--- loncom/Attic/lchtmldir	2007/04/10 20:32:13	1.18
+++ loncom/Attic/lchtmldir	2008/05/30 13:37:48	1.21
@@ -2,6 +2,8 @@
 
 # The Learning Online Network with CAPA
 #
+# $Id: lchtmldir,v 1.21 2008/05/30 13:37:48 raeburn Exp $
+#
 # Copyright Michigan State University Board of Trustees
 #
 # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
@@ -127,7 +129,7 @@ if( $authentication ne "unix:"     &&
     $authentication ne "localauth:") {
     if($DEBUG) {
 	print("Invalid authentication parameter: ".$authentication."\n");
-	print("Should be one of: unix, internal, krb4, localauth\n");
+	print("Should be one of-- unix: internal: krb4: krb5: localauth:\n");
     }
     exit 3;
 }
@@ -156,32 +158,30 @@ if($username ne $safeuser) {
 #untaint the base directory require that the dir contain only 
 # alphas, / numbers or underscores, and end in /$safeuser
 
-$dir =~ /(^([\w\/\.\-]+))/;
 
-my $dirtry1 = $1;
 
-$dir =~ /$\/$safeuser/;
-my $dirtry2 = $1;
+my ($allowed_dir) = ($dir =~ m{(^([/]|$match_username)+)});
+
+my $has_correct_end = ($dir =~ m{/\Q$safeuser\E$});
 
-if(($dirtry1 ne $dir) or ($dirtry2 ne $dir)) {
+if(($allowed_dir ne $dir) or (!$has_correct_end)) {
     if ($DEBUG) {
 	print("Directory $dir is not a valid home for $safeuser\n");
     }
     exit 5;
 }
 
-
 # As root, create the directory.
 
-my $homedir = $dirtry1;
+my $homedir = $allowed_dir;
 my $fulldir = $homedir."/public_html";
 
 if($DEBUG) {
     print("Full directory path is: $fulldir \n");
 }
-if(!( -e $dirtry1)) {
+if(!( -e $homedir)) {
     if($DEBUG) {
-	print("User's home directory $dirtry1 does not exist\n");
+	print("User's home directory $homedir does not exist\n");
     }
     if ($authentication eq "unix:") {
         exit 6;