From 2b87d6f700d8134cbdec10adb69c3ef97fe6ec54 Mon Sep 17 00:00:00 2001
From: Peter Eckersley <pde@eff.org>
Date: Mon, 30 Nov 2015 18:15:07 -0800
Subject: [PATCH] Do not accept -d first in the presence of multiple -w flags

 * informal testing suggested that many people found this behaviour confusing
---
 letsencrypt/cli.py            |  8 ++++++++
 letsencrypt/tests/cli_test.py | 11 +++++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index ffccd56b4..cc458d7fe 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -1043,6 +1043,10 @@ def _plugins_parsing(helpful, plugins):
 
 
 class WebrootPathProcessor(argparse.Action): # pylint: disable=missing-docstring
+    def __init__(self, *args, **kwargs):
+        self.domain_before_webroot = False
+        argparse.Action.__init__(self, *args, **kwargs)
+
     def __call__(self, parser, config, webroot, option_string=None):
         """
         Keep a record of --webroot-path / -w flags during processing, so that
@@ -1055,8 +1059,12 @@ class WebrootPathProcessor(argparse.Action): # pylint: disable=missing-docstring
             # config.webroot_map are filled in by cli.DomainFlagProcessor
             if config.domains:
                 config.webroot_map = dict([(d, webroot) for d in config.domains])
+                self.domain_before_webroot = True
             else:
                 config.webroot_map = {}
+        elif self.domain_before_webroot:
+            raise errors.Error("If you specify multiple webroot paths, one of "
+                               "them must precede all domain flags")
         config.webroot_path.append(webroot)
 
 
diff --git a/letsencrypt/tests/cli_test.py b/letsencrypt/tests/cli_test.py
index 853109636..9f6538eb8 100644
--- a/letsencrypt/tests/cli_test.py
+++ b/letsencrypt/tests/cli_test.py
@@ -343,17 +343,20 @@ class CLITest(unittest.TestCase):  # pylint: disable=too-many-public-methods
 
     def test_parse_webroot(self):
         plugins = disco.PluginsRegistry.find_all()
-        webroot_args = ['--webroot', '-d', 'stray.example.com', '-w',
-            '/var/www/example', '-d', 'example.com,www.example.com', '-w',
-            '/var/www/superfluous', '-d', 'superfluo.us', '-d', 'www.superfluo.us']
+        webroot_args = ['--webroot',  '-w', '/var/www/example',
+            '-d', 'example.com,www.example.com', '-w', '/var/www/superfluous',
+            '-d', 'superfluo.us', '-d', 'www.superfluo.us']
         namespace = cli.prepare_and_parse_args(plugins, webroot_args)
         self.assertEqual(namespace.webroot_map, {
             'example.com': '/var/www/example',
-            'stray.example.com': '/var/www/example',
             'www.example.com': '/var/www/example',
             'www.superfluo.us': '/var/www/superfluous',
             'superfluo.us': '/var/www/superfluous'})
 
+        webroot_args = ['-d', 'stray.example.com'] + webroot_args
+        with self.assertRaises(errors.Error):
+            cli.prepare_and_parse_args(plugins, webroot_args)
+
         webroot_map_args = ['--webroot-map', '{"eg.com" : "/tmp"}']
         namespace = cli.prepare_and_parse_args(plugins, webroot_map_args)
         self.assertEqual(namespace.webroot_map, {u"eg.com": u"/tmp"})