From ced02195fa344c4715edd9da1efb9fabe697d639 Mon Sep 17 00:00:00 2001
From: Justin Azoff <justin@bouncybouncy.net>
Date: Sun, 28 Jul 2013 00:41:27 -0400
Subject: [PATCH 1/2] expand ~ in paths to the users home directory

If the site uri starts with ~/ then expand it to the users home
directory.  ~user style paths aren't implemented as part of this change.
---
 handlers-of.go | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/handlers-of.go b/handlers-of.go
index 2d4abcf..e18aaae 100644
--- a/handlers-of.go
+++ b/handlers-of.go
@@ -4,6 +4,8 @@ import (
 	"regexp"
 	"fmt"
 	"os"
+	"os/user"
+	"strings"
 )
 
 type Handlers map[string]*Handler
@@ -12,6 +14,7 @@ func handlerOf (uri string, hasCustom404 bool, custom404 string) *Handler {
 	debug("Setting up the HTTP handler that will serve %s", uri)
 
 	handler := &Handler{ false, false, uri, nil }
+	uri = expandUser(uri)
 	isStatic := isLocalPath(uri)
 
 	if isStatic && isSingleFile(uri) {
@@ -76,3 +79,13 @@ func isSingleFile (uri string) bool {
 
 	return false
 }
+
+func expandUser(uri string) string {
+	if !strings.HasPrefix(uri, "~/") {
+		return uri
+	}
+	usr, _ := user.Current()
+	dir := usr.HomeDir
+	uri = strings.Replace(uri, "~", dir, 1)
+	return uri
+}

From 769f2666e5be40b2a35e1460b211934f2344178a Mon Sep 17 00:00:00 2001
From: Justin Azoff <justin@bouncybouncy.net>
Date: Sun, 28 Jul 2013 20:02:28 -0400
Subject: [PATCH 2/2] Drop privileges before reading the configuration

Change the uid/gid before reading the configuration.
This makes the ~/ path expansion use the specified users home directory.
---
 boxcars/boxcars.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/boxcars/boxcars.go b/boxcars/boxcars.go
index 05b68e0..403eeba 100644
--- a/boxcars/boxcars.go
+++ b/boxcars/boxcars.go
@@ -29,13 +29,13 @@ func main() {
 		os.Exit(1)
 	}
 
+	if secure {
+		boxcars.Secure(user_id, group_id)
+	}
+
 	boxcars.SetFilename(filename)
 	go boxcars.ReadConfig()
 	go boxcars.AutoReload()
 
-	if secure {
-		go boxcars.Secure(user_id, group_id)
-	}
-
 	boxcars.Listen(port)
 }