($target->getSourceUrl());
         $ref = escapeshellarg($target->getSourceReference());
-        $path = escapeshellarg($path);
         $this->io->write("    Updating to ".$target->getSourceReference());
         $command = sprintf('hg pull %s && hg up %s', $url, $ref);
         if (0 !== $this->process->execute($command, $ignoredOutput, $path)) {