--- loncom/Attic/lcuseradd	2002/12/09 16:15:51	1.24
+++ loncom/Attic/lcuseradd	2004/08/05 21:01:20	1.25.2.1
@@ -5,10 +5,6 @@
 # lcuseradd - LON-CAPA setuid script to coordinate all actions
 #             with adding a user with filesystem privileges (e.g. author)
 #
-# YEAR=2000
-# 10/27,10/29,10/30 Scott Harrison
-# YEAR=2001
-# 10/21,11/13,11/15 Scott Harrison
 # YEAR=2002
 #   May 19, 2002 Ron Fox
 #      - Removed creation of the pulic_html directory.  This directory
@@ -18,7 +14,7 @@
 #        o LonCapa will add it if/when the user is granted an Author
 #          role.
 #
-# $Id: lcuseradd,v 1.24 2002/12/09 16:15:51 www Exp $
+# $Id: lcuseradd,v 1.25.2.1 2004/08/05 21:01:20 albertel Exp $
 ###
 
 ###############################################################################
@@ -218,6 +214,9 @@ if ($status) {
 print "Done adding user\n" unless $noprint;
 # Make www a member of that user group.
 my $groups=`/usr/bin/groups www` or exit(6);
+# untaint
+my ($safegroups)=($groups=~/([\s\w]+)/);
+$groups=$safegroups;
 chomp $groups; $groups=~s/^\S+\s+\:\s+//;
 my @grouplist=split(/\s+/,$groups);
 my @ugrouplist=grep {!/www|$safeusername/} @grouplist;
@@ -284,9 +283,9 @@ if (-e '/var/run/httpd.pid') {
     open(PID,'/var/run/httpd.pid');
     my $pid=<PID>;
     close(PID);
-    $pid=~s/\D+//g;
+    my ($safepid)=($pid=~s/(\D+)//g);
     if ($pid) {
-	system('kill','-USR1',"$pid");
+	system('kill','-USR1',"$safepid");
     }
 }
 # -------------------------------------------------------- Exit script