don't return grouped data

the arguments to the function are grouped.  But the actual content
of the arguments is the group contents.  It's not the group.

So we can't copy the input groups to the output, that results in
too many groups.

diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c
index 8509b580ea0721c2951a4ff40b9cdab729f71959..48f2b0d1e6a20f949e245a77123a783d019cea90 100644 (file)
--- a/src/lib/unlang/xlat_builtin.c
+++ b/src/lib/unlang/xlat_builtin.c
@@ -755,9 +755,16 @@ static xlat_action_t xlat_func_taint(UNUSED TALLOC_CTX *ctx, fr_dcursor_t *out,
 {
        fr_value_box_t *vb;
 
-       fr_value_box_list_taint(in);
        while ((vb = fr_value_box_list_pop_head(in)) != NULL) {
-               fr_dcursor_append(out, vb);
+               fr_value_box_t *child;
+
+               fr_assert(vb->type == FR_TYPE_GROUP);
+
+               while ((child = fr_value_box_list_pop_head(&vb->vb_group)) != NULL) {
+                       child->tainted = true;
+
+                       fr_dcursor_append(out, child);
+               }
        }
 
        return XLAT_ACTION_DONE;