X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=make-secnet-sites;h=668dbf635b02ec9e98533e5e8b261297614074fb;hb=1699c102b7b7d76a66aaf65832cda1476171671f;hp=f14a72524d5c9580ddac78b34f524eadd0dccbfa;hpb=fcfa19e603539af0e3c97635dead1ec4e4816756;p=secnet.git

diff --git a/make-secnet-sites b/make-secnet-sites
index f14a725..668dbf6 100755
--- a/make-secnet-sites
+++ b/make-secnet-sites
@@ -227,6 +227,8 @@ def parse_args():
 			print("Wrong number of arguments")
 			sys.exit(1)
 		(header, groupfiledir, sitesfile, group) = av.arg
+		group = Tainted(group,0,'command line')
+		# untrusted argument from caller
 		if "USERV_USER" not in os.environ:
 			print("Environment variable USERV_USER not found")
 			sys.exit(1)
@@ -732,14 +734,15 @@ complaints=None # arranges to crash if we complain later
 if service:
 	# Put the user's input into their group file, and rebuild the main
 	# sites file
-	f=open(groupfiledir+"/T"+group,'w')
+	f=open(groupfiledir+"/T"+group.groupname(),'w')
 	f.write("# Section submitted by user %s, %s\n"%
 		(user,time.asctime(time.localtime(time.time()))))
 	f.write("# Checked by make-secnet-sites version %s\n\n"%VERSION)
 	for i in userinput: f.write(i)
 	f.write("\n")
 	f.close()
-	os.rename(groupfiledir+"/T"+group,groupfiledir+"/R"+group)
+	os.rename(groupfiledir+"/T"+group.groupname(),
+		  groupfiledir+"/R"+group.groupname())
 	f=open(sitesfile+"-tmp",'w')
 	f.write("# sites file autogenerated by make-secnet-sites\n")
 	f.write("# generated %s, invoked by %s\n"%