Don't do vars and users in abs_file

It meant file names could be incorrectly expanded.

2 files changed, 3 insertions, 3 deletions

diff --git a/coverage/config.py b/coverage/config.py
index 62f281ad..b8789fbf 100644
--- a/coverage/config.py
+++ b/coverage/config.py
@@ -534,5 +534,6 @@ def read_coverage_config(config_file, **kwargs):
     config.data_file = os.path.expanduser(config.data_file)
     config.html_dir = os.path.expanduser(config.html_dir)
     config.xml_output = os.path.expanduser(config.xml_output)
+    config.paths = {k: [os.path.expanduser(f) for f in v] for k, v in config.paths.items()}
 
     return config
diff --git a/coverage/files.py b/coverage/files.py
index 2836d4e5..5c2ff1ac 100644
--- a/coverage/files.py
+++ b/coverage/files.py
@@ -159,9 +159,8 @@ else:
 
 
 @contract(returns='unicode')
-def abs_file(filename):
-    """Return the absolute normalized form of `filename`."""
-    path = os.path.expandvars(os.path.expanduser(filename))
+def abs_file(path):
+    """Return the absolute normalized form of `path`."""
     try:
         path = os.path.realpath(path)
     except UnicodeError: