]> git.ipfire.org Git - thirdparty/cups.git/blobdiff - scheduler/ipp.c
Import CUPS v1.7.1
[thirdparty/cups.git] / scheduler / ipp.c
index 15803a4338edc49966396553c344eeb85b954792..a3e55c2bd474e33d9701df0c4df39ebfd769b1ec 100644 (file)
@@ -1,98 +1,19 @@
 /*
- * "$Id: ipp.c 6052 2006-10-20 20:35:41Z mike $"
+ * "$Id: ipp.c 11500 2014-01-06 22:21:15Z msweet $"
  *
- *   IPP routines for the Common UNIX Printing System (CUPS) scheduler.
+ * IPP routines for the CUPS scheduler.
  *
- *   Copyright 1997-2006 by Easy Software Products, all rights reserved.
+ * Copyright 2007-2014 by Apple Inc.
+ * Copyright 1997-2007 by Easy Software Products, all rights reserved.
  *
- *   These coded instructions, statements, and computer programs are the
- *   property of Easy Software Products and are protected by Federal
- *   copyright law.  Distribution and use rights are outlined in the file
- *   "LICENSE.txt" which should have been included with this file.  If this
- *   file is missing or damaged please contact Easy Software Products
- *   at:
+ * This file contains Kerberos support code, copyright 2006 by
+ * Jelmer Vernooij.
  *
- *       Attn: CUPS Licensing Information
- *       Easy Software Products
- *       44141 Airport View Drive, Suite 204
- *       Hollywood, Maryland 20636 USA
- *
- *       Voice: (301) 373-9600
- *       EMail: cups-info@cups.org
- *         WWW: http://www.cups.org
- *
- * Contents:
- *
- *   cupsdProcessIPPRequest()    - Process an incoming IPP request...
- *   accept_jobs()               - Accept print jobs to a printer.
- *   add_class()                 - Add a class to the system.
- *   add_file()                  - Add a file to a job.
- *   add_job()                   - Add a job to a print queue.
- *   add_job_state_reasons()     - Add the "job-state-reasons" attribute based
- *                                 upon the job and printer state...
- *   add_job_subscriptions()     - Add any subcriptions for a job.
- *   add_job_uuid()              - Add job-uuid attribute to a job.
- *   add_printer()               - Add a printer to the system.
- *   add_printer_state_reasons() - Add the "printer-state-reasons" attribute
- *                                 based upon the printer state...
- *   add_queued_job_count()      - Add the "queued-job-count" attribute for
- *   apply_printer_defaults()    - Apply printer default options to a job.
- *   authenticate_job()          - Set job authentication info.
- *   cancel_all_jobs()           - Cancel all print jobs.
- *   cancel_job()                - Cancel a print job.
- *   cancel_subscription()       - Cancel a subscription.
- *   check_quotas()              - Check quotas for a printer and user.
- *   copy_attribute()            - Copy a single attribute.
- *   copy_attrs()                - Copy attributes from one request to another.
- *   copy_banner()               - Copy a banner file to the requests directory
- *                                 for the specified job.
- *   copy_file()                 - Copy a PPD file or interface script...
- *   copy_model()                - Copy a PPD model file, substituting default
- *                                 values as needed...
- *   copy_job_attrs()            - Copy job attributes.
- *   copy_printer_attrs()        - Copy printer attributes.
- *   copy_subscription_attrs()   - Copy subscription attributes.
- *   create_job()                - Print a file to a printer or class.
- *   create_requested_array()    - Create an array for the requested-attributes.
- *   create_subscription()       - Create a notification subscription.
- *   delete_printer()            - Remove a printer or class from the system.
- *   get_default()               - Get the default destination.
- *   get_devices()               - Get the list of available devices on the
- *                                 local system.
- *   get_job_attrs()             - Get job attributes.
- *   get_jobs()                  - Get a list of jobs for the specified printer.
- *   get_notifications()         - Get events for a subscription.
- *   get_ppds()                  - Get the list of PPD files on the local
- *                                 system.
- *   get_printer_attrs()         - Get printer attributes.
- *   get_printers()              - Get a list of printers.
- *   get_subscription_attrs()    - Get subscription attributes.
- *   get_subscriptions()         - Get subscriptions.
- *   get_username()              - Get the username associated with a request.
- *   hold_job()                  - Hold a print job.
- *   move_job()                  - Move a job to a new destination.
- *   ppd_parse_line()            - Parse a PPD default line.
- *   print_job()                 - Print a file to a printer or class.
- *   read_ps_line()              - Read a line from a PS file...
- *   read_ps_job_ticket()        - Reads a job ticket embedded in a PS file.
- *   reject_jobs()               - Reject print jobs to a printer.
- *   release_job()               - Release a held print job.
- *   restart_job()               - Restart an old print job.
- *   save_auth_info()            - Save authentication information for a job.
- *   send_document()             - Send a file to a printer or class.
- *   send_http_error()           - Send a HTTP error back to the IPP client.
- *   send_ipp_status()           - Send a status back to the IPP client.
- *   set_default()               - Set the default destination...
- *   set_job_attrs()             - Set job attributes.
- *   set_printer_defaults()      - Set printer default options from a request.
- *   start_printer()             - Start a printer.
- *   stop_printer()              - Stop a printer.
- *   url_encode_attr()           - URL-encode a string attribute.
- *   user_allowed()              - See if a user is allowed to print to a queue.
- *   validate_job()              - Validate printer options and destination.
- *   validate_name()             - Make sure the printer name only contains
- *                                 valid chars.
- *   validate_user()             - Validate the user for the request.
+ * These coded instructions, statements, and computer programs are the
+ * property of Apple Inc. and are protected by Federal copyright
+ * law.  Distribution and use rights are outlined in the file "LICENSE.txt"
+ * which should have been included with this file.  If this file is
+ * file is missing or damaged, see the license at "http://www.cups.org/".
  */
 
 /*
  */
 
 #include "cupsd.h"
+#include <cups/ppd-private.h>
 
-#ifdef HAVE_LIBPAPER
-#  include <paper.h>
-#endif /* HAVE_LIBPAPER */
+#ifdef __APPLE__
+/*#  include <ApplicationServices/ApplicationServices.h>
+extern CFUUIDRef ColorSyncCreateUUIDFromUInt32(unsigned id);
+#  include <CoreFoundation/CoreFoundation.h>*/
+#  ifdef HAVE_MEMBERSHIP_H
+#    include <membership.h>
+#  endif /* HAVE_MEMBERSHIP_H */
+#  ifdef HAVE_MEMBERSHIPPRIV_H
+#    include <membershipPriv.h>
+#  else
+extern int mbr_user_name_to_uuid(const char* name, uuid_t uu);
+extern int mbr_group_name_to_uuid(const char* name, uuid_t uu);
+extern int mbr_check_membership_by_id(uuid_t user, gid_t group, int* ismember);
+#  endif /* HAVE_MEMBERSHIPPRIV_H */
+#endif /* __APPLE__ */
 
 
 /*
@@ -114,12 +48,10 @@ static void        accept_jobs(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    add_class(cupsd_client_t *con, ipp_attribute_t *uri);
 static int     add_file(cupsd_client_t *con, cupsd_job_t *job,
                         mime_type_t *filetype, int compression);
-static cupsd_job_t *add_job(cupsd_client_t *con, ipp_attribute_t *uri,
-                           cupsd_printer_t **dprinter,
+static cupsd_job_t *add_job(cupsd_client_t *con, cupsd_printer_t *printer,
                            mime_type_t *filetype);
-static void    add_job_state_reasons(cupsd_client_t *con, cupsd_job_t *job);
 static void    add_job_subscriptions(cupsd_client_t *con, cupsd_job_t *job);
-static void    add_job_uuid(cupsd_client_t *con, cupsd_job_t *job);
+static void    add_job_uuid(cupsd_job_t *job);
 static void    add_printer(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    add_printer_state_reasons(cupsd_client_t *con,
                                          cupsd_printer_t *p);
@@ -130,11 +62,12 @@ static void        authenticate_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    cancel_all_jobs(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    cancel_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    cancel_subscription(cupsd_client_t *con, int id);
+static int     check_rss_recipient(const char *recipient);
 static int     check_quotas(cupsd_client_t *con, cupsd_printer_t *p);
-static ipp_attribute_t *copy_attribute(ipp_t *to, ipp_attribute_t *attr,
-                                       int quickcopy);
+static void    close_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    copy_attrs(ipp_t *to, ipp_t *from, cups_array_t *ra,
-                          ipp_tag_t group, int quickcopy);
+                          ipp_tag_t group, int quickcopy,
+                          cups_array_t *exclude);
 static int     copy_banner(cupsd_client_t *con, cupsd_job_t *job,
                            const char *name);
 static int     copy_file(const char *from, const char *to);
@@ -142,55 +75,63 @@ static int copy_model(cupsd_client_t *con, const char *from,
                           const char *to);
 static void    copy_job_attrs(cupsd_client_t *con,
                               cupsd_job_t *job,
-                              cups_array_t *ra);
+                              cups_array_t *ra, cups_array_t *exclude);
 static void    copy_printer_attrs(cupsd_client_t *con,
                                   cupsd_printer_t *printer,
                                   cups_array_t *ra);
 static void    copy_subscription_attrs(cupsd_client_t *con,
                                        cupsd_subscription_t *sub,
-                                       cups_array_t *ra);
+                                       cups_array_t *ra,
+                                       cups_array_t *exclude);
 static void    create_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static cups_array_t *create_requested_array(ipp_t *request);
 static void    create_subscription(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    delete_printer(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    get_default(cupsd_client_t *con);
 static void    get_devices(cupsd_client_t *con);
+static void    get_document(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    get_jobs(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    get_job_attrs(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    get_notifications(cupsd_client_t *con);
+static void    get_ppd(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    get_ppds(cupsd_client_t *con);
 static void    get_printers(cupsd_client_t *con, int type);
 static void    get_printer_attrs(cupsd_client_t *con, ipp_attribute_t *uri);
+static void    get_printer_supported(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    get_subscription_attrs(cupsd_client_t *con, int sub_id);
 static void    get_subscriptions(cupsd_client_t *con, ipp_attribute_t *uri);
 static const char *get_username(cupsd_client_t *con);
 static void    hold_job(cupsd_client_t *con, ipp_attribute_t *uri);
+static void    hold_new_jobs(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    move_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static int     ppd_parse_line(const char *line, char *option, int olen,
                               char *choice, int clen);
 static void    print_job(cupsd_client_t *con, ipp_attribute_t *uri);
-static void    read_ps_job_ticket(cupsd_client_t *con);
+static void    read_job_ticket(cupsd_client_t *con);
 static void    reject_jobs(cupsd_client_t *con, ipp_attribute_t *uri);
+static void    release_held_new_jobs(cupsd_client_t *con,
+                                     ipp_attribute_t *uri);
 static void    release_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    renew_subscription(cupsd_client_t *con, int sub_id);
 static void    restart_job(cupsd_client_t *con, ipp_attribute_t *uri);
-static void    save_auth_info(cupsd_client_t *con, cupsd_job_t *job);
+static void    save_auth_info(cupsd_client_t *con, cupsd_job_t *job,
+                              ipp_attribute_t *auth_info);
 static void    send_document(cupsd_client_t *con, ipp_attribute_t *uri);
-static void    send_http_error(cupsd_client_t *con, http_status_t status);
+static void    send_http_error(cupsd_client_t *con, http_status_t status,
+                               cupsd_printer_t *printer);
 static void    send_ipp_status(cupsd_client_t *con, ipp_status_t status,
                                const char *message, ...)
-#    ifdef __GNUC__
-__attribute__ ((__format__ (__printf__, 3, 4)))
-#    endif /* __GNUC__ */
-;
+               __attribute__((__format__(__printf__, 3, 4)));
 static void    set_default(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    set_job_attrs(cupsd_client_t *con, ipp_attribute_t *uri);
+static void    set_printer_attrs(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    set_printer_defaults(cupsd_client_t *con,
                                     cupsd_printer_t *printer);
 static void    start_printer(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    stop_printer(cupsd_client_t *con, ipp_attribute_t *uri);
 static void    url_encode_attr(ipp_attribute_t *attr, char *buffer,
                                int bufsize);
+static char    *url_encode_string(const char *s, char *buffer, int bufsize);
 static int     user_allowed(cupsd_printer_t *p, const char *username);
 static void    validate_job(cupsd_client_t *con, ipp_attribute_t *uri);
 static int     validate_name(const char *name);
@@ -200,7 +141,7 @@ static int  validate_user(cupsd_job_t *job, cupsd_client_t *con,
 
 
 /*
- * 'cupsdProcessIPPRequest()' - Process an incoming IPP request...
+ * 'cupsdProcessIPPRequest()' - Process an incoming IPP request.
  */
 
 int                                    /* O - 1 on success, 0 on failure */
@@ -211,7 +152,7 @@ cupsdProcessIPPRequest(
   ipp_attribute_t      *attr;          /* Current attribute */
   ipp_attribute_t      *charset;       /* Character set attribute */
   ipp_attribute_t      *language;      /* Language attribute */
-  ipp_attribute_t      *uri;           /* Printer URI attribute */
+  ipp_attribute_t      *uri = NULL;    /* Printer or job URI attribute */
   ipp_attribute_t      *username;      /* requesting-user-name attr */
   int                  sub_id;         /* Subscription ID */
 
@@ -226,18 +167,22 @@ cupsdProcessIPPRequest(
 
   con->response = ippNew();
 
-  con->response->request.status.version[0] = con->request->request.op.version[0];
-  con->response->request.status.version[1] = con->request->request.op.version[1];
-  con->response->request.status.request_id = con->request->request.op.request_id;
+  con->response->request.status.version[0] =
+      con->request->request.op.version[0];
+  con->response->request.status.version[1] =
+      con->request->request.op.version[1];
+  con->response->request.status.request_id =
+      con->request->request.op.request_id;
 
  /*
   * Then validate the request header and required attributes...
   */
-  
-  if (con->request->request.any.version[0] != 1)
+
+  if (con->request->request.any.version[0] != 1 &&
+      con->request->request.any.version[0] != 2)
   {
    /*
-    * Return an error, since we only support IPP 1.x.
+    * Return an error, since we only support IPP 1.x and 2.x.
     */
 
     cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
@@ -247,17 +192,31 @@ cupsdProcessIPPRequest(
                  con->request->request.any.version[1]);
 
     send_ipp_status(con, IPP_VERSION_NOT_SUPPORTED,
-                    _("Bad request version number %d.%d!"),
+                    _("Bad request version number %d.%d."),
                    con->request->request.any.version[0],
                    con->request->request.any.version[1]);
-  }  
+  }
+  else if (con->request->request.any.request_id < 1)
+  {
+   /*
+    * Return an error, since request IDs must be between 1 and 2^31-1
+    */
+
+    cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
+                  "%04X %s Bad request ID %d",
+                 IPP_BAD_REQUEST, con->http.hostname,
+                  con->request->request.any.request_id);
+
+    send_ipp_status(con, IPP_BAD_REQUEST, _("Bad request ID %d."),
+                   con->request->request.any.request_id);
+  }
   else if (!con->request->attrs)
   {
     cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
                   "%04X %s No attributes in request",
                  IPP_BAD_REQUEST, con->http.hostname);
 
-    send_ipp_status(con, IPP_BAD_REQUEST, _("No attributes in request!"));
+    send_ipp_status(con, IPP_BAD_REQUEST, _("No attributes in request."));
   }
   else
   {
@@ -280,7 +239,7 @@ cupsdProcessIPPRequest(
                      IPP_BAD_REQUEST, con->http.hostname);
 
        send_ipp_status(con, IPP_BAD_REQUEST,
-                       _("Attribute groups are out of order (%x < %x)!"),
+                       _("Attribute groups are out of order (%x < %x)."),
                        attr->group_tag, group);
        break;
       }
@@ -298,7 +257,8 @@ cupsdProcessIPPRequest(
       */
 
       attr = con->request->attrs;
-      if (attr && !strcmp(attr->name, "attributes-charset") &&
+      if (attr && attr->name &&
+          !strcmp(attr->name, "attributes-charset") &&
          (attr->value_tag & IPP_TAG_MASK) == IPP_TAG_CHARSET)
        charset = attr;
       else
@@ -307,9 +267,23 @@ cupsdProcessIPPRequest(
       if (attr)
         attr = attr->next;
 
-      if (attr && !strcmp(attr->name, "attributes-natural-language") &&
+      if (attr && attr->name &&
+          !strcmp(attr->name, "attributes-natural-language") &&
          (attr->value_tag & IPP_TAG_MASK) == IPP_TAG_LANGUAGE)
+      {
        language = attr;
+
+       /*
+        * Reset language for this request if different from Accept-Language.
+        */
+
+       if (!con->language ||
+           strcmp(attr->values[0].string.text, con->language->language))
+       {
+         cupsLangFree(con->language);
+         con->language = cupsLangGet(attr->values[0].string.text);
+       }
+      }
       else
        language = NULL;
 
@@ -319,15 +293,18 @@ cupsdProcessIPPRequest(
       else if ((attr = ippFindAttribute(con->request, "job-uri",
                                         IPP_TAG_URI)) != NULL)
        uri = attr;
+      else if (con->request->request.op.operation_id == CUPS_GET_PPD)
+        uri = ippFindAttribute(con->request, "ppd-name", IPP_TAG_NAME);
       else
        uri = NULL;
 
       if (charset)
        ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                    "attributes-charset", NULL, charset->values[0].string.text);
+                    "attributes-charset", NULL,
+                    charset->values[0].string.text);
       else
        ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                    "attributes-charset", NULL, DefaultCharset);
+                    "attributes-charset", NULL, "utf-8");
 
       if (language)
        ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
@@ -337,13 +314,31 @@ cupsdProcessIPPRequest(
        ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                      "attributes-natural-language", NULL, DefaultLanguage);
 
-      if (!charset || !language ||
-         (!uri &&
-          con->request->request.op.operation_id != CUPS_GET_DEFAULT &&
-          con->request->request.op.operation_id != CUPS_GET_PRINTERS &&
-          con->request->request.op.operation_id != CUPS_GET_CLASSES &&
-          con->request->request.op.operation_id != CUPS_GET_DEVICES &&
-          con->request->request.op.operation_id != CUPS_GET_PPDS))
+      if (charset &&
+          _cups_strcasecmp(charset->values[0].string.text, "us-ascii") &&
+          _cups_strcasecmp(charset->values[0].string.text, "utf-8"))
+      {
+       /*
+        * Bad character set...
+       */
+
+        cupsdLogMessage(CUPSD_LOG_ERROR, "Unsupported character set \"%s\"",
+                       charset->values[0].string.text);
+       cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
+                     "%04X %s Unsupported attributes-charset value \"%s\"",
+                     IPP_CHARSET, con->http.hostname,
+                     charset->values[0].string.text);
+       send_ipp_status(con, IPP_BAD_REQUEST,
+                       _("Unsupported character set \"%s\"."),
+                       charset->values[0].string.text);
+      }
+      else if (!charset || !language ||
+              (!uri &&
+               con->request->request.op.operation_id != CUPS_GET_DEFAULT &&
+               con->request->request.op.operation_id != CUPS_GET_PRINTERS &&
+               con->request->request.op.operation_id != CUPS_GET_CLASSES &&
+               con->request->request.op.operation_id != CUPS_GET_DEVICES &&
+               con->request->request.op.operation_id != CUPS_GET_PPDS))
       {
        /*
        * Return an error, since attributes-charset,
@@ -354,7 +349,7 @@ cupsdProcessIPPRequest(
         if (!charset)
        {
          cupsdLogMessage(CUPSD_LOG_ERROR,
-                         "Missing attributes-charset attribute!");
+                         "Missing attributes-charset attribute");
 
          cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
                        "%04X %s Missing attributes-charset attribute",
@@ -364,7 +359,7 @@ cupsdProcessIPPRequest(
         if (!language)
        {
          cupsdLogMessage(CUPSD_LOG_ERROR,
-                         "Missing attributes-natural-language attribute!");
+                         "Missing attributes-natural-language attribute");
 
          cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
                        "%04X %s Missing attributes-natural-language attribute",
@@ -374,17 +369,18 @@ cupsdProcessIPPRequest(
         if (!uri)
        {
          cupsdLogMessage(CUPSD_LOG_ERROR,
-                         "Missing printer-uri or job-uri attribute!");
+                         "Missing printer-uri, job-uri, or ppd-name "
+                         "attribute");
 
          cupsdAddEvent(CUPSD_EVENT_SERVER_AUDIT, NULL, NULL,
-                       "%04X %s Missing printer-uri or job-uri attribute",
-                       IPP_BAD_REQUEST, con->http.hostname);
+                       "%04X %s Missing printer-uri, job-uri, or ppd-name "
+                       "attribute", IPP_BAD_REQUEST, con->http.hostname);
         }
 
        cupsdLogMessage(CUPSD_LOG_DEBUG, "Request attributes follow...");
 
        for (attr = con->request->attrs; attr; attr = attr->next)
-         cupsdLogMessage(CUPSD_LOG_DEBUG, 
+         cupsdLogMessage(CUPSD_LOG_DEBUG,
                          "attr \"%s\": group_tag = %x, value_tag = %x",
                          attr->name ? attr->name : "(null)", attr->group_tag,
                          attr->value_tag);
@@ -392,7 +388,7 @@ cupsdProcessIPPRequest(
        cupsdLogMessage(CUPSD_LOG_DEBUG, "End of attributes...");
 
        send_ipp_status(con, IPP_BAD_REQUEST,
-                       _("Missing required attributes!"));
+                       _("Missing required attributes."));
       }
       else
       {
@@ -409,7 +405,7 @@ cupsdProcessIPPRequest(
          */
 
          if (!strcmp(username->values[0].string.text, "root") &&
-             strcasecmp(con->http.hostname, "localhost") &&
+             _cups_strcasecmp(con->http.hostname, "localhost") &&
              strcmp(con->username, "root"))
          {
           /*
@@ -473,6 +469,10 @@ cupsdProcessIPPRequest(
               get_printer_attrs(con, uri);
               break;
 
+         case IPP_GET_PRINTER_SUPPORTED_VALUES :
+              get_printer_supported(con, uri);
+              break;
+
          case IPP_HOLD_JOB :
               hold_job(con, uri);
               break;
@@ -494,6 +494,8 @@ cupsdProcessIPPRequest(
              break;
 
          case IPP_PURGE_JOBS :
+         case IPP_CANCEL_JOBS :
+         case IPP_CANCEL_MY_JOBS :
               cancel_all_jobs(con, uri);
               break;
 
@@ -501,6 +503,22 @@ cupsdProcessIPPRequest(
               set_job_attrs(con, uri);
               break;
 
+         case IPP_SET_PRINTER_ATTRIBUTES :
+              set_printer_attrs(con, uri);
+              break;
+
+         case IPP_HOLD_NEW_JOBS :
+              hold_new_jobs(con, uri);
+              break;
+
+         case IPP_RELEASE_HELD_NEW_JOBS :
+              release_held_new_jobs(con, uri);
+              break;
+
+         case IPP_CLOSE_JOB :
+              close_job(con, uri);
+              break;
+
          case CUPS_GET_DEFAULT :
               get_default(con);
               break;
@@ -547,6 +565,14 @@ cupsdProcessIPPRequest(
               get_devices(con);
               break;
 
+          case CUPS_GET_DOCUMENT :
+             get_document(con, uri);
+             break;
+
+         case CUPS_GET_PPD :
+              get_ppd(con, uri);
+              break;
+
          case CUPS_GET_PPDS :
               get_ppds(con);
               break;
@@ -592,8 +618,9 @@ cupsdProcessIPPRequest(
                            ippOpString(con->request->request.op.operation_id));
 
               send_ipp_status(con, IPP_OPERATION_NOT_SUPPORTED,
-                             _("%s not supported!"),
-                             ippOpString(con->request->request.op.operation_id));
+                             _("%s not supported."),
+                             ippOpString(
+                                 con->request->request.op.operation_id));
              break;
        }
       }
@@ -606,12 +633,18 @@ cupsdProcessIPPRequest(
     * Sending data from the scheduler...
     */
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG,
-                    "cupsdProcessIPPRequest: %d status_code=%x (%s)",
-                    con->http.fd, con->response->request.status.status_code,
-                   ippErrorString(con->response->request.status.status_code));
+    cupsdLogMessage(con->response->request.status.status_code
+                        >= IPP_BAD_REQUEST &&
+                    con->response->request.status.status_code
+                       != IPP_NOT_FOUND ? CUPSD_LOG_ERROR : CUPSD_LOG_DEBUG,
+                    "[Client %d] Returning IPP %s for %s (%s) from %s",
+                   con->http.fd,
+                   ippErrorString(con->response->request.status.status_code),
+                   ippOpString(con->request->request.op.operation_id),
+                   uri ? uri->values[0].string.text : "no URI",
+                   con->http.hostname);
 
-    if (cupsdSendHeader(con, HTTP_OK, "application/ipp"))
+    if (cupsdSendHeader(con, HTTP_OK, "application/ipp", CUPSD_AUTH_NONE))
     {
 #ifdef CUPSD_USE_CHUNKING
      /*
@@ -624,6 +657,10 @@ cupsdProcessIPPRequest(
 
       if (con->http.version == HTTP_1_1)
       {
+        cupsdLogMessage(CUPSD_LOG_DEBUG,
+                        "[Client %d] Transfer-Encoding: chunked",
+                        con->http.fd);
+
        if (httpPrintf(HTTP(con), "Transfer-Encoding: chunked\r\n\r\n") < 0)
          return (0);
 
@@ -640,6 +677,17 @@ cupsdProcessIPPRequest(
 
        length = ippLength(con->response);
 
+       if (con->file >= 0 && !con->pipe_pid)
+       {
+         struct stat   fileinfo;       /* File information */
+
+          if (!fstat(con->file, &fileinfo))
+           length += fileinfo.st_size;
+       }
+
+        cupsdLogMessage(CUPSD_LOG_DEBUG,
+                        "[Client %d] Content-Length: " CUPS_LLFMT,
+                        con->http.fd, CUPS_LLCAST length);
        if (httpPrintf(HTTP(con), "Content-Length: " CUPS_LLFMT "\r\n\r\n",
                       CUPS_LLCAST length) < 0)
          return (0);
@@ -649,13 +697,15 @@ cupsdProcessIPPRequest(
 
        con->http.data_encoding  = HTTP_ENCODE_LENGTH;
        con->http.data_remaining = length;
-      }
 
-      cupsdLogMessage(CUPSD_LOG_DEBUG2,
-                      "cupsdProcessIPPRequest: Adding fd %d to OutputSet...",
-                     con->http.fd);
+       if (con->http.data_remaining <= INT_MAX)
+         con->http._data_remaining = con->http.data_remaining;
+       else
+         con->http._data_remaining = INT_MAX;
+      }
 
-      FD_SET(con->http.fd, OutputSet);
+      cupsdAddSelect(con->http.fd, (cupsd_selfunc_t)cupsdReadClient,
+                     (cupsd_selfunc_t)cupsdWriteClient, con);
 
      /*
       * Tell the caller the response header was sent successfully...
@@ -684,6 +734,50 @@ cupsdProcessIPPRequest(
 }
 
 
+/*
+ * 'cupsdTimeoutJob()' - Timeout a job waiting on job files.
+ */
+
+int                                    /* O - 0 on success, -1 on error */
+cupsdTimeoutJob(cupsd_job_t *job)      /* I - Job to timeout */
+{
+  cupsd_printer_t      *printer;       /* Destination printer or class */
+  ipp_attribute_t      *attr;          /* job-sheets attribute */
+  int                  kbytes;         /* Kilobytes in banner */
+
+
+  job->pending_timeout = 0;
+
+ /*
+  * See if we need to add the ending sheet...
+  */
+
+  if (!cupsdLoadJob(job))
+    return (-1);
+
+  printer = cupsdFindDest(job->dest);
+  attr    = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME);
+
+  if (printer && !(printer->type & CUPS_PRINTER_REMOTE) &&
+      attr && attr->num_values > 1)
+  {
+   /*
+    * Yes...
+    */
+
+    cupsdLogJob(job, CUPSD_LOG_INFO, "Adding end banner page \"%s\".",
+                attr->values[1].string.text);
+
+    if ((kbytes = copy_banner(NULL, job, attr->values[1].string.text)) < 0)
+      return (-1);
+
+    cupsdUpdateQuota(printer, job->username, 0, kbytes);
+  }
+
+  return (0);
+}
+
+
 /*
  * 'accept_jobs()' - Accept print jobs to a printer.
  */
@@ -693,13 +787,7 @@ accept_jobs(cupsd_client_t  *con,  /* I - Client connection */
             ipp_attribute_t *uri)      /* I - Printer or class URI */
 {
   http_status_t        status;                 /* Policy status */
-  cups_ptype_t dtype;                  /* Destination type (printer or class) */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
-               username[HTTP_MAX_URI], /* Username portion of URI */
-               host[HTTP_MAX_URI],     /* Host portion of URI */
-               resource[HTTP_MAX_URI]; /* Resource portion of URI */
-  int          port;                   /* Port portion of URI */
-  const char   *name;                  /* Printer name */
+  cups_ptype_t dtype;                  /* Destination type (printer/class) */
   cupsd_printer_t *printer;            /* Printer data */
 
 
@@ -710,18 +798,14 @@ accept_jobs(cupsd_client_t  *con, /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((name = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -731,7 +815,7 @@ accept_jobs(cupsd_client_t  *con,   /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
     return;
   }
 
@@ -742,15 +826,24 @@ accept_jobs(cupsd_client_t  *con, /* I - Client connection */
   printer->accepting        = 1;
   printer->state_message[0] = '\0';
 
-  cupsdAddPrinterHistory(printer);
+  cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, printer, NULL,
+                "Now accepting jobs.");
 
   if (dtype & CUPS_PRINTER_CLASS)
-    cupsdSaveAllClasses();
+  {
+    cupsdMarkDirty(CUPSD_DIRTY_CLASSES);
+
+    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" now accepting jobs (\"%s\").",
+                    printer->name, get_username(con));
+  }
   else
-    cupsdSaveAllPrinters();
+  {
+    cupsdMarkDirty(CUPSD_DIRTY_PRINTERS);
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" now accepting jobs (\"%s\").", name,
-                  get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Printer \"%s\" now accepting jobs (\"%s\").",
+                    printer->name, get_username(con));
+  }
 
  /*
   * Everything was ok, so return OK status...
@@ -770,7 +863,7 @@ add_class(cupsd_client_t  *con,             /* I - Client connection */
 {
   http_status_t        status;                 /* Policy status */
   int          i;                      /* Looping var */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Method portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
@@ -780,7 +873,6 @@ add_class(cupsd_client_t  *con,             /* I - Client connection */
   cups_ptype_t dtype;                  /* Destination type */
   ipp_attribute_t *attr;               /* Printer attribute */
   int          modify;                 /* Non-zero if we just modified */
-  char         newname[IPP_MAX_NAME];  /* New class name */
   int          need_restart_job;       /* Need to restart job? */
 
 
@@ -791,8 +883,8 @@ add_class(cupsd_client_t  *con,             /* I - Client connection */
   * Do we have a valid URI?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
+  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                  sizeof(scheme), username, sizeof(username), host,
                  sizeof(host), &port, resource, sizeof(resource));
 
 
@@ -824,16 +916,6 @@ add_class(cupsd_client_t  *con,            /* I - Client connection */
     return;
   }
 
- /*
-  * Check policy...
-  */
-
-  if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
-  {
-    send_http_error(con, status);
-    return;
-  }
-
  /*
   * See if the class already exists; if not, create a new class...
   */
@@ -844,62 +926,36 @@ add_class(cupsd_client_t  *con,           /* I - Client connection */
     * Class doesn't exist; see if we have a printer of the same name...
     */
 
-    if ((pclass = cupsdFindPrinter(resource + 9)) != NULL &&
-        !(pclass->type & CUPS_PRINTER_REMOTE))
+    if ((pclass = cupsdFindPrinter(resource + 9)) != NULL)
     {
      /*
       * Yes, return an error...
       */
 
       send_ipp_status(con, IPP_NOT_POSSIBLE,
-                      _("A printer named \"%s\" already exists!"),
+                      _("A printer named \"%s\" already exists."),
                      resource + 9);
       return;
     }
 
    /*
-    * No, add the pclass...
+    * No, check the default policy and then add the class...
     */
 
-    pclass = cupsdAddClass(resource + 9);
-    modify = 0;
-  }
-  else if (pclass->type & CUPS_PRINTER_IMPLICIT)
-  {
-   /*
-    * Rename the implicit class to "AnyClass" or remove it...
-    */
-
-    if (ImplicitAnyClasses)
+    if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
     {
-      snprintf(newname, sizeof(newname), "Any%s", resource + 9);
-      cupsdRenamePrinter(pclass, newname);
+      send_http_error(con, status, NULL);
+      return;
     }
-    else
-      cupsdDeletePrinter(pclass, 1);
-
-   /*
-    * Add the class as a new local class...
-    */
 
     pclass = cupsdAddClass(resource + 9);
     modify = 0;
   }
-  else if (pclass->type & CUPS_PRINTER_REMOTE)
+  else if ((status = cupsdCheckPolicy(pclass->op_policy_ptr, con,
+                                      NULL)) != HTTP_OK)
   {
-   /*
-    * Rename the remote class to "Class"...
-    */
-
-    snprintf(newname, sizeof(newname), "%s@%s", resource + 9, pclass->hostname);
-    cupsdRenamePrinter(pclass, newname);
-
-   /*
-    * Add the class as a new local class...
-    */
-
-    pclass = cupsdAddClass(resource + 9);
-    modify = 0;
+    send_http_error(con, status, pclass);
+    return;
   }
   else
     modify = 1;
@@ -919,20 +975,24 @@ add_class(cupsd_client_t  *con,           /* I - Client connection */
     cupsdSetString(&pclass->info, attr->values[0].string.text);
 
   if ((attr = ippFindAttribute(con->request, "printer-is-accepting-jobs",
-                               IPP_TAG_BOOLEAN)) != NULL)
+                               IPP_TAG_BOOLEAN)) != NULL &&
+      attr->values[0].boolean != pclass->accepting)
   {
-    cupsdLogMessage(CUPSD_LOG_INFO, "Setting %s printer-is-accepting-jobs to %d (was %d.)",
-               pclass->name, attr->values[0].boolean, pclass->accepting);
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Setting %s printer-is-accepting-jobs to %d (was %d.)",
+                    pclass->name, attr->values[0].boolean, pclass->accepting);
 
     pclass->accepting = attr->values[0].boolean;
-    cupsdAddPrinterHistory(pclass);
+
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, pclass, NULL, "%s accepting jobs.",
+                 pclass->accepting ? "Now" : "No longer");
   }
 
   if ((attr = ippFindAttribute(con->request, "printer-is-shared",
                                IPP_TAG_BOOLEAN)) != NULL)
   {
     if (pclass->shared && !attr->values[0].boolean)
-      cupsdSendBrowseDelete(pclass);
+      cupsdDeregisterPrinter(pclass, 1);
 
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Setting %s printer-is-shared to %d (was %d.)",
@@ -948,13 +1008,13 @@ add_class(cupsd_client_t  *con,          /* I - Client connection */
         attr->values[0].integer != IPP_PRINTER_STOPPED)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Attempt to set %s printer-state to bad value %d!"),
+                      _("Attempt to set %s printer-state to bad value %d."),
                       pclass->name, attr->values[0].integer);
       return;
     }
 
-    cupsdLogMessage(CUPSD_LOG_INFO, "Setting %s printer-state to %d (was %d.)", pclass->name,
-                    attr->values[0].integer, pclass->state);
+    cupsdLogMessage(CUPSD_LOG_INFO, "Setting %s printer-state to %d (was %d.)",
+                    pclass->name, attr->values[0].integer, pclass->state);
 
     if (attr->values[0].integer == IPP_PRINTER_STOPPED)
       cupsdStopPrinter(pclass, 0);
@@ -969,7 +1029,9 @@ add_class(cupsd_client_t  *con,            /* I - Client connection */
   {
     strlcpy(pclass->state_message, attr->values[0].string.text,
             sizeof(pclass->state_message));
-    cupsdAddPrinterHistory(pclass);
+
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, pclass, NULL, "%s",
+                  pclass->state_message);
   }
   if ((attr = ippFindAttribute(con->request, "member-uris",
                                IPP_TAG_URI)) != NULL)
@@ -996,20 +1058,22 @@ add_class(cupsd_client_t  *con,          /* I - Client connection */
       * Search for the printer or class URI...
       */
 
-      httpSeparateURI(HTTP_URI_CODING_ALL, attr->values[i].string.text, method,
-                      sizeof(method), username, sizeof(username), host,
-                     sizeof(host), &port, resource, sizeof(resource));
-
-      if (!cupsdValidateDest(host, resource, &dtype, &member))
+      if (!cupsdValidateDest(attr->values[i].string.text, &dtype, &member))
       {
        /*
        * Bad URI...
        */
 
        send_ipp_status(con, IPP_NOT_FOUND,
-                       _("The printer or class was not found."));
+                       _("The printer or class does not exist."));
        return;
       }
+      else if (dtype & CUPS_PRINTER_CLASS)
+      {
+        send_ipp_status(con, IPP_BAD_REQUEST,
+                       _("Nested classes are not allowed."));
+        return;
+      }
 
      /*
       * Add it to the class...
@@ -1021,50 +1085,43 @@ add_class(cupsd_client_t  *con,         /* I - Client connection */
 
   set_printer_defaults(con, pclass);
 
+  if ((attr = ippFindAttribute(con->request, "auth-info-required",
+                               IPP_TAG_KEYWORD)) != NULL)
+    cupsdSetAuthInfoRequired(pclass, NULL, attr);
+
  /*
   * Update the printer class attributes and return...
   */
 
   cupsdSetPrinterAttrs(pclass);
-  cupsdSaveAllClasses();
+  cupsdMarkDirty(CUPSD_DIRTY_CLASSES);
 
   if (need_restart_job && pclass->job)
   {
-    cupsd_job_t *job;
-
    /*
-    * Stop the current job and then restart it below...
+    * Reset the current job to a "pending" status...
     */
 
-    job = (cupsd_job_t *)pclass->job;
-
-    cupsdStopJob(job, 1);
-
-    job->state->values[0].integer = IPP_JOB_PENDING;
-    job->state_value              = IPP_JOB_PENDING;
+    cupsdSetJobState(pclass->job, IPP_JOB_PENDING, CUPSD_JOB_FORCE,
+                     "Job restarted because the class was modified.");
   }
 
-  if (need_restart_job)
-    cupsdCheckJobs();
-
-  cupsdWritePrintcap();
+  cupsdMarkDirty(CUPSD_DIRTY_PRINTCAP);
 
   if (modify)
   {
-    cupsdAddEvent(CUPSD_EVENT_PRINTER_MODIFIED, pclass, NULL,
-                  "Class \"%s\" modified by \"%s\".", pclass->name,
-                 get_username(con));
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_MODIFIED,
+                 pclass, NULL, "Class \"%s\" modified by \"%s\".",
+                 pclass->name, get_username(con));
 
     cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" modified by \"%s\".",
                     pclass->name, get_username(con));
   }
   else
   {
-    cupsdAddPrinterHistory(pclass);
-
-    cupsdAddEvent(CUPSD_EVENT_PRINTER_ADDED, pclass, NULL,
-                  "New class \"%s\" added by \"%s\".", pclass->name,
-                 get_username(con));
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_ADDED,
+                 pclass, NULL, "New class \"%s\" added by \"%s\".",
+                 pclass->name, get_username(con));
 
     cupsdLogMessage(CUPSD_LOG_INFO, "New class \"%s\" added by \"%s\".",
                     pclass->name, get_username(con));
@@ -1089,9 +1146,9 @@ add_file(cupsd_client_t *con,             /* I - Connection to client */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
-                 "add_file(con=%p[%d], job=%d, filetype=%s/%s, compression=%d)",
-                 con, con->http.fd, job->id, filetype->super, filetype->type,
-                 compression);
+                 "add_file(con=%p[%d], job=%d, filetype=%s/%s, "
+                 "compression=%d)", con, con ? con->http.fd : -1, job->id,
+                 filetype->super, filetype->type, compression);
 
  /*
   * Add the file to the job...
@@ -1111,22 +1168,32 @@ add_file(cupsd_client_t *con,           /* I - Connection to client */
                                           sizeof(mime_type_t *));
   }
 
+  if (compressions)
+    job->compressions = compressions;
+
+  if (filetypes)
+    job->filetypes = filetypes;
+
   if (!compressions || !filetypes)
   {
-    cupsdCancelJob(job, 1, IPP_JOB_ABORTED);
+    cupsdSetJobState(job, IPP_JOB_ABORTED, CUPSD_JOB_PURGE,
+                     "Job aborted because the scheduler ran out of memory.");
+
+    if (con)
+      send_ipp_status(con, IPP_INTERNAL_ERROR,
+                     _("Unable to allocate memory for file types."));
 
-    send_ipp_status(con, IPP_INTERNAL_ERROR,
-                    _("Unable to allocate memory for file types!"));
     return (-1);
   }
 
-  job->compressions                 = compressions;
   job->compressions[job->num_files] = compression;
-  job->filetypes                    = filetypes;
   job->filetypes[job->num_files]    = filetype;
 
   job->num_files ++;
 
+  job->dirty = 1;
+  cupsdMarkDirty(CUPSD_DIRTY_JOBS);
+
   return (0);
 }
 
@@ -1137,65 +1204,54 @@ add_file(cupsd_client_t *con,           /* I - Connection to client */
 
 static cupsd_job_t *                   /* O - Job object */
 add_job(cupsd_client_t  *con,          /* I - Client connection */
-        ipp_attribute_t *uri,          /* I - printer-uri */
-       cupsd_printer_t **dprinter,     /* I - Destination printer */
+       cupsd_printer_t *printer,       /* I - Destination printer */
        mime_type_t     *filetype)      /* I - First print file type, if any */
 {
   http_status_t        status;                 /* Policy status */
-  ipp_attribute_t *attr;               /* Current attribute */
-  const char   *dest;                  /* Destination */
-  cups_ptype_t dtype;                  /* Destination type (printer or class) */
+  ipp_attribute_t *attr,               /* Current attribute */
+               *auth_info;             /* auth-info attribute */
+  const char   *mandatory;             /* Current mandatory job attribute */
   const char   *val;                   /* Default option value */
   int          priority;               /* Job priority */
-  char         *title;                 /* Job name/title */
   cupsd_job_t  *job;                   /* Current job */
-  char         job_uri[HTTP_MAX_URI],  /* Job URI */
-               method[HTTP_MAX_URI],   /* Method portion of URI */
-               username[HTTP_MAX_URI], /* Username portion of URI */
-               host[HTTP_MAX_URI],     /* Host portion of URI */
-               resource[HTTP_MAX_URI]; /* Resource portion of URI */
-  int          port;                   /* Port portion of URI */
-  cupsd_printer_t *printer;            /* Printer data */
+  char         job_uri[HTTP_MAX_URI];  /* Job URI */
   int          kbytes;                 /* Size of print file */
   int          i;                      /* Looping var */
   int          lowerpagerange;         /* Page range bound */
-
-
-  cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %s)", con,
-                  con->http.fd, uri->values[0].string.text);
-
- /*
-  * Is the destination valid?
-  */
-
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((dest = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
-  {
-   /*
-    * Bad URI...
-    */
-
-    send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
-    return (NULL);
-  }
-
-  if (dprinter)
-    *dprinter = printer;
+  int          exact;                  /* Did we have an exact match? */
+  ipp_attribute_t *media_col,          /* media-col attribute */
+               *media_margin;          /* media-*-margin attribute */
+  ipp_t                *unsup_col;             /* media-col in unsupported response */
+  static const char * const readonly[] =/* List of read-only attributes */
+  {
+    "job-id",
+    "job-k-octets-completed",
+    "job-impressions-completed",
+    "job-media-sheets-completed",
+    "job-state",
+    "job-state-message",
+    "job-state-reasons",
+    "time-at-completed",
+    "time-at-creation",
+    "time-at-processing"
+  };
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %p(%s), %p(%s/%s))",
+                  con, con->http.fd, printer, printer->name,
+                 filetype, filetype ? filetype->super : "none",
+                 filetype ? filetype->type : "none");
 
  /*
   * Check remote printing to non-shared printer...
   */
 
   if (!printer->shared &&
-      strcasecmp(con->http.hostname, "localhost") &&
-      strcasecmp(con->http.hostname, ServerName))
+      _cups_strcasecmp(con->http.hostname, "localhost") &&
+      _cups_strcasecmp(con->http.hostname, ServerName))
   {
     send_ipp_status(con, IPP_NOT_AUTHORIZED,
-                    _("The printer or class is not shared!"));
+                    _("The printer or class is not shared."));
     return (NULL);
   }
 
@@ -1203,16 +1259,32 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
   * Check policy...
   */
 
+  auth_info = ippFindAttribute(con->request, "auth-info", IPP_TAG_TEXT);
+
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
+    return (NULL);
+  }
+  else if (printer->num_auth_info_required == 1 &&
+           !strcmp(printer->auth_info_required[0], "negotiate") &&
+           !con->username[0])
+  {
+    send_http_error(con, HTTP_UNAUTHORIZED, printer);
     return (NULL);
   }
-  else if ((printer->type & CUPS_PRINTER_AUTHENTICATED) && !con->username[0])
+#ifdef HAVE_SSL
+  else if (auth_info && !con->http.tls &&
+           !httpAddrLocalhost(con->http.hostaddr))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+   /*
+    * Require encryption of auth-info over non-local connections...
+    */
+
+    send_http_error(con, HTTP_UPGRADE_REQUIRED, printer);
     return (NULL);
   }
+#endif /* HAVE_SSL */
 
  /*
   * See if the printer is accepting jobs...
@@ -1222,15 +1294,57 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
   {
     send_ipp_status(con, IPP_NOT_ACCEPTING,
                     _("Destination \"%s\" is not accepting jobs."),
-                    dest);
+                    printer->name);
     return (NULL);
   }
 
  /*
   * Validate job template attributes; for now just document-format,
-  * copies, and page-ranges...
+  * copies, job-sheets, number-up, page-ranges, mandatory attributes, and
+  * media...
   */
 
+  for (i = 0; i < (int)(sizeof(readonly) / sizeof(readonly[0])); i ++)
+  {
+    if ((attr = ippFindAttribute(con->request, readonly[i],
+                                 IPP_TAG_ZERO)) != NULL)
+    {
+      ippDeleteAttribute(con->request, attr);
+
+      if (StrictConformance)
+      {
+       send_ipp_status(con, IPP_BAD_REQUEST,
+                       _("The '%s' Job Description attribute cannot be "
+                         "supplied in a job creation request."), readonly[i]);
+       return (NULL);
+      }
+
+      cupsdLogMessage(CUPSD_LOG_INFO,
+                      "Unexpected '%s' Job Description attribute in a job "
+                      "creation request.", readonly[i]);
+    }
+  }
+
+  if (printer->pc)
+  {
+    for (mandatory = (char *)cupsArrayFirst(printer->pc->mandatory);
+        mandatory;
+        mandatory = (char *)cupsArrayNext(printer->pc->mandatory))
+    {
+      if (!ippFindAttribute(con->request, mandatory, IPP_TAG_ZERO))
+      {
+       /*
+       * Missing a required attribute...
+       */
+
+       send_ipp_status(con, IPP_CONFLICT,
+                       _("The \"%s\" attribute is required for print jobs."),
+                       mandatory);
+       return (NULL);
+      }
+    }
+  }
+
   if (filetype && printer->filetypes &&
       !cupsArrayFind(printer->filetypes, filetype))
   {
@@ -1242,7 +1356,7 @@ add_job(cupsd_client_t  *con,             /* I - Client connection */
              filetype->type);
 
     send_ipp_status(con, IPP_DOCUMENT_FORMAT,
-                    _("Unsupported format \'%s\'!"), mimetype);
+                    _("Unsupported format \"%s\"."), mimetype);
 
     ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_MIMETYPE,
                  "document-format", NULL, mimetype);
@@ -1263,12 +1377,58 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
     }
   }
 
+  if ((attr = ippFindAttribute(con->request, "job-sheets",
+                               IPP_TAG_ZERO)) != NULL)
+  {
+    if (attr->value_tag != IPP_TAG_KEYWORD &&
+        attr->value_tag != IPP_TAG_NAME)
+    {
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-sheets value type."));
+      return (NULL);
+    }
+
+    if (attr->num_values > 2)
+    {
+      send_ipp_status(con, IPP_BAD_REQUEST,
+                      _("Too many job-sheets values (%d > 2)."),
+                     attr->num_values);
+      return (NULL);
+    }
+
+    for (i = 0; i < attr->num_values; i ++)
+      if (strcmp(attr->values[i].string.text, "none") &&
+          !cupsdFindBanner(attr->values[i].string.text))
+      {
+       send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-sheets value \"%s\"."),
+                       attr->values[i].string.text);
+       return (NULL);
+      }
+  }
+
+  if ((attr = ippFindAttribute(con->request, "number-up",
+                               IPP_TAG_INTEGER)) != NULL)
+  {
+    if (attr->values[0].integer != 1 &&
+        attr->values[0].integer != 2 &&
+        attr->values[0].integer != 4 &&
+        attr->values[0].integer != 6 &&
+        attr->values[0].integer != 9 &&
+        attr->values[0].integer != 16)
+    {
+      send_ipp_status(con, IPP_ATTRIBUTES, _("Bad number-up value %d."),
+                      attr->values[0].integer);
+      ippAddInteger(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_INTEGER,
+                   "number-up", attr->values[0].integer);
+      return (NULL);
+    }
+  }
+
   if ((attr = ippFindAttribute(con->request, "page-ranges",
                                IPP_TAG_RANGE)) != NULL)
   {
     for (i = 0, lowerpagerange = 1; i < attr->num_values; i ++)
     {
-      if (attr->values[i].range.lower < lowerpagerange || 
+      if (attr->values[i].range.lower < lowerpagerange ||
          attr->values[i].range.lower > attr->values[i].range.upper)
       {
        send_ipp_status(con, IPP_BAD_REQUEST,
@@ -1282,6 +1442,51 @@ add_job(cupsd_client_t  *con,            /* I - Client connection */
     }
   }
 
+ /*
+  * Do media selection as needed...
+  */
+
+  if (!ippFindAttribute(con->request, "PageRegion", IPP_TAG_ZERO) &&
+      !ippFindAttribute(con->request, "PageSize", IPP_TAG_ZERO) &&
+      _ppdCacheGetPageSize(printer->pc, con->request, NULL, &exact))
+  {
+    if (!exact &&
+        (media_col = ippFindAttribute(con->request, "media-col",
+                                     IPP_TAG_BEGIN_COLLECTION)) != NULL)
+    {
+      send_ipp_status(con, IPP_OK_SUBST, _("Unsupported margins."));
+
+      unsup_col = ippNew();
+      if ((media_margin = ippFindAttribute(media_col->values[0].collection,
+                                           "media-bottom-margin",
+                                          IPP_TAG_INTEGER)) != NULL)
+        ippAddInteger(unsup_col, IPP_TAG_ZERO, IPP_TAG_INTEGER,
+                     "media-bottom-margin", media_margin->values[0].integer);
+
+      if ((media_margin = ippFindAttribute(media_col->values[0].collection,
+                                           "media-left-margin",
+                                          IPP_TAG_INTEGER)) != NULL)
+        ippAddInteger(unsup_col, IPP_TAG_ZERO, IPP_TAG_INTEGER,
+                     "media-left-margin", media_margin->values[0].integer);
+
+      if ((media_margin = ippFindAttribute(media_col->values[0].collection,
+                                           "media-right-margin",
+                                          IPP_TAG_INTEGER)) != NULL)
+        ippAddInteger(unsup_col, IPP_TAG_ZERO, IPP_TAG_INTEGER,
+                     "media-right-margin", media_margin->values[0].integer);
+
+      if ((media_margin = ippFindAttribute(media_col->values[0].collection,
+                                           "media-top-margin",
+                                          IPP_TAG_INTEGER)) != NULL)
+        ippAddInteger(unsup_col, IPP_TAG_ZERO, IPP_TAG_INTEGER,
+                     "media-top-margin", media_margin->values[0].integer);
+
+      ippAddCollection(con->response, IPP_TAG_UNSUPPORTED_GROUP, "media-col",
+                       unsup_col);
+      ippDelete(unsup_col);
+    }
+  }
+
  /*
   * Make sure we aren't over our limit...
   */
@@ -1289,18 +1494,22 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
   if (MaxJobs && cupsArrayCount(Jobs) >= MaxJobs)
     cupsdCleanJobs();
 
-  if (cupsArrayCount(Jobs) >= MaxJobs && MaxJobs)
+  if (MaxJobs && cupsArrayCount(Jobs) >= MaxJobs)
   {
-    send_ipp_status(con, IPP_NOT_POSSIBLE,
-                    _("Too many active jobs."));
+    send_ipp_status(con, IPP_NOT_POSSIBLE, _("Too many active jobs."));
     return (NULL);
   }
 
-  if (!check_quotas(con, printer))
+  if ((i = check_quotas(con, printer)) < 0)
   {
     send_ipp_status(con, IPP_NOT_POSSIBLE, _("Quota limit reached."));
     return (NULL);
   }
+  else if (i == 0)
+  {
+    send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Not allowed to print."));
+    return (NULL);
+  }
 
  /*
   * Create the job and set things up...
@@ -1321,25 +1530,44 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
                   priority);
   }
 
-  if ((attr = ippFindAttribute(con->request, "job-name",
-                               IPP_TAG_NAME)) != NULL)
-    title = attr->values[0].string.text;
-  else
+  if ((attr = ippFindAttribute(con->request, "job-name", IPP_TAG_ZERO)) == NULL)
     ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL,
-                 title = "Untitled");
+                 "Untitled");
+  else if ((attr->value_tag != IPP_TAG_NAME &&
+            attr->value_tag != IPP_TAG_NAMELANG) ||
+           attr->num_values != 1)
+  {
+    send_ipp_status(con, IPP_ATTRIBUTES,
+                    _("Bad job-name value: Wrong type or count."));
+    if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
+      attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+    return (NULL);
+  }
+  else if (!ippValidateAttribute(attr))
+  {
+    send_ipp_status(con, IPP_ATTRIBUTES, _("Bad job-name value: %s"),
+                    cupsLastErrorString());
+    if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
+      attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+    return (NULL);
+  }
 
   if ((job = cupsdAddJob(priority, printer->name)) == NULL)
   {
     send_ipp_status(con, IPP_INTERNAL_ERROR,
-                    _("Unable to add job for destination \"%s\"!"), dest);
+                    _("Unable to add job for destination \"%s\"."),
+                   printer->name);
     return (NULL);
   }
 
-  job->dtype   = dtype;
+  job->dtype   = printer->type & (CUPS_PRINTER_CLASS | CUPS_PRINTER_REMOTE);
   job->attrs   = con->request;
+  job->dirty   = 1;
   con->request = ippNewRequest(job->attrs->request.op.operation_id);
 
-  add_job_uuid(con, job);
+  cupsdMarkDirty(CUPSD_DIRTY_JOBS);
+
+  add_job_uuid(job);
   apply_printer_defaults(printer, job);
 
   attr = ippFindAttribute(job->attrs, "requesting-user-name", IPP_TAG_NAME);
@@ -1350,8 +1578,6 @@ add_job(cupsd_client_t  *con,             /* I - Client connection */
 
     if (attr)
       cupsdSetString(&attr->values[0].string.text, con->username);
-
-    save_auth_info(con, job);
   }
   else if (attr)
   {
@@ -1374,6 +1600,18 @@ add_job(cupsd_client_t  *con,            /* I - Client connection */
     attr->name = _cupsStrAlloc("job-originating-user-name");
   }
 
+  if (con->username[0] || auth_info)
+  {
+    save_auth_info(con, job, auth_info);
+
+   /*
+    * Remove the auth-info attribute from the attribute data...
+    */
+
+    if (auth_info)
+      ippDeleteAttribute(job->attrs, auth_info);
+  }
+
   if ((attr = ippFindAttribute(job->attrs, "job-originating-host-name",
                                IPP_TAG_ZERO)) != NULL)
   {
@@ -1411,10 +1649,10 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
            {
              _cupsStrFree(attr->values[i].string.text);
              attr->values[i].string.text = NULL;
-             if (attr->values[i].string.charset)
+             if (attr->values[i].string.language)
              {
-               _cupsStrFree(attr->values[i].string.charset);
-               attr->values[i].string.charset = NULL;
+               _cupsStrFree(attr->values[i].string.language);
+               attr->values[i].string.language = NULL;
              }
             }
 
@@ -1440,7 +1678,7 @@ add_job(cupsd_client_t  *con,             /* I - Client connection */
     * the connection...
     */
 
-    ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_NAME, 
+    ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_NAME,
                 "job-originating-host-name", NULL, con->http.hostname);
   }
 
@@ -1461,19 +1699,18 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
   job->state = ippAddInteger(job->attrs, IPP_TAG_JOB, IPP_TAG_ENUM,
                              "job-state", IPP_JOB_STOPPED);
   job->state_value = (ipp_jstate_t)job->state->values[0].integer;
+  job->reasons = ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_KEYWORD,
+                              "job-state-reasons", NULL, "job-incoming");
   job->sheets = ippAddInteger(job->attrs, IPP_TAG_JOB, IPP_TAG_INTEGER,
                               "job-media-sheets-completed", 0);
   ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_URI, "job-printer-uri", NULL,
                printer->uri);
-  ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL,
-               title);
 
   if ((attr = ippFindAttribute(job->attrs, "job-k-octets",
                                IPP_TAG_INTEGER)) != NULL)
     attr->values[0].integer = 0;
   else
-    attr = ippAddInteger(job->attrs, IPP_TAG_JOB, IPP_TAG_INTEGER,
-                         "job-k-octets", 0);
+    ippAddInteger(job->attrs, IPP_TAG_JOB, IPP_TAG_INTEGER, "job-k-octets", 0);
 
   if ((attr = ippFindAttribute(job->attrs, "job-hold-until",
                                IPP_TAG_KEYWORD)) == NULL)
@@ -1487,21 +1724,22 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
     attr = ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_KEYWORD,
                         "job-hold-until", NULL, val);
   }
-  if (attr && strcmp(attr->values[0].string.text, "no-hold") &&
-      !(printer->type & CUPS_PRINTER_REMOTE))
+  if (attr && strcmp(attr->values[0].string.text, "no-hold"))
   {
    /*
     * Hold job until specified time...
     */
 
-    cupsdSetJobHoldUntil(job, attr->values[0].string.text);
+    cupsdSetJobHoldUntil(job, attr->values[0].string.text, 0);
 
     job->state->values[0].integer = IPP_JOB_HELD;
     job->state_value              = IPP_JOB_HELD;
+
+    ippSetString(job->attrs, &job->reasons, 0, "job-hold-until-specified");
   }
   else if (job->attrs->request.op.operation_id == IPP_CREATE_JOB)
   {
-    job->hold_until               = time(NULL) + 60;
+    job->hold_until               = time(NULL) + MultipleOperationTimeout;
     job->state->values[0].integer = IPP_JOB_HELD;
     job->state_value              = IPP_JOB_HELD;
   }
@@ -1509,10 +1747,11 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
   {
     job->state->values[0].integer = IPP_JOB_PENDING;
     job->state_value              = IPP_JOB_PENDING;
+
+    ippSetString(job->attrs, &job->reasons, 0, "none");
   }
 
-  if (!(printer->type & (CUPS_PRINTER_REMOTE | CUPS_PRINTER_IMPLICIT)) ||
-      Classification)
+  if (!(printer->type & CUPS_PRINTER_REMOTE) || Classification)
   {
    /*
     * Add job sheets options...
@@ -1527,8 +1766,8 @@ add_job(cupsd_client_t  *con,             /* I - Client connection */
 
       attr = ippAddStrings(job->attrs, IPP_TAG_JOB, IPP_TAG_NAME, "job-sheets",
                            2, NULL, NULL);
-      attr->values[0].string.text = _cupsStrAlloc(printer->job_sheets[0]);
-      attr->values[1].string.text = _cupsStrAlloc(printer->job_sheets[1]);
+      attr->values[0].string.text = _cupsStrRetain(printer->job_sheets[0]);
+      attr->values[1].string.text = _cupsStrRetain(printer->job_sheets[1]);
     }
 
     job->job_sheets = attr;
@@ -1556,10 +1795,10 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
 
           cupsdSetString(&attr->values[0].string.text, Classification);
 
-         cupsdLogMessage(CUPSD_LOG_NOTICE, "[Job %d] CLASSIFICATION FORCED "
-                                           "job-sheets=\"%s,none\", "
-                                           "job-originating-user-name=\"%s\"",
-                        job->id, Classification, job->username);
+         cupsdLogJob(job, CUPSD_LOG_NOTICE, "CLASSIFICATION FORCED "
+                                            "job-sheets=\"%s,none\", "
+                                            "job-originating-user-name=\"%s\"",
+                     Classification, job->username);
        }
        else if (attr->num_values == 2 &&
                 strcmp(attr->values[0].string.text,
@@ -1573,11 +1812,11 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
 
           cupsdSetString(&attr->values[1].string.text, attr->values[0].string.text);
 
-         cupsdLogMessage(CUPSD_LOG_NOTICE, "[Job %d] CLASSIFICATION FORCED "
-                                           "job-sheets=\"%s,%s\", "
-                                           "job-originating-user-name=\"%s\"",
-                        job->id, attr->values[0].string.text,
-                        attr->values[1].string.text, job->username);
+         cupsdLogJob(job, CUPSD_LOG_NOTICE, "CLASSIFICATION FORCED "
+                                            "job-sheets=\"%s,%s\", "
+                                            "job-originating-user-name=\"%s\"",
+                     attr->values[0].string.text,
+                     attr->values[1].string.text, job->username);
        }
        else if (strcmp(attr->values[0].string.text, Classification) &&
                 strcmp(attr->values[0].string.text, "none") &&
@@ -1586,18 +1825,18 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
                   strcmp(attr->values[1].string.text, "none"))))
         {
          if (attr->num_values == 1)
-            cupsdLogMessage(CUPSD_LOG_NOTICE,
-                           "[Job %d] CLASSIFICATION OVERRIDDEN "
-                           "job-sheets=\"%s\", "
-                           "job-originating-user-name=\"%s\"",
-                      job->id, attr->values[0].string.text, job->username);
+            cupsdLogJob(job, CUPSD_LOG_NOTICE,
+                       "CLASSIFICATION OVERRIDDEN "
+                       "job-sheets=\"%s\", "
+                       "job-originating-user-name=\"%s\"",
+                       attr->values[0].string.text, job->username);
           else
-            cupsdLogMessage(CUPSD_LOG_NOTICE,
-                           "[Job %d] CLASSIFICATION OVERRIDDEN "
-                           "job-sheets=\"%s,%s\",fffff "
-                           "job-originating-user-name=\"%s\"",
-                           job->id, attr->values[0].string.text,
-                           attr->values[1].string.text, job->username);
+            cupsdLogJob(job, CUPSD_LOG_NOTICE,
+                       "CLASSIFICATION OVERRIDDEN "
+                       "job-sheets=\"%s,%s\",fffff "
+                       "job-originating-user-name=\"%s\"",
+                       attr->values[0].string.text,
+                       attr->values[1].string.text, job->username);
         }
       }
       else if (strcmp(attr->values[0].string.text, Classification) &&
@@ -1626,18 +1865,18 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
         }
 
         if (attr->num_values > 1)
-         cupsdLogMessage(CUPSD_LOG_NOTICE,
-                         "[Job %d] CLASSIFICATION FORCED "
-                         "job-sheets=\"%s,%s\", "
-                         "job-originating-user-name=\"%s\"",
-                         job->id, attr->values[0].string.text,
-                         attr->values[1].string.text, job->username);
+         cupsdLogJob(job, CUPSD_LOG_NOTICE,
+                     "CLASSIFICATION FORCED "
+                     "job-sheets=\"%s,%s\", "
+                     "job-originating-user-name=\"%s\"",
+                     attr->values[0].string.text,
+                     attr->values[1].string.text, job->username);
         else
-         cupsdLogMessage(CUPSD_LOG_NOTICE,
-                         "[Job %d] CLASSIFICATION FORCED "
-                         "job-sheets=\"%s\", "
-                         "job-originating-user-name=\"%s\"",
-                        job->id, Classification, job->username);
+         cupsdLogJob(job, CUPSD_LOG_NOTICE,
+                     "CLASSIFICATION FORCED "
+                     "job-sheets=\"%s\", "
+                     "job-originating-user-name=\"%s\"",
+                     Classification, job->username);
       }
     }
 
@@ -1645,28 +1884,32 @@ add_job(cupsd_client_t  *con,           /* I - Client connection */
     * See if we need to add the starting sheet...
     */
 
-    if (!(printer->type & (CUPS_PRINTER_REMOTE | CUPS_PRINTER_IMPLICIT)))
+    if (!(printer->type & CUPS_PRINTER_REMOTE))
     {
-      cupsdLogMessage(CUPSD_LOG_INFO,
-                      "Adding start banner page \"%s\" to job %d.",
-                      attr->values[0].string.text, job->id);
+      cupsdLogJob(job, CUPSD_LOG_INFO, "Adding start banner page \"%s\".",
+                 attr->values[0].string.text);
 
-      kbytes = copy_banner(con, job, attr->values[0].string.text);
+      if ((kbytes = copy_banner(con, job, attr->values[0].string.text)) < 0)
+      {
+        cupsdSetJobState(job, IPP_JOB_ABORTED, CUPSD_JOB_PURGE,
+                        "Aborting job because the start banner could not be "
+                        "copied.");
+        return (NULL);
+      }
 
       cupsdUpdateQuota(printer, job->username, 0, kbytes);
     }
   }
   else if ((attr = ippFindAttribute(job->attrs, "job-sheets",
                                     IPP_TAG_ZERO)) != NULL)
-    job->sheets = attr;
+    job->job_sheets = attr;
 
  /*
   * Fill in the response info...
   */
 
-  snprintf(job_uri, sizeof(job_uri), "http://%s:%d/jobs/%d", ServerName,
-          LocalPort, job->id);
-
+  httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "ipp", NULL,
+                   con->clientname, con->clientport, "/jobs/%d", job->id);
   ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI, "job-uri", NULL,
                job_uri);
 
@@ -1674,7 +1917,8 @@ add_job(cupsd_client_t  *con,             /* I - Client connection */
 
   ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_ENUM, "job-state",
                 job->state_value);
-  add_job_state_reasons(con, job);
+  ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD, "job-state-reasons",
+               NULL, job->reasons->values[0].string.text);
 
   con->response->request.status.status_code = IPP_OK;
 
@@ -1706,76 +1950,7 @@ add_job(cupsd_client_t  *con,            /* I - Client connection */
 
 
 /*
- * 'add_job_state_reasons()' - Add the "job-state-reasons" attribute based
- *                             upon the job and printer state...
- */
-
-static void
-add_job_state_reasons(
-    cupsd_client_t *con,               /* I - Client connection */
-    cupsd_job_t    *job)               /* I - Job info */
-{
-  cupsd_printer_t      *dest;          /* Destination printer */
-
-
-  cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job_state_reasons(%p[%d], %d)",
-                  con, con->http.fd, job ? job->id : 0);
-
-  switch (job ? job->state_value : IPP_JOB_CANCELED)
-  {
-    case IPP_JOB_PENDING :
-       dest = cupsdFindDest(job->dest);
-
-        if (dest && dest->state == IPP_PRINTER_STOPPED)
-          ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                      "job-state-reasons", NULL, "printer-stopped");
-        else
-          ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                      "job-state-reasons", NULL, "none");
-        break;
-
-    case IPP_JOB_HELD :
-        if (ippFindAttribute(job->attrs, "job-hold-until",
-                            IPP_TAG_KEYWORD) != NULL ||
-           ippFindAttribute(job->attrs, "job-hold-until",
-                            IPP_TAG_NAME) != NULL)
-          ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                      "job-state-reasons", NULL, "job-hold-until-specified");
-        else
-          ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                      "job-state-reasons", NULL, "job-incoming");
-        break;
-
-    case IPP_JOB_PROCESSING :
-        ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                    "job-state-reasons", NULL, "job-printing");
-        break;
-
-    case IPP_JOB_STOPPED :
-        ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                    "job-state-reasons", NULL, "job-stopped");
-        break;
-
-    case IPP_JOB_CANCELED :
-        ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                    "job-state-reasons", NULL, "job-canceled-by-user");
-        break;
-
-    case IPP_JOB_ABORTED :
-        ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                    "job-state-reasons", NULL, "aborted-by-system");
-        break;
-
-    case IPP_JOB_COMPLETED :
-        ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD,
-                    "job-state-reasons", NULL, "job-completed-successfully");
-        break;
-  }
-}
-
-
-/*
- * 'add_job_subscriptions()' - Add any subcriptions for a job.
+ * 'add_job_subscriptions()' - Add any subscriptions for a job.
  */
 
 static void
@@ -1800,9 +1975,7 @@ add_job_subscriptions(
   * none...
   */
 
-  for (attr = job->attrs->attrs, prev = NULL;
-       attr;
-       prev = attr, attr = attr->next)
+  for (attr = job->attrs->attrs; attr; attr = attr->next)
     if (attr->group_tag == IPP_TAG_SUBSCRIPTION)
       break;
 
@@ -1823,19 +1996,79 @@ add_job_subscriptions(
 
     while (attr && attr->group_tag != IPP_TAG_ZERO)
     {
-      if (!strcmp(attr->name, "notify-recipient") &&
+      if (!strcmp(attr->name, "notify-recipient-uri") &&
           attr->value_tag == IPP_TAG_URI)
+      {
+       /*
+        * Validate the recipient scheme against the ServerBin/notifier
+       * directory...
+       */
+
+       char    notifier[1024],         /* Notifier filename */
+               scheme[HTTP_MAX_URI],   /* Scheme portion of URI */
+               userpass[HTTP_MAX_URI], /* Username portion of URI */
+               host[HTTP_MAX_URI],     /* Host portion of URI */
+               resource[HTTP_MAX_URI]; /* Resource portion of URI */
+        int    port;                   /* Port portion of URI */
+
+
         recipient = attr->values[0].string.text;
+
+       if (httpSeparateURI(HTTP_URI_CODING_ALL, recipient,
+                           scheme, sizeof(scheme), userpass, sizeof(userpass),
+                           host, sizeof(host), &port,
+                           resource, sizeof(resource)) < HTTP_URI_OK)
+        {
+          send_ipp_status(con, IPP_NOT_POSSIBLE,
+                         _("Bad notify-recipient-uri \"%s\"."), recipient);
+         ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
+                       "notify-status-code", IPP_URI_SCHEME);
+         return;
+       }
+
+        snprintf(notifier, sizeof(notifier), "%s/notifier/%s", ServerBin,
+                scheme);
+        if (access(notifier, X_OK))
+       {
+          send_ipp_status(con, IPP_NOT_POSSIBLE,
+                         _("notify-recipient-uri URI \"%s\" uses unknown "
+                           "scheme."), recipient);
+         ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
+                       "notify-status-code", IPP_URI_SCHEME);
+         return;
+       }
+
+        if (!strcmp(scheme, "rss") && !check_rss_recipient(recipient))
+       {
+          send_ipp_status(con, IPP_NOT_POSSIBLE,
+                         _("notify-recipient-uri URI \"%s\" is already used."),
+                         recipient);
+         ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
+                       "notify-status-code", IPP_ATTRIBUTES);
+         return;
+       }
+      }
       else if (!strcmp(attr->name, "notify-pull-method") &&
                attr->value_tag == IPP_TAG_KEYWORD)
+      {
         pullmethod = attr->values[0].string.text;
+
+        if (strcmp(pullmethod, "ippget"))
+       {
+          send_ipp_status(con, IPP_NOT_POSSIBLE,
+                         _("Bad notify-pull-method \"%s\"."), pullmethod);
+         ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
+                       "notify-status-code", IPP_ATTRIBUTES);
+         return;
+       }
+      }
       else if (!strcmp(attr->name, "notify-charset") &&
                attr->value_tag == IPP_TAG_CHARSET &&
               strcmp(attr->values[0].string.text, "us-ascii") &&
               strcmp(attr->values[0].string.text, "utf-8"))
       {
         send_ipp_status(con, IPP_CHARSET,
-                       _("Character set \"%s\" not supported!"),
+                       _("Character set \"%s\" not supported."),
                        attr->values[0].string.text);
        return;
       }
@@ -1844,7 +2077,7 @@ add_job_subscriptions(
                strcmp(attr->values[0].string.text, DefaultLanguage)))
       {
         send_ipp_status(con, IPP_CHARSET,
-                       _("Language \"%s\" not supported!"),
+                       _("Language \"%s\" not supported."),
                        attr->values[0].string.text);
        return;
       }
@@ -1855,7 +2088,7 @@ add_job_subscriptions(
        {
           send_ipp_status(con, IPP_REQUEST_VALUE,
                          _("The notify-user-data value is too large "
-                           "(%d > 63 octets)!"),
+                           "(%d > 63 octets)."),
                          attr->values[0].unknown.length);
          return;
        }
@@ -1888,32 +2121,39 @@ add_job_subscriptions(
     if (mask == CUPSD_EVENT_NONE)
       mask = CUPSD_EVENT_JOB_COMPLETED;
 
-    sub = cupsdAddSubscription(mask, cupsdFindDest(job->dest), job, recipient,
-                               0);
+    if ((sub = cupsdAddSubscription(mask, cupsdFindDest(job->dest), job,
+                                    recipient, 0)) != NULL)
+    {
+      sub->interval = interval;
 
-    sub->interval = interval;
+      cupsdSetString(&sub->owner, job->username);
 
-    cupsdSetString(&sub->owner, job->username);
+      if (user_data)
+      {
+       sub->user_data_len = user_data->values[0].unknown.length;
+       memcpy(sub->user_data, user_data->values[0].unknown.data,
+              sub->user_data_len);
+      }
 
-    if (user_data)
-    {
-      sub->user_data_len = user_data->values[0].unknown.length;
-      memcpy(sub->user_data, user_data->values[0].unknown.data,
-             sub->user_data_len);
-    }
+      ippAddSeparator(con->response);
+      ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
+                   "notify-subscription-id", sub->id);
 
-    ippAddSeparator(con->response);
-    ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
-                  "notify-subscription-id", sub->id);
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Added subscription %d for job %d",
+                      sub->id, job->id);
+    }
 
     if (attr)
       attr = attr->next;
   }
 
-  cupsdSaveAllSubscriptions();
+  cupsdMarkDirty(CUPSD_DIRTY_SUBSCRIPTIONS);
 
  /*
   * Remove all of the subscription attributes from the job request...
+  *
+  * TODO: Optimize this since subscription groups have to come at the
+  * end of the request...
   */
 
   for (attr = job->attrs->attrs, prev = NULL; attr; attr = next)
@@ -1927,7 +2167,7 @@ add_job_subscriptions(
       * Free and remove this attribute...
       */
 
-      _ippFreeAttr(attr);
+      ippDeleteAttribute(NULL, attr);
 
       if (prev)
         prev->next = next;
@@ -1950,48 +2190,19 @@ add_job_subscriptions(
  */
 
 static void
-add_job_uuid(cupsd_client_t *con,      /* I - Client connection */
-             cupsd_job_t    *job)      /* I - Job */
+add_job_uuid(cupsd_job_t *job)         /* I - Job */
 {
-  char                 uuid[1024];     /* job-uuid string */
-  _cups_md5_state_t    md5state;       /* MD5 state */
-  unsigned char                md5sum[16];     /* MD5 digest/sum */
-
-
- /*
-  * First see if the job already has a job-uuid attribute; if so, return...
-  */
-
-  if (ippFindAttribute(job->attrs, "job-uuid", IPP_TAG_URI))
-    return;
-
- /*
-  * No job-uuid attribute, so build a version 3 UUID with the local job
-  * ID at the end; see RFC 4122 for details.  Start with the MD5 sum of
-  * the ServerName, server name and port that the client connected to,
-  * and local job ID...
-  */
+  char                 uuid[64];       /* job-uuid string */
 
-  snprintf(uuid, sizeof(uuid), "%s:%s:%d:%d", ServerName, con->servername,
-          con->serverport, job->id);
-
-  _cupsMD5Init(&md5state);
-  _cupsMD5Append(&md5state, (unsigned char *)uuid, strlen(uuid));
-  _cupsMD5Finish(&md5state, md5sum);
 
  /*
-  * Format the UUID URI using the MD5 sum and job ID.
+  * Add a job-uuid attribute if none exists...
   */
 
-  snprintf(uuid, sizeof(uuid),
-           "urn:uuid:%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
-          "%02x%02x%02x%02x%02x%02x",
-          md5sum[0], md5sum[1], md5sum[2], md5sum[3], md5sum[4], md5sum[5],
-          (md5sum[6] & 15) | 0x30, md5sum[7], (md5sum[8] & 0x3f) | 0x40,
-          md5sum[9], md5sum[10], md5sum[11], md5sum[12], md5sum[13],
-          md5sum[14], md5sum[15]);
-
-  ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_URI, "job-uuid", NULL, uuid);
+  if (!ippFindAttribute(job->attrs, "job-uuid", IPP_TAG_URI))
+    ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_URI, "job-uuid", NULL,
+                _httpAssembleUUID(ServerName, RemotePort, job->dest, job->id,
+                                  uuid, sizeof(uuid)));
 }
 
 
@@ -2005,7 +2216,7 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
 {
   http_status_t        status;                 /* Policy status */
   int          i;                      /* Looping var */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Method portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
@@ -2017,8 +2228,10 @@ add_printer(cupsd_client_t  *con,        /* I - Client connection */
   char         srcfile[1024],          /* Source Script/PPD file */
                dstfile[1024];          /* Destination Script/PPD file */
   int          modify;                 /* Non-zero if we are modifying */
-  char         newname[IPP_MAX_NAME];  /* New printer name */
-  int          need_restart_job;       /* Need to restart job? */
+  int          changed_driver,         /* Changed the PPD/interface script? */
+               need_restart_job,       /* Need to restart job? */
+               set_device_uri,         /* Did we set the device URI? */
+               set_port_monitor;       /* Did we set the port monitor? */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_printer(%p[%d], %s)", con,
@@ -2028,8 +2241,8 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
   * Do we have a valid URI?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
+  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                  sizeof(scheme), username, sizeof(username), host,
                  sizeof(host), &port, resource, sizeof(resource));
 
   if (strncmp(resource, "/printers/", 10) || strlen(resource) == 10)
@@ -2060,16 +2273,6 @@ add_printer(cupsd_client_t  *con,        /* I - Client connection */
     return;
   }
 
- /*
-  * Check policy...
-  */
-
-  if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
-  {
-    send_http_error(con, status);
-    return;
-  }
-
  /*
   * See if the printer already exists; if not, create a new printer...
   */
@@ -2080,63 +2283,36 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
     * Printer doesn't exist; see if we have a class of the same name...
     */
 
-    if ((printer = cupsdFindClass(resource + 10)) != NULL &&
-        !(printer->type & CUPS_PRINTER_REMOTE))
+    if ((printer = cupsdFindClass(resource + 10)) != NULL)
     {
      /*
       * Yes, return an error...
       */
 
       send_ipp_status(con, IPP_NOT_POSSIBLE,
-                      _("A class named \"%s\" already exists!"),
+                      _("A class named \"%s\" already exists."),
                      resource + 10);
       return;
     }
 
    /*
-    * No, add the printer...
-    */
-
-    printer = cupsdAddPrinter(resource + 10);
-    modify  = 0;
-  }
-  else if (printer->type & CUPS_PRINTER_IMPLICIT)
-  {
-   /*
-    * Rename the implicit printer to "AnyPrinter" or delete it...
+    * No, check the default policy then add the printer...
     */
 
-    if (ImplicitAnyClasses)
+    if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
     {
-      snprintf(newname, sizeof(newname), "Any%s", resource + 10);
-      cupsdRenamePrinter(printer, newname);
+      send_http_error(con, status, NULL);
+      return;
     }
-    else
-      cupsdDeletePrinter(printer, 1);
-
-   /*
-    * Add the printer as a new local printer...
-    */
 
     printer = cupsdAddPrinter(resource + 10);
     modify  = 0;
   }
-  else if (printer->type & CUPS_PRINTER_REMOTE)
+  else if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con,
+                                      NULL)) != HTTP_OK)
   {
-   /*
-    * Rename the remote printer to "Printer@server"...
-    */
-
-    snprintf(newname, sizeof(newname), "%s@%s", resource + 10,
-             printer->hostname);
-    cupsdRenamePrinter(printer, newname);
-
-   /*
-    * Add the printer as a new local printer...
-    */
-
-    printer = cupsdAddPrinter(resource + 10);
-    modify  = 0;
+    send_http_error(con, status, printer);
+    return;
   }
   else
     modify = 1;
@@ -2145,6 +2321,7 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
   * Look for attributes and copy them over as needed...
   */
 
+  changed_driver   = 0;
   need_restart_job = 0;
 
   if ((attr = ippFindAttribute(con->request, "printer-location",
@@ -2155,6 +2332,8 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
                                IPP_TAG_TEXT)) != NULL)
     cupsdSetString(&printer->info, attr->values[0].string.text);
 
+  set_device_uri = 0;
+
   if ((attr = ippFindAttribute(con->request, "device-uri",
                                IPP_TAG_URI)) != NULL)
   {
@@ -2162,13 +2341,47 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
     * Do we have a valid device URI?
     */
 
+    http_uri_status_t  uri_status;     /* URI separation status */
+    char               old_device_uri[1024];
+                                       /* Old device URI */
+    static const char * const uri_status_strings[] =
+    {
+      "URI too large.",
+      "Bad arguments to function.",
+      "Bad resource path.",
+      "Bad port number.",
+      "Bad hostname/address.",
+      "Bad username/password.",
+      "Bad URI scheme.",
+      "Bad URI.",
+      "OK",
+      "Missing URI scheme.",
+      "Unknown URI scheme",
+      "Missing resource path."
+    };
+
+
     need_restart_job = 1;
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, attr->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
-                   sizeof(host), &port, resource, sizeof(resource));
+    uri_status = httpSeparateURI(HTTP_URI_CODING_ALL,
+                                attr->values[0].string.text,
+                                scheme, sizeof(scheme),
+                                username, sizeof(username),
+                                host, sizeof(host), &port,
+                                resource, sizeof(resource));
+
+    cupsdLogMessage(CUPSD_LOG_DEBUG,
+                   "%s device-uri: %s", printer->name,
+                   uri_status_strings[uri_status - HTTP_URI_STATUS_OVERFLOW]);
+
+    if (uri_status < HTTP_URI_OK)
+    {
+      send_ipp_status(con, IPP_NOT_POSSIBLE, _("Bad device-uri \"%s\"."),
+                     attr->values[0].string.text);
+      return;
+    }
 
-    if (!strcmp(method, "file"))
+    if (!strcmp(scheme, "file"))
     {
      /*
       * See if the administrator has enabled file devices...
@@ -2181,9 +2394,9 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
        */
 
        send_ipp_status(con, IPP_NOT_POSSIBLE,
-                       _("File device URIs have been disabled! "
+                       _("File device URIs have been disabled. "
                          "To enable, see the FileDevice directive in "
-                         "\"%s/cupsd.conf\"."),
+                         "\"%s/cups-files.conf\"."),
                        ServerRoot);
        return;
       }
@@ -2194,48 +2407,58 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
       * See if the backend exists and is executable...
       */
 
-      snprintf(srcfile, sizeof(srcfile), "%s/backend/%s", ServerBin, method);
+      snprintf(srcfile, sizeof(srcfile), "%s/backend/%s", ServerBin, scheme);
       if (access(srcfile, X_OK))
       {
        /*
         * Could not find device in list!
        */
 
-       send_ipp_status(con, IPP_NOT_POSSIBLE, _("Bad device-uri \"%s\"!"),
-                       attr->values[0].string.text);
+       send_ipp_status(con, IPP_NOT_POSSIBLE,
+                        _("Bad device-uri scheme \"%s\"."), scheme);
        return;
       }
     }
 
+    if (printer->sanitized_device_uri)
+      strlcpy(old_device_uri, printer->sanitized_device_uri,
+              sizeof(old_device_uri));
+    else
+      old_device_uri[0] = '\0';
+
+    cupsdSetDeviceURI(printer, attr->values[0].string.text);
+
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Setting %s device-uri to \"%s\" (was \"%s\".)",
-                   printer->name,
-                   cupsdSanitizeURI(attr->values[0].string.text, line,
-                                    sizeof(line)),
-                   cupsdSanitizeURI(printer->device_uri, resource,
-                                    sizeof(resource)));
+                   printer->name, printer->sanitized_device_uri,
+                   old_device_uri);
 
-    cupsdSetString(&printer->device_uri, attr->values[0].string.text);
+    set_device_uri = 1;
   }
 
+  set_port_monitor = 0;
+
   if ((attr = ippFindAttribute(con->request, "port-monitor",
-                               IPP_TAG_KEYWORD)) != NULL)
+                               IPP_TAG_NAME)) != NULL)
   {
     ipp_attribute_t    *supported;     /* port-monitor-supported attribute */
 
 
     need_restart_job = 1;
 
-    supported = ippFindAttribute(printer->attrs, "port-monitor-supported",
-                                 IPP_TAG_KEYWORD);
-    for (i = 0; i < supported->num_values; i ++)
-      if (!strcmp(supported->values[i].string.text,
-                  attr->values[0].string.text))
-        break;
+    supported = ippFindAttribute(printer->ppd_attrs, "port-monitor-supported",
+                                 IPP_TAG_NAME);
+    if (supported)
+    {
+      for (i = 0; i < supported->num_values; i ++)
+        if (!strcmp(supported->values[i].string.text,
+                    attr->values[0].string.text))
+          break;
+    }
 
-    if (i >= supported->num_values)
+    if (!supported || i >= supported->num_values)
     {
-      send_ipp_status(con, IPP_NOT_POSSIBLE, _("Bad port-monitor \"%s\"!"),
+      send_ipp_status(con, IPP_NOT_POSSIBLE, _("Bad port-monitor \"%s\"."),
                      attr->values[0].string.text);
       return;
     }
@@ -2243,30 +2466,45 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Setting %s port-monitor to \"%s\" (was \"%s\".)",
                     printer->name, attr->values[0].string.text,
-                   printer->port_monitor);
+                   printer->port_monitor ? printer->port_monitor : "none");
 
     if (strcmp(attr->values[0].string.text, "none"))
       cupsdSetString(&printer->port_monitor, attr->values[0].string.text);
     else
       cupsdClearString(&printer->port_monitor);
+
+    set_port_monitor = 1;
   }
 
   if ((attr = ippFindAttribute(con->request, "printer-is-accepting-jobs",
-                               IPP_TAG_BOOLEAN)) != NULL)
+                               IPP_TAG_BOOLEAN)) != NULL &&
+      attr->values[0].boolean != printer->accepting)
   {
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Setting %s printer-is-accepting-jobs to %d (was %d.)",
                     printer->name, attr->values[0].boolean, printer->accepting);
 
     printer->accepting = attr->values[0].boolean;
-    cupsdAddPrinterHistory(printer);
+
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, printer, NULL,
+                  "%s accepting jobs.",
+                 printer->accepting ? "Now" : "No longer");
   }
 
   if ((attr = ippFindAttribute(con->request, "printer-is-shared",
                                IPP_TAG_BOOLEAN)) != NULL)
   {
+    if (attr->values[0].boolean &&
+        printer->num_auth_info_required == 1 &&
+       !strcmp(printer->auth_info_required[0], "negotiate"))
+    {
+      send_ipp_status(con, IPP_BAD_REQUEST,
+                      _("Cannot share a remote Kerberized printer."));
+      return;
+    }
+
     if (printer->shared && !attr->values[0].boolean)
-      cupsdSendBrowseDelete(printer);
+      cupsdDeregisterPrinter(printer, 1);
 
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Setting %s printer-is-shared to %d (was %d.)",
@@ -2281,13 +2519,13 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
     if (attr->values[0].integer != IPP_PRINTER_IDLE &&
         attr->values[0].integer != IPP_PRINTER_STOPPED)
     {
-      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad printer-state value %d!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad printer-state value %d."),
                       attr->values[0].integer);
       return;
     }
 
-    cupsdLogMessage(CUPSD_LOG_INFO, "Setting %s printer-state to %d (was %d.)", printer->name,
-               attr->values[0].integer, printer->state);
+    cupsdLogMessage(CUPSD_LOG_INFO, "Setting %s printer-state to %d (was %d.)",
+                    printer->name, attr->values[0].integer, printer->state);
 
     if (attr->values[0].integer == IPP_PRINTER_STOPPED)
       cupsdStopPrinter(printer, 0);
@@ -2297,16 +2535,67 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
       cupsdSetPrinterState(printer, (ipp_pstate_t)(attr->values[0].integer), 0);
     }
   }
+
   if ((attr = ippFindAttribute(con->request, "printer-state-message",
                                IPP_TAG_TEXT)) != NULL)
   {
     strlcpy(printer->state_message, attr->values[0].string.text,
             sizeof(printer->state_message));
-    cupsdAddPrinterHistory(printer);
+
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, printer, NULL, "%s",
+                  printer->state_message);
+  }
+
+  if ((attr = ippFindAttribute(con->request, "printer-state-reasons",
+                               IPP_TAG_KEYWORD)) != NULL)
+  {
+    if (attr->num_values >
+            (int)(sizeof(printer->reasons) / sizeof(printer->reasons[0])))
+    {
+      send_ipp_status(con, IPP_NOT_POSSIBLE,
+                      _("Too many printer-state-reasons values (%d > %d)."),
+                     attr->num_values,
+                     (int)(sizeof(printer->reasons) /
+                           sizeof(printer->reasons[0])));
+      return;
+    }
+
+    for (i = 0; i < printer->num_reasons; i ++)
+      _cupsStrFree(printer->reasons[i]);
+
+    printer->num_reasons = 0;
+    for (i = 0; i < attr->num_values; i ++)
+    {
+      if (!strcmp(attr->values[i].string.text, "none"))
+        continue;
+
+      printer->reasons[printer->num_reasons] =
+          _cupsStrRetain(attr->values[i].string.text);
+      printer->num_reasons ++;
+
+      if (!strcmp(attr->values[i].string.text, "paused") &&
+          printer->state != IPP_PRINTER_STOPPED)
+      {
+       cupsdLogMessage(CUPSD_LOG_INFO,
+                       "Setting %s printer-state to %d (was %d.)",
+                       printer->name, IPP_PRINTER_STOPPED, printer->state);
+       cupsdStopPrinter(printer, 0);
+      }
+    }
+
+    if (PrintcapFormat == PRINTCAP_PLIST)
+      cupsdMarkDirty(CUPSD_DIRTY_PRINTCAP);
+
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, printer, NULL,
+                  "Printer \"%s\" state changed.", printer->name);
   }
 
   set_printer_defaults(con, printer);
 
+  if ((attr = ippFindAttribute(con->request, "auth-info-required",
+                               IPP_TAG_KEYWORD)) != NULL)
+    cupsdSetAuthInfoRequired(printer, NULL, attr);
+
  /*
   * See if we have all required attributes...
   */
@@ -2321,6 +2610,7 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
   if (con->filename)
   {
     need_restart_job = 1;
+    changed_driver   = 1;
 
     strlcpy(srcfile, con->filename, sizeof(srcfile));
 
@@ -2360,16 +2650,14 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
        if (copy_file(srcfile, dstfile))
        {
           send_ipp_status(con, IPP_INTERNAL_ERROR,
-                         _("Unable to copy interface script - %s!"),
+                         _("Unable to copy interface script - %s"),
                          strerror(errno));
          return;
        }
-       else
-       {
-          cupsdLogMessage(CUPSD_LOG_DEBUG,
-                         "Copied interface script successfully!");
-          chmod(dstfile, 0755);
-       }
+
+       cupsdLogMessage(CUPSD_LOG_DEBUG,
+                       "Copied interface script successfully");
+       chmod(dstfile, 0755);
       }
 
       snprintf(dstfile, sizeof(dstfile), "%s/ppd/%s.ppd", ServerRoot,
@@ -2385,16 +2673,14 @@ add_printer(cupsd_client_t  *con,       /* I - Client connection */
        if (copy_file(srcfile, dstfile))
        {
           send_ipp_status(con, IPP_INTERNAL_ERROR,
-                         _("Unable to copy PPD file - %s!"),
+                         _("Unable to copy PPD file - %s"),
                          strerror(errno));
          return;
        }
-       else
-       {
-          cupsdLogMessage(CUPSD_LOG_DEBUG,
-                         "Copied PPD file successfully!");
-          chmod(dstfile, 0644);
-       }
+
+       cupsdLogMessage(CUPSD_LOG_DEBUG,
+                       "Copied PPD file successfully");
+       chmod(dstfile, 0644);
       }
       else
       {
@@ -2411,6 +2697,7 @@ add_printer(cupsd_client_t  *con, /* I - Client connection */
                                     IPP_TAG_NAME)) != NULL)
   {
     need_restart_job = 1;
+    changed_driver   = 1;
 
     if (!strcmp(attr->values[0].string.text, "raw"))
     {
@@ -2441,62 +2728,113 @@ add_printer(cupsd_client_t  *con,      /* I - Client connection */
 
       if (copy_model(con, attr->values[0].string.text, dstfile))
       {
-        send_ipp_status(con, IPP_INTERNAL_ERROR, _("Unable to copy PPD file!"));
+        send_ipp_status(con, IPP_INTERNAL_ERROR, _("Unable to copy PPD file."));
        return;
       }
-      else
-      {
-        cupsdLogMessage(CUPSD_LOG_DEBUG,
-                       "Copied PPD file successfully!");
-        chmod(dstfile, 0644);
-      }
+
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+                     "Copied PPD file successfully");
+      chmod(dstfile, 0644);
     }
   }
 
- /*
-  * Update the printer attributes and return...
-  */
-
-  cupsdSetPrinterAttrs(printer);
-  cupsdSaveAllPrinters();
-
-  if (need_restart_job && printer->job)
+  if (changed_driver)
   {
-    cupsd_job_t *job;
-
    /*
-    * Stop the current job and then restart it below...
+    * If we changed the PPD/interface script, then remove the printer's cache
+    * file and clear the printer-state-reasons...
     */
 
-    job = (cupsd_job_t *)printer->job;
+    char cache_name[1024];             /* Cache filename for printer attrs */
 
-    cupsdStopJob(job, 1);
+    snprintf(cache_name, sizeof(cache_name), "%s/%s.data", CacheDir,
+             printer->name);
+    unlink(cache_name);
 
-    job->state->values[0].integer = IPP_JOB_PENDING;
-    job->state_value              = IPP_JOB_PENDING;
+    cupsdSetPrinterReasons(printer, "none");
+
+   /*
+    * (Re)register color profiles...
+    */
+
+    cupsdRegisterColor(printer);
   }
 
-  if (need_restart_job)
-    cupsdCheckJobs();
+ /*
+  * If we set the device URI but not the port monitor, check which port
+  * monitor to use by default...
+  */
+
+  if (set_device_uri && !set_port_monitor)
+  {
+    ppd_file_t *ppd;                   /* PPD file */
+    ppd_attr_t *ppdattr;               /* cupsPortMonitor attribute */
+
+
+    httpSeparateURI(HTTP_URI_CODING_ALL, printer->device_uri, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
+                   sizeof(host), &port, resource, sizeof(resource));
+
+    snprintf(srcfile, sizeof(srcfile), "%s/ppd/%s.ppd", ServerRoot,
+            printer->name);
+    if ((ppd = _ppdOpenFile(srcfile, _PPD_LOCALIZATION_NONE)) != NULL)
+    {
+      for (ppdattr = ppdFindAttr(ppd, "cupsPortMonitor", NULL);
+          ppdattr;
+          ppdattr = ppdFindNextAttr(ppd, "cupsPortMonitor", NULL))
+        if (!strcmp(scheme, ppdattr->spec))
+       {
+         cupsdLogMessage(CUPSD_LOG_INFO,
+                         "Setting %s port-monitor to \"%s\" (was \"%s\".)",
+                         printer->name, ppdattr->value,
+                         printer->port_monitor ? printer->port_monitor
+                                               : "none");
+
+         if (strcmp(ppdattr->value, "none"))
+           cupsdSetString(&printer->port_monitor, ppdattr->value);
+         else
+           cupsdClearString(&printer->port_monitor);
+
+         break;
+       }
+
+      ppdClose(ppd);
+    }
+  }
+
+ /*
+  * Update the printer attributes and return...
+  */
+
+  cupsdSetPrinterAttrs(printer);
+  cupsdMarkDirty(CUPSD_DIRTY_PRINTERS);
+
+  if (need_restart_job && printer->job)
+  {
+   /*
+    * Restart the current job...
+    */
+
+    cupsdSetJobState(printer->job, IPP_JOB_PENDING, CUPSD_JOB_FORCE,
+                     "Job restarted because the printer was modified.");
+  }
 
-  cupsdWritePrintcap();
+  cupsdMarkDirty(CUPSD_DIRTY_PRINTCAP);
 
   if (modify)
   {
-    cupsdAddEvent(CUPSD_EVENT_PRINTER_MODIFIED, printer, NULL,
-                  "Printer \"%s\" modified by \"%s\".", printer->name,
-                 get_username(con));
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_MODIFIED,
+                  printer, NULL, "Printer \"%s\" modified by \"%s\".",
+                 printer->name, get_username(con));
 
     cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" modified by \"%s\".",
                     printer->name, get_username(con));
   }
   else
   {
-    cupsdAddPrinterHistory(printer);
-
-    cupsdAddEvent(CUPSD_EVENT_PRINTER_ADDED, printer, NULL,
-                  "New printer \"%s\" added by \"%s\".", printer->name,
-                 get_username(con));
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_ADDED,
+                  printer, NULL, "New printer \"%s\" added by \"%s\".",
+                 printer->name, get_username(con));
 
     cupsdLogMessage(CUPSD_LOG_INFO, "New printer \"%s\" added by \"%s\".",
                     printer->name, get_username(con));
@@ -2522,8 +2860,7 @@ add_printer_state_reasons(
 
   if (p->num_reasons == 0)
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_KEYWORD,
-                 "printer-state-reasons", NULL,
-                p->state == IPP_PRINTER_STOPPED ? "paused" : "none");
+                 "printer-state-reasons", NULL, "none");
   else
     ippAddStrings(con->response, IPP_TAG_PRINTER, IPP_TAG_KEYWORD,
                   "printer-state-reasons", p->num_reasons, NULL,
@@ -2566,7 +2903,7 @@ apply_printer_defaults(
   int          i,                      /* Looping var */
                num_options;            /* Number of default options */
   cups_option_t        *options,               /* Default options */
-               *option;                /* Current option */    
+               *option;                /* Current option */
 
 
  /*
@@ -2574,7 +2911,8 @@ apply_printer_defaults(
   * job object...
   */
 
-  for (i = printer->num_options, num_options = 0, option = printer->options;
+  for (i = printer->num_options, num_options = 0, options = NULL,
+           option = printer->options;
        i > 0;
        i --, option ++)
     if (!ippFindAttribute(job->attrs, option->name, IPP_TAG_ZERO))
@@ -2600,10 +2938,11 @@ static void
 authenticate_job(cupsd_client_t  *con, /* I - Client connection */
                 ipp_attribute_t *uri)  /* I - Job URI */
 {
-  ipp_attribute_t      *attr;          /* Job-id attribute */
+  ipp_attribute_t      *attr,          /* job-id attribute */
+                       *auth_info;     /* auth-info attribute */
   int                  jobid;          /* Job ID */
   cupsd_job_t          *job;           /* Current job */
-  char                 method[HTTP_MAX_URI],
+  char                 scheme[HTTP_MAX_URI],
                                        /* Method portion of URI */
                        username[HTTP_MAX_URI],
                                        /* Username portion of URI */
@@ -2637,7 +2976,7 @@ authenticate_job(cupsd_client_t  *con,    /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -2649,17 +2988,17 @@ authenticate_job(cupsd_client_t  *con,  /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
+
     if (strncmp(resource, "/jobs/", 6))
     {
      /*
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -2677,8 +3016,7 @@ authenticate_job(cupsd_client_t  *con,    /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND,
-                    _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -2693,7 +3031,7 @@ authenticate_job(cupsd_client_t  *con,    /* I - Client connection */
     */
 
     send_ipp_status(con, IPP_NOT_POSSIBLE,
-                    _("Job #%d is not held for authentication!"),
+                    _("Job #%d is not held for authentication."),
                    jobid);
     return;
   }
@@ -2702,10 +3040,25 @@ authenticate_job(cupsd_client_t  *con,  /* I - Client connection */
   * See if we have already authenticated...
   */
 
-  if (!con->username[0])
+  auth_info = ippFindAttribute(con->request, "auth-info", IPP_TAG_TEXT);
+
+  if (!con->username[0] && !auth_info)
   {
-    send_ipp_status(con, IPP_NOT_AUTHORIZED,
-                    _("No authentication information provided!"));
+    cupsd_printer_t    *printer;       /* Job destination */
+
+   /*
+    * No auth data.  If we need to authenticate via Kerberos, send a
+    * HTTP auth challenge, otherwise just return an IPP error...
+    */
+
+    printer = cupsdFindDest(job->dest);
+
+    if (printer && printer->num_auth_info_required > 0 &&
+        !strcmp(printer->auth_info_required[0], "negotiate"))
+      send_http_error(con, HTTP_UNAUTHORIZED, printer);
+    else
+      send_ipp_status(con, IPP_NOT_AUTHORIZED,
+                     _("No authentication information provided."));
     return;
   }
 
@@ -2715,7 +3068,8 @@ authenticate_job(cupsd_client_t  *con,    /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
     return;
   }
 
@@ -2723,7 +3077,7 @@ authenticate_job(cupsd_client_t  *con,    /* I - Client connection */
   * Save the authentication information for this job...
   */
 
-  save_auth_info(con, job);
+  save_auth_info(con, job, auth_info);
 
  /*
   * Reset the job-hold-until value to "no-hold"...
@@ -2745,105 +3099,130 @@ authenticate_job(cupsd_client_t  *con,        /* I - Client connection */
 
   cupsdReleaseJob(job);
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d was authenticated by \"%s\".", jobid,
-                  con->username);
+  cupsdAddEvent(CUPSD_EVENT_JOB_STATE, NULL, job, "Job authenticated by user");
+
+  cupsdLogJob(job, CUPSD_LOG_INFO, "Authenticated by \"%s\".", con->username);
+
+  cupsdCheckJobs();
 }
 
 
 /*
- * 'cancel_all_jobs()' - Cancel all print jobs.
+ * 'cancel_all_jobs()' - Cancel all or selected print jobs.
  */
 
 static void
 cancel_all_jobs(cupsd_client_t  *con,  /* I - Client connection */
                ipp_attribute_t *uri)   /* I - Job or Printer URI */
 {
+  int          i;                      /* Looping var */
   http_status_t        status;                 /* Policy status */
-  const char   *dest;                  /* Destination */
   cups_ptype_t dtype;                  /* Destination type */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Scheme portion of URI */
                userpass[HTTP_MAX_URI], /* Username portion of URI */
-               host[HTTP_MAX_URI],     /* Host portion of URI */
+               hostname[HTTP_MAX_URI], /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
   int          port;                   /* Port portion of URI */
   ipp_attribute_t *attr;               /* Attribute in request */
-  const char   *username;              /* Username */
-  int          purge;                  /* Purge? */
+  const char   *username = NULL;       /* Username */
+  cupsd_jobaction_t purge = CUPSD_JOB_DEFAULT;
+                                       /* Purge? */
   cupsd_printer_t *printer;            /* Printer */
+  ipp_attribute_t *job_ids;            /* job-ids attribute */
+  cupsd_job_t  *job;                   /* Job */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cancel_all_jobs(%p[%d], %s)", con,
                   con->http.fd, uri->values[0].string.text);
 
  /*
-  * See if we have a printer URI...
+  * Get the jobs to cancel/purge...
   */
 
-  if (strcmp(uri->name, "printer-uri"))
+  switch (con->request->request.op.operation_id)
   {
-    send_ipp_status(con, IPP_BAD_REQUEST,
-                    _("The printer-uri attribute is required!"));
-    return;
-  }
+    case IPP_PURGE_JOBS :
+       /*
+       * Get the username (if any) for the jobs we want to cancel (only if
+       * "my-jobs" is specified...
+       */
 
- /*
-  * Get the username (if any) for the jobs we want to cancel (only if
-  * "my-jobs" is specified...
-  */
+        if ((attr = ippFindAttribute(con->request, "my-jobs",
+                                     IPP_TAG_BOOLEAN)) != NULL &&
+            attr->values[0].boolean)
+       {
+         if ((attr = ippFindAttribute(con->request, "requesting-user-name",
+                                      IPP_TAG_NAME)) != NULL)
+           username = attr->values[0].string.text;
+         else
+         {
+           send_ipp_status(con, IPP_BAD_REQUEST,
+                           _("Missing requesting-user-name attribute."));
+           return;
+         }
+       }
 
-  if ((attr = ippFindAttribute(con->request, "my-jobs",
-                               IPP_TAG_BOOLEAN)) != NULL &&
-      attr->values[0].boolean)
-  {
-    if ((attr = ippFindAttribute(con->request, "requesting-user-name",
-                                 IPP_TAG_NAME)) != NULL)
-      username = attr->values[0].string.text;
-    else
-    {
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Missing requesting-user-name attribute!"));
-      return;
-    }
+       /*
+       * Look for the "purge-jobs" attribute...
+       */
+
+       if ((attr = ippFindAttribute(con->request, "purge-jobs",
+                                    IPP_TAG_BOOLEAN)) != NULL)
+         purge = attr->values[0].boolean ? CUPSD_JOB_PURGE : CUPSD_JOB_DEFAULT;
+       else
+         purge = CUPSD_JOB_PURGE;
+       break;
+
+    case IPP_CANCEL_MY_JOBS :
+        if (con->username[0])
+          username = con->username;
+        else if ((attr = ippFindAttribute(con->request, "requesting-user-name",
+                                         IPP_TAG_NAME)) != NULL)
+          username = attr->values[0].string.text;
+        else
+        {
+         send_ipp_status(con, IPP_BAD_REQUEST,
+                         _("Missing requesting-user-name attribute."));
+         return;
+        }
+
+    default :
+        break;
   }
-  else
-    username = NULL;
+
+  job_ids = ippFindAttribute(con->request, "job-ids", IPP_TAG_INTEGER);
 
  /*
-  * Look for the "purge-jobs" attribute...
+  * See if we have a printer URI...
   */
 
-  if ((attr = ippFindAttribute(con->request, "purge-jobs",
-                               IPP_TAG_BOOLEAN)) != NULL)
-    purge = attr->values[0].boolean;
-  else
-    purge = 1;
+  if (strcmp(uri->name, "printer-uri"))
+  {
+    send_ipp_status(con, IPP_BAD_REQUEST,
+                    _("The printer-uri attribute is required."));
+    return;
+  }
 
  /*
   * And if the destination is valid...
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), userpass, sizeof(userpass), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((dest = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI?
     */
 
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text,
+                    scheme, sizeof(scheme), userpass, sizeof(userpass),
+                   hostname, sizeof(hostname), &port,
+                   resource, sizeof(resource));
+
     if ((!strncmp(resource, "/printers/", 10) && resource[10]) ||
         (!strncmp(resource, "/classes/", 9) && resource[9]))
     {
       send_ipp_status(con, IPP_NOT_FOUND,
-                      _("The printer or class was not found."));
-      return;
-    }
-    else if (strcmp(resource, "/printers/"))
-    {
-      send_ipp_status(con, IPP_NOT_FOUND,
-                      _("The printer-uri \"%s\" is not valid."),
-                     uri->values[0].string.text);
+                      _("The printer or class does not exist."));
       return;
     }
 
@@ -2853,18 +3232,54 @@ cancel_all_jobs(cupsd_client_t  *con,   /* I - Client connection */
 
     if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
     {
-      send_http_error(con, status);
+      send_http_error(con, status, NULL);
       return;
     }
 
-   /*
-    * Cancel all jobs on all printers...
-    */
+    if (job_ids)
+    {
+      for (i = 0; i < job_ids->num_values; i ++)
+      {
+       if ((job = cupsdFindJob(job_ids->values[i].integer)) == NULL)
+         break;
+
+        if (con->request->request.op.operation_id == IPP_CANCEL_MY_JOBS &&
+            _cups_strcasecmp(job->username, username))
+          break;
+      }
+
+      if (i < job_ids->num_values)
+      {
+       send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
+                       job_ids->values[i].integer);
+       return;
+      }
+
+      for (i = 0; i < job_ids->num_values; i ++)
+      {
+       job = cupsdFindJob(job_ids->values[i].integer);
+
+       cupsdSetJobState(job, IPP_JOB_CANCELED, purge,
+                        purge == CUPSD_JOB_PURGE ? "Job purged by user." :
+                                                   "Job canceled by user.");
+      }
+
+      cupsdLogMessage(CUPSD_LOG_INFO, "Selected jobs were %s by \"%s\".",
+                     purge == CUPSD_JOB_PURGE ? "purged" : "canceled",
+                     get_username(con));
+    }
+    else
+    {
+     /*
+      * Cancel all jobs on all printers...
+      */
 
-    cupsdCancelJobs(NULL, username, purge);
+      cupsdCancelJobs(NULL, username, purge);
 
-    cupsdLogMessage(CUPSD_LOG_INFO, "All jobs were %s by \"%s\".",
-                    purge ? "purged" : "canceled", get_username(con));
+      cupsdLogMessage(CUPSD_LOG_INFO, "All jobs were %s by \"%s\".",
+                     purge == CUPSD_JOB_PURGE ? "purged" : "canceled",
+                     get_username(con));
+    }
   }
   else
   {
@@ -2872,20 +3287,59 @@ cancel_all_jobs(cupsd_client_t  *con,   /* I - Client connection */
     * Check policy...
     */
 
-    if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
+    if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con,
+                                   NULL)) != HTTP_OK)
     {
-      send_http_error(con, status);
+      send_http_error(con, status, printer);
       return;
     }
 
-   /*
-    * Cancel all of the jobs on the named printer...
-    */
+    if (job_ids)
+    {
+      for (i = 0; i < job_ids->num_values; i ++)
+      {
+       if ((job = cupsdFindJob(job_ids->values[i].integer)) == NULL ||
+           _cups_strcasecmp(job->dest, printer->name))
+         break;
+
+        if (con->request->request.op.operation_id == IPP_CANCEL_MY_JOBS &&
+            _cups_strcasecmp(job->username, username))
+          break;
+      }
+
+      if (i < job_ids->num_values)
+      {
+       send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
+                       job_ids->values[i].integer);
+       return;
+      }
+
+      for (i = 0; i < job_ids->num_values; i ++)
+      {
+       job = cupsdFindJob(job_ids->values[i].integer);
 
-    cupsdCancelJobs(dest, username, purge);
+       cupsdSetJobState(job, IPP_JOB_CANCELED, purge,
+                        purge == CUPSD_JOB_PURGE ? "Job purged by user." :
+                                                   "Job canceled by user.");
+      }
+
+      cupsdLogMessage(CUPSD_LOG_INFO, "Selected jobs were %s by \"%s\".",
+                     purge == CUPSD_JOB_PURGE ? "purged" : "canceled",
+                     get_username(con));
+    }
+    else
+    {
+     /*
+      * Cancel all of the jobs on the named printer...
+      */
+
+      cupsdCancelJobs(printer->name, username, purge);
 
-    cupsdLogMessage(CUPSD_LOG_INFO, "All jobs on \"%s\" were %s by \"%s\".",
-                    dest, purge ? "purged" : "canceled", get_username(con));
+      cupsdLogMessage(CUPSD_LOG_INFO, "All jobs on \"%s\" were %s by \"%s\".",
+                     printer->name,
+                     purge == CUPSD_JOB_PURGE ? "purged" : "canceled",
+                     get_username(con));
+    }
   }
 
   con->response->request.status.status_code = IPP_OK;
@@ -2902,15 +3356,15 @@ cancel_job(cupsd_client_t  *con,        /* I - Client connection */
 {
   ipp_attribute_t *attr;               /* Current attribute */
   int          jobid;                  /* Job ID */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Scheme portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
   int          port;                   /* Port portion of URI */
   cupsd_job_t  *job;                   /* Job information */
-  const char   *dest;                  /* Destination */
-  cups_ptype_t dtype;                  /* Destination type (printer or class) */
+  cups_ptype_t dtype;                  /* Destination type (printer/class) */
   cupsd_printer_t *printer;            /* Printer data */
+  cupsd_jobaction_t purge;             /* Purge the job? */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cancel_job(%p[%d], %s)", con,
@@ -2930,7 +3384,7 @@ cancel_job(cupsd_client_t  *con,  /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -2940,46 +3394,49 @@ cancel_job(cupsd_client_t  *con,        /* I - Client connection */
       * Find the current job on the specified printer...
       */
 
-      httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                      sizeof(method), username, sizeof(username), host,
-                     sizeof(host), &port, resource, sizeof(resource));
-
-      if ((dest = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+      if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
       {
        /*
        * Bad URI...
        */
 
        send_ipp_status(con, IPP_NOT_FOUND,
-                       _("The printer or class was not found."));
+                       _("The printer or class does not exist."));
        return;
       }
 
      /*
-      * See if the printer is currently printing a job...
+      * See if there are any pending jobs...
       */
 
-      if (printer->job)
-        jobid = ((cupsd_job_t *)printer->job)->id;
+      for (job = (cupsd_job_t *)cupsArrayFirst(ActiveJobs);
+          job;
+          job = (cupsd_job_t *)cupsArrayNext(ActiveJobs))
+       if (job->state_value <= IPP_JOB_PROCESSING &&
+           !_cups_strcasecmp(job->dest, printer->name))
+         break;
+
+      if (job)
+       jobid = job->id;
       else
       {
        /*
-        * No, see if there are any pending jobs...
+        * No, try stopped jobs...
        */
-        
-        for (job = (cupsd_job_t *)cupsArrayFirst(ActiveJobs);
+
+       for (job = (cupsd_job_t *)cupsArrayFirst(ActiveJobs);
             job;
             job = (cupsd_job_t *)cupsArrayNext(ActiveJobs))
-         if (job->state_value <= IPP_JOB_PROCESSING &&
-             !strcasecmp(job->dest, dest))
+         if (job->state_value == IPP_JOB_STOPPED &&
+             !_cups_strcasecmp(job->dest, printer->name))
            break;
 
        if (job)
          jobid = job->id;
        else
        {
-         send_ipp_status(con, IPP_NOT_POSSIBLE, _("No active jobs on %s!"),
-                         dest);
+         send_ipp_status(con, IPP_NOT_POSSIBLE, _("No active jobs on %s."),
+                         printer->name);
          return;
        }
       }
@@ -2991,18 +3448,17 @@ cancel_job(cupsd_client_t  *con,        /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
+
     if (strncmp(resource, "/jobs/", 6))
     {
      /*
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -3010,6 +3466,16 @@ cancel_job(cupsd_client_t  *con, /* I - Client connection */
     jobid = atoi(resource + 6);
   }
 
+ /*
+  * Look for the "purge-job" attribute...
+  */
+
+  if ((attr = ippFindAttribute(con->request, "purge-job",
+                               IPP_TAG_BOOLEAN)) != NULL)
+    purge = attr->values[0].boolean ? CUPSD_JOB_PURGE : CUPSD_JOB_DEFAULT;
+  else
+    purge = CUPSD_JOB_DEFAULT;
+
  /*
   * See if the job exists...
   */
@@ -3020,7 +3486,7 @@ cancel_job(cupsd_client_t  *con,  /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -3030,7 +3496,8 @@ cancel_job(cupsd_client_t  *con,  /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
     return;
   }
 
@@ -3039,7 +3506,7 @@ cancel_job(cupsd_client_t  *con,  /* I - Client connection */
   * we can't cancel...
   */
 
-  if (job->state_value >= IPP_JOB_CANCELED)
+  if (job->state_value >= IPP_JOB_CANCELED && purge != CUPSD_JOB_PURGE)
   {
     switch (job->state_value)
     {
@@ -3069,11 +3536,18 @@ cancel_job(cupsd_client_t  *con,        /* I - Client connection */
   * Cancel the job and return...
   */
 
-  cupsdCancelJob(job, 0, IPP_JOB_CANCELED);
+  cupsdSetJobState(job, IPP_JOB_CANCELED, purge,
+                   purge == CUPSD_JOB_PURGE ? "Job purged by \"%s\"" :
+                                             "Job canceled by \"%s\"",
+                  username);
   cupsdCheckJobs();
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d was canceled by \"%s\".", jobid,
-                  username);
+  if (purge == CUPSD_JOB_PURGE)
+    cupsdLogMessage(CUPSD_LOG_INFO, "[Job %d] Purged by \"%s\".", jobid,
+                   username);
+  else
+    cupsdLogMessage(CUPSD_LOG_INFO, "[Job %d] Canceled by \"%s\".", jobid,
+                   username);
 
   con->response->request.status.status_code = IPP_OK;
 }
@@ -3107,7 +3581,7 @@ cancel_subscription(
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("notify-subscription-id %d no good!"), sub_id);
+                    _("Subscription #%d does not exist."), sub_id);
     return;
   }
 
@@ -3119,7 +3593,7 @@ cancel_subscription(
                                              DefaultPolicyPtr,
                                  con, sub->owner)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, sub->dest);
     return;
   }
 
@@ -3134,35 +3608,83 @@ cancel_subscription(
 
 
 /*
- * 'check_quotas()' - Check quotas for a printer and user.
+ * 'check_rss_recipient()' - Check that we do not have a duplicate RSS feed URI.
  */
 
 static int                             /* O - 1 if OK, 0 if not */
+check_rss_recipient(
+    const char *recipient)             /* I - Recipient URI */
+{
+  cupsd_subscription_t *sub;           /* Current subscription */
+
+
+  for (sub = (cupsd_subscription_t *)cupsArrayFirst(Subscriptions);
+       sub;
+       sub = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
+    if (sub->recipient)
+    {
+     /*
+      * Compare the URIs up to the first ?...
+      */
+
+      const char *r1, *r2;
+
+      for (r1 = recipient, r2 = sub->recipient;
+           *r1 == *r2 && *r1 && *r1 != '?' && *r2 && *r2 != '?';
+          r1 ++, r2 ++);
+
+      if (*r1 == *r2)
+        return (0);
+    }
+
+  return (1);
+}
+
+
+/*
+ * 'check_quotas()' - Check quotas for a printer and user.
+ */
+
+static int                             /* O - 1 if OK, 0 if forbidden,
+                                              -1 if limit reached */
 check_quotas(cupsd_client_t  *con,     /* I - Client connection */
              cupsd_printer_t *p)       /* I - Printer or class */
 {
-  int          i;                      /* Looping var */
-  char         username[33];           /* Username */
+  char         username[33],           /* Username */
+               *name;                  /* Current user name */
   cupsd_quota_t        *q;                     /* Quota data */
+#ifdef HAVE_MBR_UID_TO_UUID
+ /*
+  * Use Apple membership APIs which require that all names represent
+  * valid user account or group records accessible by the server.
+  */
+
+  uuid_t       usr_uuid;               /* UUID for job requesting user  */
+  uuid_t       usr2_uuid;              /* UUID for ACL user name entry  */
+  uuid_t       grp_uuid;               /* UUID for ACL group name entry */
+  int          mbr_err;                /* Error from membership function */
+  int          is_member;              /* Is this user a member? */
+#else
+ /*
+  * Use standard POSIX APIs for checking users and groups...
+  */
+
   struct passwd        *pw;                    /* User password data */
+#endif /* HAVE_MBR_UID_TO_UUID */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "check_quotas(%p[%d], %p[%s])",
                   con, con->http.fd, p, p->name);
 
- /*
-  * Check input...
-  */
-
-  if (!con || !p)
-    return (0);
-
  /*
   * Figure out who is printing...
   */
 
   strlcpy(username, get_username(con), sizeof(username));
 
+  if ((name = strchr(username, '@')) != NULL)
+    *name = '\0';                      /* Strip @REALM */
+
  /*
   * Check global active job limits for printers and users...
   */
@@ -3177,7 +3699,7 @@ check_quotas(cupsd_client_t  *con,        /* I - Client connection */
     {
       cupsdLogMessage(CUPSD_LOG_INFO, "Too many jobs for printer \"%s\"...",
                       p->name);
-      return (0);
+      return (-1);
     }
   }
 
@@ -3191,7 +3713,7 @@ check_quotas(cupsd_client_t  *con,        /* I - Client connection */
     {
       cupsdLogMessage(CUPSD_LOG_INFO, "Too many jobs for user \"%s\"...",
                       username);
-      return (0);
+      return (-1);
     }
   }
 
@@ -3199,28 +3721,127 @@ check_quotas(cupsd_client_t  *con,     /* I - Client connection */
   * Check against users...
   */
 
-  if (p->num_users == 0 && p->k_limit == 0 && p->page_limit == 0)
+  if (cupsArrayCount(p->users) == 0 && p->k_limit == 0 && p->page_limit == 0)
     return (1);
 
-  if (p->num_users)
+  if (cupsArrayCount(p->users))
   {
+#ifdef HAVE_MBR_UID_TO_UUID
+   /*
+    * Get UUID for job requesting user...
+    */
+
+    if (mbr_user_name_to_uuid((char *)username, usr_uuid))
+    {
+     /*
+      * Unknown user...
+      */
+
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
+                     "check_quotas: UUID lookup failed for user \"%s\"",
+                     username);
+      cupsdLogMessage(CUPSD_LOG_INFO,
+                     "Denying user \"%s\" access to printer \"%s\" "
+                     "(unknown user)...",
+                     username, p->name);
+      return (0);
+    }
+#else
+   /*
+    * Get UID and GID of requesting user...
+    */
+
     pw = getpwnam(username);
     endpwent();
+#endif /* HAVE_MBR_UID_TO_UUID */
 
-    for (i = 0; i < p->num_users; i ++)
-      if (p->users[i][0] == '@')
+    for (name = (char *)cupsArrayFirst(p->users);
+         name;
+        name = (char *)cupsArrayNext(p->users))
+      if (name[0] == '@')
       {
        /*
         * Check group membership...
        */
 
-        if (cupsdCheckGroup(username, pw, p->users[i] + 1))
+#ifdef HAVE_MBR_UID_TO_UUID
+        if (name[1] == '#')
+       {
+         if (uuid_parse(name + 2, grp_uuid))
+           uuid_clear(grp_uuid);
+       }
+       else if ((mbr_err = mbr_group_name_to_uuid(name + 1, grp_uuid)) != 0)
+       {
+        /*
+         * Invalid ACL entries are ignored for matching; just record a
+         * warning in the log...
+         */
+
+         cupsdLogMessage(CUPSD_LOG_DEBUG,
+                         "check_quotas: UUID lookup failed for ACL entry "
+                         "\"%s\" (err=%d)", name, mbr_err);
+         cupsdLogMessage(CUPSD_LOG_WARN,
+                         "Access control entry \"%s\" not a valid group name; "
+                         "entry ignored", name);
+       }
+
+       if ((mbr_err = mbr_check_membership(usr_uuid, grp_uuid,
+                                           &is_member)) != 0)
+       {
+        /*
+         * At this point, there should be no errors, but check anyways...
+         */
+
+         cupsdLogMessage(CUPSD_LOG_DEBUG,
+                         "check_quotas: group \"%s\" membership check "
+                         "failed (err=%d)", name + 1, mbr_err);
+         is_member = 0;
+       }
+
+       /*
+       * Stop if we found a match...
+       */
+
+       if (is_member)
+         break;
+
+#else
+        if (cupsdCheckGroup(username, pw, name + 1))
+         break;
+#endif /* HAVE_MBR_UID_TO_UUID */
+      }
+#ifdef HAVE_MBR_UID_TO_UUID
+      else
+      {
+        if (name[0] == '#')
+       {
+         if (uuid_parse(name + 1, usr2_uuid))
+           uuid_clear(usr2_uuid);
+        }
+        else if ((mbr_err = mbr_user_name_to_uuid(name, usr2_uuid)) != 0)
+       {
+        /*
+         * Invalid ACL entries are ignored for matching; just record a
+         * warning in the log...
+         */
+
+          cupsdLogMessage(CUPSD_LOG_DEBUG,
+                         "check_quotas: UUID lookup failed for ACL entry "
+                         "\"%s\" (err=%d)", name, mbr_err);
+          cupsdLogMessage(CUPSD_LOG_WARN,
+                         "Access control entry \"%s\" not a valid user name; "
+                         "entry ignored", name);
+       }
+
+       if (!uuid_compare(usr_uuid, usr2_uuid))
          break;
       }
-      else if (!strcasecmp(username, p->users[i]))
+#else
+      else if (!_cups_strcasecmp(username, name))
        break;
+#endif /* HAVE_MBR_UID_TO_UUID */
 
-    if ((i < p->num_users) == p->deny_users)
+    if ((name != NULL) == p->deny_users)
     {
       cupsdLogMessage(CUPSD_LOG_INFO,
                       "Denying user \"%s\" access to printer \"%s\"...",
@@ -3238,9 +3859,9 @@ check_quotas(cupsd_client_t  *con,        /* I - Client connection */
     if ((q = cupsdUpdateQuota(p, username, 0, 0)) == NULL)
     {
       cupsdLogMessage(CUPSD_LOG_ERROR,
-                      "Unable to allocate quota data for user \"%s\"!",
+                      "Unable to allocate quota data for user \"%s\"",
                       username);
-      return (0);
+      return (-1);
     }
 
     if ((q->k_count >= p->k_limit && p->k_limit) ||
@@ -3248,7 +3869,7 @@ check_quotas(cupsd_client_t  *con,        /* I - Client connection */
     {
       cupsdLogMessage(CUPSD_LOG_INFO, "User \"%s\" is over the quota limit...",
                       username);
-      return (0);
+      return (-1);
     }
   }
 
@@ -3261,166 +3882,121 @@ check_quotas(cupsd_client_t  *con,    /* I - Client connection */
 
 
 /*
- * 'copy_attribute()' - Copy a single attribute.
+ * 'close_job()' - Close a multi-file job.
  */
 
-static ipp_attribute_t *               /* O - New attribute */
-copy_attribute(
-    ipp_t           *to,               /* O - Destination request/response */
-    ipp_attribute_t *attr,             /* I - Attribute to copy */
-    int             quickcopy)         /* I - Do a quick copy? */
+static void
+close_job(cupsd_client_t  *con,                /* I - Client connection */
+          ipp_attribute_t *uri)                /* I - Printer URI */
 {
-  int                  i;              /* Looping var */
-  ipp_attribute_t      *toattr;        /* Destination attribute */
+  cupsd_job_t          *job;           /* Job */
+  ipp_attribute_t      *attr;          /* Attribute */
+  char                 job_uri[HTTP_MAX_URI],
+                                       /* Job URI */
+                       username[256];  /* User name */
 
 
-  cupsdLogMessage(CUPSD_LOG_DEBUG2,
-                  "copy_attribute(%p, %p[%s,%x,%x])", to, attr,
-                 attr->name ? attr->name : "(null)", attr->group_tag,
-                 attr->value_tag);
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "close_job(%p[%d], %s)", con,
+                  con->http.fd, uri->values[0].string.text);
+
+ /*
+  * See if we have a job URI or a printer URI...
+  */
 
-  switch (attr->value_tag & ~IPP_TAG_COPY)
+  if (strcmp(uri->name, "printer-uri"))
   {
-    case IPP_TAG_ZERO :
-        toattr = ippAddSeparator(to);
-       break;
+   /*
+    * job-uri is not supported by Close-Job!
+    */
 
-    case IPP_TAG_INTEGER :
-    case IPP_TAG_ENUM :
-        toattr = ippAddIntegers(to, attr->group_tag, attr->value_tag,
-                               attr->name, attr->num_values, NULL);
+    send_ipp_status(con, IPP_BAD_REQUEST,
+                   _("Close-Job doesn't support the job-uri attribute."));
+    return;
+  }
 
-        for (i = 0; i < attr->num_values; i ++)
-         toattr->values[i].integer = attr->values[i].integer;
-        break;
+ /*
+  * Got a printer URI; see if we also have a job-id attribute...
+  */
 
-    case IPP_TAG_BOOLEAN :
-        toattr = ippAddBooleans(to, attr->group_tag, attr->name,
-                               attr->num_values, NULL);
+  if ((attr = ippFindAttribute(con->request, "job-id",
+                              IPP_TAG_INTEGER)) == NULL)
+  {
+    send_ipp_status(con, IPP_BAD_REQUEST,
+                   _("Got a printer-uri attribute but no job-id."));
+    return;
+  }
 
-        for (i = 0; i < attr->num_values; i ++)
-         toattr->values[i].boolean = attr->values[i].boolean;
-        break;
+  if ((job = cupsdFindJob(attr->values[0].integer)) == NULL)
+  {
+   /*
+    * Nope - return a "not found" error...
+    */
 
-    case IPP_TAG_STRING :
-    case IPP_TAG_TEXT :
-    case IPP_TAG_NAME :
-    case IPP_TAG_KEYWORD :
-    case IPP_TAG_URI :
-    case IPP_TAG_URISCHEME :
-    case IPP_TAG_CHARSET :
-    case IPP_TAG_LANGUAGE :
-    case IPP_TAG_MIMETYPE :
-        toattr = ippAddStrings(to, attr->group_tag,
-                              (ipp_tag_t)(attr->value_tag | quickcopy),
-                              attr->name, attr->num_values, NULL, NULL);
-
-        if (quickcopy)
-       {
-          for (i = 0; i < attr->num_values; i ++)
-           toattr->values[i].string.text = attr->values[i].string.text;
-        }
-       else
-       {
-          for (i = 0; i < attr->num_values; i ++)
-           toattr->values[i].string.text = _cupsStrAlloc(attr->values[i].string.text);
-       }
-        break;
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
+                    attr->values[0].integer);
+    return;
+  }
 
-    case IPP_TAG_DATE :
-        toattr = ippAddDate(to, attr->group_tag, attr->name,
-                           attr->values[0].date);
-        break;
+ /*
+  * See if the job is owned by the requesting user...
+  */
 
-    case IPP_TAG_RESOLUTION :
-        toattr = ippAddResolutions(to, attr->group_tag, attr->name,
-                                  attr->num_values, IPP_RES_PER_INCH,
-                                  NULL, NULL);
+  if (!validate_user(job, con, job->username, username, sizeof(username)))
+  {
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
+    return;
+  }
 
-        for (i = 0; i < attr->num_values; i ++)
-       {
-         toattr->values[i].resolution.xres  = attr->values[i].resolution.xres;
-         toattr->values[i].resolution.yres  = attr->values[i].resolution.yres;
-         toattr->values[i].resolution.units = attr->values[i].resolution.units;
-       }
-        break;
+ /*
+  * Add any ending sheet...
+  */
 
-    case IPP_TAG_RANGE :
-        toattr = ippAddRanges(to, attr->group_tag, attr->name,
-                             attr->num_values, NULL, NULL);
+  if (cupsdTimeoutJob(job))
+    return;
 
-        for (i = 0; i < attr->num_values; i ++)
-       {
-         toattr->values[i].range.lower = attr->values[i].range.lower;
-         toattr->values[i].range.upper = attr->values[i].range.upper;
-       }
-        break;
+  if (job->state_value == IPP_JOB_STOPPED)
+  {
+    job->state->values[0].integer = IPP_JOB_PENDING;
+    job->state_value              = IPP_JOB_PENDING;
+  }
+  else if (job->state_value == IPP_JOB_HELD)
+  {
+    if ((attr = ippFindAttribute(job->attrs, "job-hold-until",
+                                IPP_TAG_KEYWORD)) == NULL)
+      attr = ippFindAttribute(job->attrs, "job-hold-until", IPP_TAG_NAME);
 
-    case IPP_TAG_TEXTLANG :
-    case IPP_TAG_NAMELANG :
-        toattr = ippAddStrings(to, attr->group_tag,
-                              (ipp_tag_t)(attr->value_tag | quickcopy),
-                              attr->name, attr->num_values, NULL, NULL);
+    if (!attr || !strcmp(attr->values[0].string.text, "no-hold"))
+    {
+      job->state->values[0].integer = IPP_JOB_PENDING;
+      job->state_value              = IPP_JOB_PENDING;
+    }
+  }
 
-        if (quickcopy)
-       {
-          for (i = 0; i < attr->num_values; i ++)
-         {
-            toattr->values[i].string.charset = attr->values[i].string.charset;
-           toattr->values[i].string.text    = attr->values[i].string.text;
-          }
-        }
-       else
-       {
-          for (i = 0; i < attr->num_values; i ++)
-         {
-           if (!i)
-              toattr->values[i].string.charset =
-                 _cupsStrAlloc(attr->values[i].string.charset);
-           else
-              toattr->values[i].string.charset =
-                 toattr->values[0].string.charset;
-
-           toattr->values[i].string.text = _cupsStrAlloc(attr->values[i].string.text);
-          }
-        }
-        break;
+  job->dirty = 1;
+  cupsdMarkDirty(CUPSD_DIRTY_JOBS);
 
-    case IPP_TAG_BEGIN_COLLECTION :
-        toattr = ippAddCollections(to, attr->group_tag, attr->name,
-                                  attr->num_values, NULL);
+ /*
+  * Fill in the response info...
+  */
 
-        for (i = 0; i < attr->num_values; i ++)
-       {
-         toattr->values[i].collection = ippNew();
-         copy_attrs(toattr->values[i].collection, attr->values[i].collection,
-                    NULL, IPP_TAG_ZERO, 0);
-       }
-        break;
+  httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "ipp", NULL,
+                   con->clientname, con->clientport, "/jobs/%d", job->id);
+  ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI, "job-uri", NULL,
+               job_uri);
 
-    default :
-        toattr = ippAddIntegers(to, attr->group_tag, attr->value_tag,
-                               attr->name, attr->num_values, NULL);
+  ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER, "job-id", job->id);
 
-        for (i = 0; i < attr->num_values; i ++)
-       {
-         toattr->values[i].unknown.length = attr->values[i].unknown.length;
+  ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_ENUM, "job-state",
+                job->state_value);
 
-         if (toattr->values[i].unknown.length > 0)
-         {
-           if ((toattr->values[i].unknown.data =
-                    malloc(toattr->values[i].unknown.length)) == NULL)
-             toattr->values[i].unknown.length = 0;
-           else
-             memcpy(toattr->values[i].unknown.data,
-                    attr->values[i].unknown.data,
-                    toattr->values[i].unknown.length);
-         }
-       }
-        break; /* anti-compiler-warning-code */
-  }
+  con->response->request.status.status_code = IPP_OK;
+
+ /*
+  * Start the job if necessary...
+  */
 
-  return (toattr);
+  cupsdCheckJobs();
 }
 
 
@@ -3433,7 +4009,8 @@ copy_attrs(ipp_t        *to,              /* I - Destination request */
            ipp_t        *from,         /* I - Source request */
            cups_array_t *ra,           /* I - Requested attributes */
           ipp_tag_t    group,          /* I - Group to copy */
-          int          quickcopy)      /* I - Do a quick copy? */
+          int          quickcopy,      /* I - Do a quick copy? */
+          cups_array_t *exclude)       /* I - Attributes to exclude? */
 {
   ipp_attribute_t      *fromattr;      /* Source attribute */
 
@@ -3455,8 +4032,47 @@ copy_attrs(ipp_t        *to,             /* I - Destination request */
          fromattr->group_tag != IPP_TAG_ZERO) || !fromattr->name)
       continue;
 
+    if (!strcmp(fromattr->name, "document-password") ||
+        !strcmp(fromattr->name, "job-authorization-uri") ||
+        !strcmp(fromattr->name, "job-password") ||
+        !strcmp(fromattr->name, "job-password-encryption") ||
+        !strcmp(fromattr->name, "job-printer-uri"))
+      continue;
+
+    if (exclude &&
+        (cupsArrayFind(exclude, fromattr->name) ||
+        cupsArrayFind(exclude, "all")))
+    {
+     /*
+      * We need to exclude this attribute for security reasons; we require the
+      * job-id attribute regardless of the security settings for IPP
+      * conformance.
+      *
+      * The job-printer-uri attribute is handled by copy_job_attrs().
+      *
+      * Subscription attribute security is handled by copy_subscription_attrs().
+      */
+
+      if (strcmp(fromattr->name, "job-id"))
+        continue;
+    }
+
     if (!ra || cupsArrayFind(ra, fromattr->name))
-      copy_attribute(to, fromattr, quickcopy);
+    {
+     /*
+      * Don't send collection attributes by default to IPP/1.x clients
+      * since many do not support collections.  Also don't send
+      * media-col-database unless specifically requested by the client.
+      */
+
+      if (fromattr->value_tag == IPP_TAG_BEGIN_COLLECTION &&
+          !ra &&
+         (to->request.status.version[0] == 1 ||
+          !strcmp(fromattr->name, "media-col-database")))
+       continue;
+
+      ippCopyAttribute(to, fromattr, quickcopy);
+    }
   }
 }
 
@@ -3483,8 +4099,10 @@ copy_banner(cupsd_client_t *con, /* I - Client connection */
   ipp_attribute_t *attr;               /* Attribute */
 
 
-  cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner(%p[%d], %p[%d], %s)",
-                  con, con->http.fd, job, job->id, name ? name : "(null)");
+  cupsdLogMessage(CUPSD_LOG_DEBUG2,
+                  "copy_banner(con=%p[%d], job=%p[%d], name=\"%s\")",
+                  con, con ? con->http.fd : -1, job, job->id,
+                 name ? name : "(null)");
 
  /*
   * Find the banner; return if not found or "none"...
@@ -3499,14 +4117,14 @@ copy_banner(cupsd_client_t *con,        /* I - Client connection */
   */
 
   if (add_file(con, job, banner->filetype, 0))
-    return (0);
+    return (-1);
 
   snprintf(filename, sizeof(filename), "%s/d%05d-%03d", RequestRoot, job->id,
            job->num_files);
   if ((out = cupsFileOpen(filename, "w")) == NULL)
   {
     cupsdLogMessage(CUPSD_LOG_ERROR,
-                    "copy_banner: Unable to create banner job file %s - %s",
+                    "Unable to create banner job file %s - %s",
                     filename, strerror(errno));
     job->num_files --;
     return (0);
@@ -3562,7 +4180,7 @@ copy_banner(cupsd_client_t *con,  /* I - Client connection */
     cupsFileClose(out);
     unlink(filename);
     cupsdLogMessage(CUPSD_LOG_ERROR,
-                    "copy_banner: Unable to open banner template file %s - %s",
+                    "Unable to open banner template file %s - %s",
                     filename, strerror(errno));
     job->num_files --;
     return (0);
@@ -3645,7 +4263,14 @@ copy_banner(cupsd_client_t *con, /* I - Client connection */
          case IPP_TAG_INTEGER :
          case IPP_TAG_ENUM :
              if (!strncmp(s, "time-at-", 8))
-               cupsFilePuts(out, cupsdGetDateTime(attr->values[i].integer));
+             {
+               struct timeval tv;      /* Time value */
+
+               tv.tv_sec  = attr->values[i].integer;
+               tv.tv_usec = 0;
+
+               cupsFilePuts(out, cupsdGetDateTime(&tv, CUPSD_TIME_STANDARD));
+             }
              else
                cupsFilePrintf(out, "%d", attr->values[i].integer);
              break;
@@ -3667,7 +4292,7 @@ copy_banner(cupsd_client_t *con,  /* I - Client connection */
              cupsFilePrintf(out, "%dx%d%s", attr->values[i].resolution.xres,
                      attr->values[i].resolution.yres,
                      attr->values[i].resolution.units == IPP_RES_PER_INCH ?
-                         "dpi" : "dpc");
+                         "dpi" : "dpcm");
              break;
 
          case IPP_TAG_URI :
@@ -3677,7 +4302,7 @@ copy_banner(cupsd_client_t *con,  /* I - Client connection */
          case IPP_TAG_KEYWORD :
          case IPP_TAG_CHARSET :
          case IPP_TAG_LANGUAGE :
-             if (!strcasecmp(banner->filetype->type, "postscript"))
+             if (!_cups_strcasecmp(banner->filetype->type, "postscript"))
              {
               /*
                * Need to quote strings for PS banners...
@@ -3794,9 +4419,9 @@ copy_model(cupsd_client_t *con,           /* I - Client connection */
            const char     *from,       /* I - Source file */
            const char     *to)         /* I - Destination file */
 {
-  fd_set       *input;                 /* select() input set */
+  fd_set       input;                  /* select() input set */
   struct timeval timeout;              /* select() timeout */
-  int          maxfd;                  /* Maximum file descriptor for select() */
+  int          maxfd;                  /* Max file descriptor for select() */
   char         tempfile[1024];         /* Temporary PPD file */
   int          tempfd;                 /* Temporary PPD file descriptor */
   int          temppid;                /* Process ID of cups-driverd */
@@ -3812,16 +4437,11 @@ copy_model(cupsd_client_t *con,         /* I - Client connection */
   int          i;                      /* Looping var */
   char         option[PPD_MAX_NAME],   /* Option name */
                choice[PPD_MAX_NAME];   /* Choice name */
+  ppd_size_t   *size;                  /* Default size */
   int          num_defaults;           /* Number of default options */
   cups_option_t        *defaults;              /* Default options */
   char         cups_protocol[PPD_MAX_LINE];
                                        /* cupsProtocol attribute */
-  int          have_letter,            /* Have Letter size */
-               have_a4;                /* Have A4 size */
-#ifdef HAVE_LIBPAPER
-  char         *paper_result;          /* Paper size name from libpaper */
-  char         system_paper[64];       /* Paper size name buffer */
-#endif /* HAVE_LIBPAPER */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
@@ -3842,31 +4462,18 @@ copy_model(cupsd_client_t *con,         /* I - Client connection */
   snprintf(buffer, sizeof(buffer), "%s/daemon/cups-driverd", ServerBin);
   snprintf(tempfile, sizeof(tempfile), "%s/%d.ppd", TempDir, con->http.fd);
   tempfd = open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-  if (tempfd < 0)
-    return (-1);
-
-  cupsdOpenPipe(temppipe);
-
-  if ((input = calloc(1, SetSize)) == NULL)
-  {
-    close(tempfd);
-    unlink(tempfile);
-
-    cupsdLogMessage(CUPSD_LOG_ERROR,
-                    "copy_model: Unable to allocate %d bytes for select()...",
-                    SetSize);
+  if (tempfd < 0 || cupsdOpenPipe(temppipe))
     return (-1);
-  }
 
   cupsdLogMessage(CUPSD_LOG_DEBUG,
                   "copy_model: Running \"cups-driverd cat %s\"...", from);
 
   if (!cupsdStartProcess(buffer, argv, envp, -1, temppipe[1], CGIPipes[1],
-                         -1, 0, &temppid))
+                         -1, -1, 0, DefaultProfile, NULL, &temppid))
   {
-    free(input);
     close(tempfd);
     unlink(tempfile);
+
     return (-1);
   }
 
@@ -3889,15 +4496,14 @@ copy_model(cupsd_client_t *con,         /* I - Client connection */
     * See if we have data ready...
     */
 
-    bytes = 0;
-
-    FD_SET(temppipe[0], input);
-    FD_SET(CGIPipes[0], input);
+    FD_ZERO(&input);
+    FD_SET(temppipe[0], &input);
+    FD_SET(CGIPipes[0], &input);
 
     timeout.tv_sec  = 30;
     timeout.tv_usec = 0;
 
-    if ((i = select(maxfd, input, NULL, NULL, &timeout)) < 0)
+    if ((i = select(maxfd, &input, NULL, NULL, &timeout)) < 0)
     {
       if (errno == EINTR)
         continue;
@@ -3913,7 +4519,7 @@ copy_model(cupsd_client_t *con,           /* I - Client connection */
       break;
     }
 
-    if (FD_ISSET(temppipe[0], input))
+    if (FD_ISSET(temppipe[0], &input))
     {
      /*
       * Read the PPD file from the pipe, and write it to the PPD file.
@@ -3930,38 +4536,44 @@ copy_model(cupsd_client_t *con,         /* I - Client connection */
        break;
     }
 
-    if (FD_ISSET(CGIPipes[0], input))
+    if (FD_ISSET(CGIPipes[0], &input))
       cupsdUpdateCGI();
   }
 
   close(temppipe[0]);
   close(tempfd);
 
-  free(input);
-
   if (!total)
   {
    /*
     * No data from cups-deviced...
     */
 
-    cupsdLogMessage(CUPSD_LOG_ERROR, "copy_model: empty PPD file!");
+    cupsdLogMessage(CUPSD_LOG_ERROR, "copy_model: empty PPD file");
     unlink(tempfile);
     return (-1);
   }
 
  /*
-  * Read the source file and see what page sizes are supported...
+  * Open the source file for a copy...
   */
 
-  if ((ppd = ppdOpenFile(tempfile)) == NULL)
+  if ((src = cupsFileOpen(tempfile, "rb")) == NULL)
   {
     unlink(tempfile);
     return (-1);
   }
 
-  have_letter = ppdPageSize(ppd, "Letter") != NULL;
-  have_a4     = ppdPageSize(ppd, "A4") != NULL;
+ /*
+  * Read the source file and see what page sizes are supported...
+  */
+
+  if ((ppd = _ppdOpen(src, _PPD_LOCALIZATION_NONE)) == NULL)
+  {
+    cupsFileClose(src);
+    unlink(tempfile);
+    return (-1);
+  }
 
  /*
   * Open the destination (if possible) and set the default options...
@@ -4007,96 +4619,24 @@ copy_model(cupsd_client_t *con,         /* I - Client connection */
 
     cupsFileClose(dst);
   }
-#ifdef HAVE_LIBPAPER
-  else if ((paper_result = systempapername()) != NULL)
-  {
-   /*
-    * Set the default media sizes from the systemwide default...
-    */
-
-    strlcpy(system_paper, paper_result, sizeof(system_paper));
-    system_paper[0] = toupper(system_paper[0] & 255);
-
-    if ((!strcmp(system_paper, "Letter") && have_letter) ||
-        (!strcmp(system_paper, "A4") && have_a4))
-    {
-      num_defaults = cupsAddOption("PageSize", system_paper, 
-                                  num_defaults, &defaults);
-      num_defaults = cupsAddOption("PageRegion", system_paper, 
-                                  num_defaults, &defaults);
-      num_defaults = cupsAddOption("PaperDimension", system_paper, 
-                                  num_defaults, &defaults);
-      num_defaults = cupsAddOption("ImageableArea", system_paper, 
-                                  num_defaults, &defaults);
-    }
-  }
-#endif /* HAVE_LIBPAPER */
-  else
+  else if ((size = ppdPageSize(ppd, DefaultPaperSize)) != NULL)
   {
    /*
     * Add the default media sizes...
-    *
-    * Note: These values are generally not valid for large-format devices
-    *       like plotters, however it is probably safe to say that those
-    *       users will configure the media size after initially adding
-    *       the device anyways...
-    */
-
-    if (!DefaultLanguage ||
-        !strcasecmp(DefaultLanguage, "C") ||
-        !strcasecmp(DefaultLanguage, "POSIX") ||
-       !strcasecmp(DefaultLanguage, "en") ||
-       !strncasecmp(DefaultLanguage, "en.", 3) ||
-       !strncasecmp(DefaultLanguage, "en_US", 5) ||
-       !strncasecmp(DefaultLanguage, "en_CA", 5) ||
-       !strncasecmp(DefaultLanguage, "fr_CA", 5))
-    {
-     /*
-      * These are the only locales that will default to "letter" size...
-      */
-
-      if (have_letter)
-      {
-       num_defaults = cupsAddOption("PageSize", "Letter", num_defaults,
-                                     &defaults);
-       num_defaults = cupsAddOption("PageRegion", "Letter", num_defaults,
-                                     &defaults);
-       num_defaults = cupsAddOption("PaperDimension", "Letter", num_defaults,
-                                     &defaults);
-       num_defaults = cupsAddOption("ImageableArea", "Letter", num_defaults,
-                                     &defaults);
-      }
-    }
-    else if (have_a4)
-    {
-     /*
-      * The rest default to "a4" size...
-      */
+    */
 
-      num_defaults = cupsAddOption("PageSize", "A4", num_defaults,
-                                   &defaults);
-      num_defaults = cupsAddOption("PageRegion", "A4", num_defaults,
-                                   &defaults);
-      num_defaults = cupsAddOption("PaperDimension", "A4", num_defaults,
-                                   &defaults);
-      num_defaults = cupsAddOption("ImageableArea", "A4", num_defaults,
-                                   &defaults);
-    }
+    num_defaults = cupsAddOption("PageSize", size->name,
+                                 num_defaults, &defaults);
+    num_defaults = cupsAddOption("PageRegion", size->name,
+                                 num_defaults, &defaults);
+    num_defaults = cupsAddOption("PaperDimension", size->name,
+                                 num_defaults, &defaults);
+    num_defaults = cupsAddOption("ImageableArea", size->name,
+                                 num_defaults, &defaults);
   }
 
   ppdClose(ppd);
 
- /*
-  * Open the source file for a copy...
-  */
-
-  if ((src = cupsFileOpen(tempfile, "rb")) == NULL)
-  {
-    cupsFreeOptions(num_defaults, defaults);
-    unlink(tempfile);
-    return (-1);
-  }
-
  /*
   * Open the destination file for a copy...
   */
@@ -4113,6 +4653,8 @@ copy_model(cupsd_client_t *con,           /* I - Client connection */
   * Copy the source file to the destination...
   */
 
+  cupsFileRewind(src);
+
   while (cupsFileGets(src, buffer, sizeof(buffer)))
   {
     if (!strncmp(buffer, "*Default", 8))
@@ -4165,7 +4707,8 @@ copy_model(cupsd_client_t *con,           /* I - Client connection */
 static void
 copy_job_attrs(cupsd_client_t *con,    /* I - Client connection */
               cupsd_job_t    *job,     /* I - Job */
-              cups_array_t   *ra)      /* I - Requested attributes array */
+              cups_array_t   *ra,      /* I - Requested attributes array */
+              cups_array_t   *exclude) /* I - Private attributes array */
 {
   char job_uri[HTTP_MAX_URI];          /* Job URI */
 
@@ -4174,31 +4717,61 @@ copy_job_attrs(cupsd_client_t *con,     /* I - Client connection */
   * Send the requested attributes for each job...
   */
 
-  httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "ipp", NULL,
-                   con->servername, con->serverport, "/jobs/%d",
-                  job->id);
+  if (!cupsArrayFind(exclude, "all"))
+  {
+    if ((!exclude || !cupsArrayFind(exclude, "number-of-documents")) &&
+        (!ra || cupsArrayFind(ra, "number-of-documents")))
+      ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER,
+                   "number-of-documents", job->num_files);
 
-  if (!ra || cupsArrayFind(ra, "job-more-info"))
-    ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI,
-                "job-more-info", NULL, job_uri);
+    if ((!exclude || !cupsArrayFind(exclude, "job-media-progress")) &&
+        (!ra || cupsArrayFind(ra, "job-media-progress")))
+      ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER,
+                   "job-media-progress", job->progress);
+
+    if ((!exclude || !cupsArrayFind(exclude, "job-more-info")) &&
+        (!ra || cupsArrayFind(ra, "job-more-info")))
+    {
+      httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "http",
+                       NULL, con->clientname, con->clientport, "/jobs/%d",
+                      job->id);
+      ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI,
+                  "job-more-info", NULL, job_uri);
+    }
 
-  if (job->state_value > IPP_JOB_PROCESSING &&
-      (!ra || cupsArrayFind(ra, "job-preserved")))
-    ippAddBoolean(con->response, IPP_TAG_JOB, "job-preserved",
-                  job->num_files > 0);
+    if (job->state_value > IPP_JOB_PROCESSING &&
+       (!exclude || !cupsArrayFind(exclude, "job-preserved")) &&
+        (!ra || cupsArrayFind(ra, "job-preserved")))
+      ippAddBoolean(con->response, IPP_TAG_JOB, "job-preserved",
+                   job->num_files > 0);
 
-  if (!ra || cupsArrayFind(ra, "job-printer-up-time"))
-    ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER,
-                  "job-printer-up-time", time(NULL));
+    if ((!exclude || !cupsArrayFind(exclude, "job-printer-up-time")) &&
+        (!ra || cupsArrayFind(ra, "job-printer-up-time")))
+      ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER,
+                   "job-printer-up-time", time(NULL));
+  }
 
-  if (!ra || cupsArrayFind(ra, "job-state-reasons"))
-    add_job_state_reasons(con, job);
+  if (!ra || cupsArrayFind(ra, "job-printer-uri"))
+  {
+    httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "ipp", NULL,
+                    con->clientname, con->clientport,
+                    (job->dtype & CUPS_PRINTER_CLASS) ? "/classes/%s" :
+                                                        "/printers/%s",
+                    job->dest);
+    ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI,
+                "job-printer-uri", NULL, job_uri);
+  }
 
   if (!ra || cupsArrayFind(ra, "job-uri"))
+  {
+    httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "ipp", NULL,
+                    con->clientname, con->clientport, "/jobs/%d",
+                    job->id);
     ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI,
                 "job-uri", NULL, job_uri);
+  }
 
-  copy_attrs(con->response, job->attrs, ra, IPP_TAG_JOB, 0);
+  copy_attrs(con->response, job->attrs, ra, IPP_TAG_JOB, 0, exclude);
 }
 
 
@@ -4214,9 +4787,10 @@ copy_printer_attrs(
 {
   char                 printer_uri[HTTP_MAX_URI];
                                        /* Printer URI */
+  char                 printer_icons[HTTP_MAX_URI];
+                                       /* Printer icons */
   time_t               curtime;        /* Current time */
   int                  i;              /* Looping var */
-  ipp_attribute_t      *history;       /* History collection */
 
 
  /*
@@ -4226,22 +4800,103 @@ copy_printer_attrs(
 
   curtime = time(NULL);
 
-#ifdef __APPLE__
-  if ((!ra || cupsArrayFind(ra, "com.apple.print.recoverable-message")) &&
-      printer->recoverable)
+  if (!ra || cupsArrayFind(ra, "marker-change-time"))
+    ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_INTEGER,
+                  "marker-change-time", printer->marker_time);
+
+  if (printer->num_printers > 0 &&
+      (!ra || cupsArrayFind(ra, "member-uris")))
+  {
+    ipp_attribute_t    *member_uris;   /* member-uris attribute */
+    cupsd_printer_t    *p2;            /* Printer in class */
+    ipp_attribute_t    *p2_uri;        /* printer-uri-supported for class printer */
+
+
+    if ((member_uris = ippAddStrings(con->response, IPP_TAG_PRINTER,
+                                     IPP_TAG_URI, "member-uris",
+                                    printer->num_printers, NULL,
+                                    NULL)) != NULL)
+    {
+      for (i = 0; i < printer->num_printers; i ++)
+      {
+        p2 = printer->printers[i];
+
+        if ((p2_uri = ippFindAttribute(p2->attrs, "printer-uri-supported",
+                                      IPP_TAG_URI)) != NULL)
+          member_uris->values[i].string.text =
+             _cupsStrRetain(p2_uri->values[0].string.text);
+        else
+       {
+         httpAssembleURIf(HTTP_URI_CODING_ALL, printer_uri,
+                          sizeof(printer_uri), "ipp", NULL, con->clientname,
+                          con->clientport,
+                          (p2->type & CUPS_PRINTER_CLASS) ?
+                              "/classes/%s" : "/printers/%s", p2->name);
+         member_uris->values[i].string.text = _cupsStrAlloc(printer_uri);
+        }
+      }
+    }
+  }
+
+  if (printer->alert && (!ra || cupsArrayFind(ra, "printer-alert")))
+    ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_STRING,
+                 "printer-alert", NULL, printer->alert);
+
+  if (printer->alert_description &&
+      (!ra || cupsArrayFind(ra, "printer-alert-description")))
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_TEXT,
-                 "com.apple.print.recoverable-message", NULL,
-                printer->recoverable);
-#endif /* __APPLE__ */
+                 "printer-alert-description", NULL,
+                printer->alert_description);
 
   if (!ra || cupsArrayFind(ra, "printer-current-time"))
     ippAddDate(con->response, IPP_TAG_PRINTER, "printer-current-time",
                ippTimeToDate(curtime));
 
+#if defined(HAVE_DNSSD) || defined(HAVE_AVAHI)
+  if (!ra || cupsArrayFind(ra, "printer-dns-sd-name"))
+  {
+    if (printer->reg_name)
+      ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_NAME,
+                   "printer-dns-sd-name", NULL, printer->reg_name);
+    else
+      ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_NOVALUE,
+                   "printer-dns-sd-name", 0);
+  }
+#endif /* HAVE_DNSSD || HAVE_AVAHI */
+
   if (!ra || cupsArrayFind(ra, "printer-error-policy"))
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_NAME,
                 "printer-error-policy", NULL, printer->error_policy);
 
+  if (!ra || cupsArrayFind(ra, "printer-error-policy-supported"))
+  {
+    static const char * const errors[] =/* printer-error-policy-supported values */
+                 {
+                   "abort-job",
+                   "retry-current-job",
+                   "retry-job",
+                   "stop-printer"
+                 };
+
+    if (printer->type & CUPS_PRINTER_CLASS)
+      ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_NAME | IPP_TAG_COPY,
+                   "printer-error-policy-supported", NULL, "retry-current-job");
+    else
+      ippAddStrings(con->response, IPP_TAG_PRINTER, IPP_TAG_NAME | IPP_TAG_COPY,
+                   "printer-error-policy-supported",
+                   sizeof(errors) / sizeof(errors[0]), NULL, errors);
+  }
+
+  if (!ra || cupsArrayFind(ra, "printer-icons"))
+  {
+    httpAssembleURIf(HTTP_URI_CODING_ALL, printer_icons, sizeof(printer_icons),
+                     "http", NULL, con->clientname, con->clientport,
+                    "/icons/%s.png", printer->name);
+    ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_URI, "printer-icons",
+                 NULL, printer_icons);
+    cupsdLogMessage(CUPSD_LOG_DEBUG2, "printer-icons=\"%s\"", printer_icons);
+  }
+
   if (!ra || cupsArrayFind(ra, "printer-is-accepting-jobs"))
     ippAddBoolean(con->response, IPP_TAG_PRINTER, "printer-is-accepting-jobs",
                   printer->accepting);
@@ -4250,6 +4905,16 @@ copy_printer_attrs(
     ippAddBoolean(con->response, IPP_TAG_PRINTER, "printer-is-shared",
                   printer->shared);
 
+  if (!ra || cupsArrayFind(ra, "printer-more-info"))
+  {
+    httpAssembleURIf(HTTP_URI_CODING_ALL, printer_uri, sizeof(printer_uri),
+                     "http", NULL, con->clientname, con->clientport,
+                    (printer->type & CUPS_PRINTER_CLASS) ?
+                        "/classes/%s" : "/printers/%s", printer->name);
+    ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_URI,
+                "printer-more-info", NULL, printer_uri);
+  }
+
   if (!ra || cupsArrayFind(ra, "printer-op-policy"))
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_NAME,
                 "printer-op-policy", NULL, printer->op_policy);
@@ -4261,23 +4926,6 @@ copy_printer_attrs(
   if (!ra || cupsArrayFind(ra, "printer-state-change-time"))
     ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_INTEGER,
                   "printer-state-change-time", printer->state_time);
-                
-  if (MaxPrinterHistory > 0 && printer->num_history > 0 &&
-      cupsArrayFind(ra, "printer-state-history"))
-  {
-   /*
-    * Printer history is only sent if specifically requested, so that
-    * older CUPS/IPP clients won't barf on the collection attributes.
-    */
-
-    history = ippAddCollections(con->response, IPP_TAG_PRINTER,
-                                "printer-state-history",
-                                printer->num_history, NULL);
-
-    for (i = 0; i < printer->num_history; i ++)
-      copy_attrs(history->values[i].collection = ippNew(), printer->history[i],
-                 NULL, IPP_TAG_ZERO, 0);
-  }
 
   if (!ra || cupsArrayFind(ra, "printer-state-message"))
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_TEXT,
@@ -4290,7 +4938,6 @@ copy_printer_attrs(
   {
     int type;                          /* printer-type value */
 
-
    /*
     * Add the CUPS-specific printer-type attribute...
     */
@@ -4314,12 +4961,10 @@ copy_printer_attrs(
     ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_INTEGER,
                   "printer-up-time", curtime);
 
-  if ((!ra || cupsArrayFind(ra, "printer-uri-supported")) &&
-      !ippFindAttribute(printer->attrs, "printer-uri-supported",
-                        IPP_TAG_URI))
+  if (!ra || cupsArrayFind(ra, "printer-uri-supported"))
   {
     httpAssembleURIf(HTTP_URI_CODING_ALL, printer_uri, sizeof(printer_uri),
-                     "ipp", NULL, con->servername, con->serverport,
+                     "ipp", NULL, con->clientname, con->clientport,
                     (printer->type & CUPS_PRINTER_CLASS) ?
                         "/classes/%s" : "/printers/%s", printer->name);
     ippAddString(con->response, IPP_TAG_PRINTER, IPP_TAG_URI,
@@ -4331,8 +4976,10 @@ copy_printer_attrs(
   if (!ra || cupsArrayFind(ra, "queued-job-count"))
     add_queued_job_count(con, printer);
 
-  copy_attrs(con->response, printer->attrs, ra, IPP_TAG_ZERO, 0);
-  copy_attrs(con->response, CommonData, ra, IPP_TAG_ZERO, IPP_TAG_COPY);
+  copy_attrs(con->response, printer->attrs, ra, IPP_TAG_ZERO, 0, NULL);
+  if (printer->ppd_attrs)
+    copy_attrs(con->response, printer->ppd_attrs, ra, IPP_TAG_ZERO, 0, NULL);
+  copy_attrs(con->response, CommonData, ra, IPP_TAG_ZERO, IPP_TAG_COPY, NULL);
 }
 
 
@@ -4344,7 +4991,8 @@ static void
 copy_subscription_attrs(
     cupsd_client_t       *con,         /* I - Client connection */
     cupsd_subscription_t *sub,         /* I - Subscription */
-    cups_array_t         *ra)          /* I - Requested attributes array */
+    cups_array_t         *ra,          /* I - Requested attributes array */
+    cups_array_t         *exclude)     /* I - Private attributes array */
 {
   ipp_attribute_t      *attr;          /* Current attribute */
   char                 printer_uri[HTTP_MAX_URI];
@@ -4354,87 +5002,104 @@ copy_subscription_attrs(
   const char           *name;          /* Current event name */
 
 
+  cupsdLogMessage(CUPSD_LOG_DEBUG2,
+                  "copy_subscription_attrs(con=%p, sub=%p, ra=%p, exclude=%p)",
+                 con, sub, ra, exclude);
+
  /*
   * Copy the subscription attributes to the response using the
   * requested-attributes attribute that may be provided by the client.
   */
 
-  if (!ra || cupsArrayFind(ra, "notify-events"))
+  if (!exclude || !cupsArrayFind(exclude, "all"))
   {
-    if ((name = cupsdEventName((cupsd_eventmask_t)sub->mask)) != NULL)
-    {
-     /*
-      * Simple event list...
-      */
-
-      ippAddString(con->response, IPP_TAG_SUBSCRIPTION,
-                   (ipp_tag_t)(IPP_TAG_KEYWORD | IPP_TAG_COPY),
-                   "notify-events", NULL, name);
-    }
-    else
+    if ((!exclude || !cupsArrayFind(exclude, "notify-events")) &&
+        (!ra || cupsArrayFind(ra, "notify-events")))
     {
-     /*
-      * Complex event list...
-      */
+      cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_subscription_attrs: notify-events");
 
-      for (mask = 1, count = 0; mask < CUPSD_EVENT_ALL; mask <<= 1)
-       if (sub->mask & mask)
-          count ++;
+      if ((name = cupsdEventName((cupsd_eventmask_t)sub->mask)) != NULL)
+      {
+       /*
+       * Simple event list...
+       */
 
-      attr = ippAddStrings(con->response, IPP_TAG_SUBSCRIPTION,
-                           (ipp_tag_t)(IPP_TAG_KEYWORD | IPP_TAG_COPY),
-                           "notify-events", count, NULL, NULL);
+       ippAddString(con->response, IPP_TAG_SUBSCRIPTION,
+                    (ipp_tag_t)(IPP_TAG_KEYWORD | IPP_TAG_COPY),
+                    "notify-events", NULL, name);
+      }
+      else
+      {
+       /*
+       * Complex event list...
+       */
 
-      for (mask = 1, count = 0; mask < CUPSD_EVENT_ALL; mask <<= 1)
-       if (sub->mask & mask)
-       {
-          attr->values[count].string.text =
-             (char *)cupsdEventName((cupsd_eventmask_t)mask);
+       for (mask = 1, count = 0; mask < CUPSD_EVENT_ALL; mask <<= 1)
+         if (sub->mask & mask)
+           count ++;
 
-          count ++;
-       }
+       attr = ippAddStrings(con->response, IPP_TAG_SUBSCRIPTION,
+                            (ipp_tag_t)(IPP_TAG_KEYWORD | IPP_TAG_COPY),
+                            "notify-events", count, NULL, NULL);
+
+       for (mask = 1, count = 0; mask < CUPSD_EVENT_ALL; mask <<= 1)
+         if (sub->mask & mask)
+         {
+           attr->values[count].string.text =
+               (char *)cupsdEventName((cupsd_eventmask_t)mask);
+
+           count ++;
+         }
+      }
     }
+
+    if ((!exclude || !cupsArrayFind(exclude, "notify-lease-duration")) &&
+        (!sub->job && (!ra || cupsArrayFind(ra, "notify-lease-duration"))))
+      ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
+                   "notify-lease-duration", sub->lease);
+
+    if ((!exclude || !cupsArrayFind(exclude, "notify-recipient-uri")) &&
+        (sub->recipient && (!ra || cupsArrayFind(ra, "notify-recipient-uri"))))
+      ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_URI,
+                  "notify-recipient-uri", NULL, sub->recipient);
+    else if ((!exclude || !cupsArrayFind(exclude, "notify-pull-method")) &&
+             (!ra || cupsArrayFind(ra, "notify-pull-method")))
+      ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_KEYWORD,
+                  "notify-pull-method", NULL, "ippget");
+
+    if ((!exclude || !cupsArrayFind(exclude, "notify-subscriber-user-name")) &&
+        (!ra || cupsArrayFind(ra, "notify-subscriber-user-name")))
+      ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_NAME,
+                  "notify-subscriber-user-name", NULL, sub->owner);
+
+    if ((!exclude || !cupsArrayFind(exclude, "notify-time-interval")) &&
+        (!ra || cupsArrayFind(ra, "notify-time-interval")))
+      ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
+                   "notify-time-interval", sub->interval);
+
+    if (sub->user_data_len > 0 &&
+       (!exclude || !cupsArrayFind(exclude, "notify-user-data")) &&
+        (!ra || cupsArrayFind(ra, "notify-user-data")))
+      ippAddOctetString(con->response, IPP_TAG_SUBSCRIPTION, "notify-user-data",
+                       sub->user_data, sub->user_data_len);
   }
 
   if (sub->job && (!ra || cupsArrayFind(ra, "notify-job-id")))
     ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
                   "notify-job-id", sub->job->id);
 
-  if (!sub->job && (!ra || cupsArrayFind(ra, "notify-lease-duration")))
-    ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
-                  "notify-lease-duration", sub->lease);
-
   if (sub->dest && (!ra || cupsArrayFind(ra, "notify-printer-uri")))
   {
     httpAssembleURIf(HTTP_URI_CODING_ALL, printer_uri, sizeof(printer_uri),
-                     "ipp", NULL, con->servername, con->serverport,
+                     "ipp", NULL, con->clientname, con->clientport,
                     "/printers/%s", sub->dest->name);
     ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_URI,
                 "notify-printer-uri", NULL, printer_uri);
   }
 
-  if (sub->recipient && (!ra || cupsArrayFind(ra, "notify-recipient-uri")))
-    ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_URI,
-                "notify-recipient-uri", NULL, sub->recipient);
-  else if (!ra || cupsArrayFind(ra, "notify-pull-method"))
-    ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_KEYWORD,
-                 "notify-pull-method", NULL, "ippget");
-
-  if (!ra || cupsArrayFind(ra, "notify-subscriber-user-name"))
-    ippAddString(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_NAME,
-                "notify-subscriber-user-name", NULL, sub->owner);
-
   if (!ra || cupsArrayFind(ra, "notify-subscription-id"))
     ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
                   "notify-subscription-id", sub->id);
-
-  if (!ra || cupsArrayFind(ra, "notify-time-interval"))
-    ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
-                  "notify-time-interval", sub->interval);
-
-  if (sub->user_data_len > 0 && (!ra || cupsArrayFind(ra, "notify-user-data")))
-    ippAddOctetString(con->response, IPP_TAG_SUBSCRIPTION, "notify-user-data",
-                      sub->user_data, sub->user_data_len);
 }
 
 
@@ -4446,27 +5111,74 @@ static void
 create_job(cupsd_client_t  *con,       /* I - Client connection */
           ipp_attribute_t *uri)        /* I - Printer URI */
 {
-  cupsd_job_t  *job;                   /* New job */
+  int                  i;              /* Looping var */
+  cupsd_printer_t      *printer;       /* Printer */
+  cupsd_job_t          *job;           /* New job */
+  static const char * const forbidden_attrs[] =
+  {                                    /* List of forbidden attributes */
+    "compression",
+    "document-format",
+    "document-name",
+    "document-natural-language"
+  };
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "create_job(%p[%d], %s)", con,
                   con->http.fd, uri->values[0].string.text);
 
+ /*
+  * Is the destination valid?
+  */
+
+  if (!cupsdValidateDest(uri->values[0].string.text, NULL, &printer))
+  {
+   /*
+    * Bad URI...
+    */
+
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The printer or class does not exist."));
+    return;
+  }
+
+ /*
+  * Check for invalid Create-Job attributes and log a warning or error depending
+  * on whether cupsd is running in "strict conformance" mode...
+  */
+
+  for (i = 0;
+       i < (int)(sizeof(forbidden_attrs) / sizeof(forbidden_attrs[0]));
+       i ++)
+    if (ippFindAttribute(con->request, forbidden_attrs[i], IPP_TAG_ZERO))
+    {
+      if (StrictConformance)
+      {
+       send_ipp_status(con, IPP_BAD_REQUEST,
+                       _("The '%s' operation attribute cannot be supplied in a "
+                         "Create-Job request."), forbidden_attrs[i]);
+       return;
+      }
+
+      cupsdLogMessage(CUPSD_LOG_WARN,
+                      "Unexpected '%s' operation attribute in a Create-Job "
+                      "request.", forbidden_attrs[i]);
+    }
+
  /*
   * Create the job object...
   */
 
-  if ((job = add_job(con, uri, NULL, NULL)) == NULL)
+  if ((job = add_job(con, printer, NULL)) == NULL)
     return;
 
+  job->pending_timeout = 1;
+
  /*
   * Save and log the job...
   */
-   
-  cupsdSaveJob(job);
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d created on \"%s\" by \"%s\".",
-                  job->id, job->dest, job->username);
+  cupsdLogJob(job, CUPSD_LOG_INFO, "Queued on \"%s\" by \"%s\".",
+             job->dest, job->username);
 }
 
 
@@ -4477,173 +5189,34 @@ create_job(cupsd_client_t  *con,       /* I - Client connection */
 static cups_array_t *                  /* O - Array of attributes or NULL */
 create_requested_array(ipp_t *request) /* I - IPP request */
 {
-  int                  i;              /* Looping var */
-  ipp_attribute_t      *requested;     /* requested-attributes attribute */
   cups_array_t         *ra;            /* Requested attributes array */
-  char                 *value;         /* Current value */
 
 
  /*
-  * Get the requested-attributes attribute, and return NULL if we don't
-  * have one...
+  * Create the array for standard attributes...
   */
 
-  if ((requested = ippFindAttribute(request, "requested-attributes",
-                                    IPP_TAG_KEYWORD)) == NULL)
-    return (NULL);
+  ra = ippCreateRequestedArray(request);
 
  /*
-  * If the attribute contains a single "all" keyword, return NULL...
+  * Add CUPS defaults as needed...
   */
 
-  if (requested->num_values == 1 &&
-      !strcmp(requested->values[0].string.text, "all"))
-    return (NULL);
+  if (cupsArrayFind(ra, "printer-defaults"))
+  {
+   /*
+    * Include user-set defaults...
+    */
 
- /*
-  * Create an array using "strcmp" as the comparison function...
-  */
-
-  ra = cupsArrayNew((cups_array_func_t)strcmp, NULL);
-
-  for (i = 0; i < requested->num_values; i ++)
-  {
-    value = requested->values[i].string.text;
-
-    if (!strcmp(value, "job-template"))
-    {
-      cupsArrayAdd(ra, "copies");
-      cupsArrayAdd(ra, "copies-default");
-      cupsArrayAdd(ra, "copies-supported");
-      cupsArrayAdd(ra, "finishings");
-      cupsArrayAdd(ra, "finishings-default");
-      cupsArrayAdd(ra, "finishings-supported");
-      cupsArrayAdd(ra, "job-hold-until");
-      cupsArrayAdd(ra, "job-hold-until-default");
-      cupsArrayAdd(ra, "job-hold-until-supported");
-      cupsArrayAdd(ra, "job-priority");
-      cupsArrayAdd(ra, "job-priority-default");
-      cupsArrayAdd(ra, "job-priority-supported");
-      cupsArrayAdd(ra, "job-sheets");
-      cupsArrayAdd(ra, "job-sheets-default");
-      cupsArrayAdd(ra, "job-sheets-supported");
-      cupsArrayAdd(ra, "media");
-      cupsArrayAdd(ra, "media-default");
-      cupsArrayAdd(ra, "media-supported");
-      cupsArrayAdd(ra, "multiple-document-handling");
-      cupsArrayAdd(ra, "multiple-document-handling-default");
-      cupsArrayAdd(ra, "multiple-document-handling-supported");
-      cupsArrayAdd(ra, "number-up");
-      cupsArrayAdd(ra, "number-up-default");
-      cupsArrayAdd(ra, "number-up-supported");
-      cupsArrayAdd(ra, "orientation-requested");
-      cupsArrayAdd(ra, "orientation-requested-default");
-      cupsArrayAdd(ra, "orientation-requested-supported");
-      cupsArrayAdd(ra, "page-ranges");
-      cupsArrayAdd(ra, "page-ranges-supported");
-      cupsArrayAdd(ra, "printer-resolution");
-      cupsArrayAdd(ra, "printer-resolution-default");
-      cupsArrayAdd(ra, "printer-resolution-supported");
-      cupsArrayAdd(ra, "print-quality");
-      cupsArrayAdd(ra, "print-quality-default");
-      cupsArrayAdd(ra, "print-quality-supported");
-      cupsArrayAdd(ra, "sides");
-      cupsArrayAdd(ra, "sides-default");
-      cupsArrayAdd(ra, "sides-supported");
-    }
-    else if (!strcmp(value, "job-description"))
-    {
-      cupsArrayAdd(ra, "date-time-at-completed");
-      cupsArrayAdd(ra, "date-time-at-creation");
-      cupsArrayAdd(ra, "date-time-at-processing");
-      cupsArrayAdd(ra, "job-detailed-status-message");
-      cupsArrayAdd(ra, "job-document-access-errors");
-      cupsArrayAdd(ra, "job-id");
-      cupsArrayAdd(ra, "job-impressions");
-      cupsArrayAdd(ra, "job-impressions-completed");
-      cupsArrayAdd(ra, "job-k-octets");
-      cupsArrayAdd(ra, "job-k-octets-processed");
-      cupsArrayAdd(ra, "job-media-sheets");
-      cupsArrayAdd(ra, "job-media-sheets-completed");
-      cupsArrayAdd(ra, "job-message-from-operator");
-      cupsArrayAdd(ra, "job-more-info");
-      cupsArrayAdd(ra, "job-name");
-      cupsArrayAdd(ra, "job-originating-user-name");
-      cupsArrayAdd(ra, "job-printer-up-time");
-      cupsArrayAdd(ra, "job-printer-uri");
-      cupsArrayAdd(ra, "job-state");
-      cupsArrayAdd(ra, "job-state-message");
-      cupsArrayAdd(ra, "job-state-reasons");
-      cupsArrayAdd(ra, "job-uri");
-      cupsArrayAdd(ra, "number-of-documents");
-      cupsArrayAdd(ra, "number-of-intervening-jobs");
-      cupsArrayAdd(ra, "output-device-assigned");
-      cupsArrayAdd(ra, "time-at-completed");
-      cupsArrayAdd(ra, "time-at-creation");
-      cupsArrayAdd(ra, "time-at-processing");
-    }
-    else if (!strcmp(value, "printer-description"))
-    {
-      cupsArrayAdd(ra, "charset-configured");
-      cupsArrayAdd(ra, "charset-supported");
-      cupsArrayAdd(ra, "color-supported");
-      cupsArrayAdd(ra, "compression-supported");
-      cupsArrayAdd(ra, "document-format-default");
-      cupsArrayAdd(ra, "document-format-supported");
-      cupsArrayAdd(ra, "generated-natural-language-supported");
-      cupsArrayAdd(ra, "ipp-versions-supported");
-      cupsArrayAdd(ra, "job-impressions-supported");
-      cupsArrayAdd(ra, "job-k-octets-supported");
-      cupsArrayAdd(ra, "job-media-sheets-supported");
-      cupsArrayAdd(ra, "multiple-document-jobs-supported");
-      cupsArrayAdd(ra, "multiple-operation-time-out");
-      cupsArrayAdd(ra, "natural-language-configured");
-      cupsArrayAdd(ra, "notify-attributes-supported");
-      cupsArrayAdd(ra, "notify-lease-duration-default");
-      cupsArrayAdd(ra, "notify-lease-duration-supported");
-      cupsArrayAdd(ra, "notify-max-events-supported");
-      cupsArrayAdd(ra, "notify-events-default");
-      cupsArrayAdd(ra, "notify-events-supported");
-      cupsArrayAdd(ra, "notify-pull-method-supported");
-      cupsArrayAdd(ra, "notify-schemes-supported");
-      cupsArrayAdd(ra, "operations-supported");
-      cupsArrayAdd(ra, "pages-per-minute");
-      cupsArrayAdd(ra, "pages-per-minute-color");
-      cupsArrayAdd(ra, "pdl-override-supported");
-      cupsArrayAdd(ra, "printer-current-time");
-      cupsArrayAdd(ra, "printer-driver-installer");
-      cupsArrayAdd(ra, "printer-info");
-      cupsArrayAdd(ra, "printer-is-accepting-jobs");
-      cupsArrayAdd(ra, "printer-location");
-      cupsArrayAdd(ra, "printer-make-and-model");
-      cupsArrayAdd(ra, "printer-message-from-operator");
-      cupsArrayAdd(ra, "printer-more-info");
-      cupsArrayAdd(ra, "printer-more-info-manufacturer");
-      cupsArrayAdd(ra, "printer-name");
-      cupsArrayAdd(ra, "printer-state");
-      cupsArrayAdd(ra, "printer-state-message");
-      cupsArrayAdd(ra, "printer-state-reasons");
-      cupsArrayAdd(ra, "printer-up-time");
-      cupsArrayAdd(ra, "printer-uri-supported");
-      cupsArrayAdd(ra, "queued-job-count");
-      cupsArrayAdd(ra, "reference-uri-schemes-supported");
-      cupsArrayAdd(ra, "uri-authentication-supported");
-      cupsArrayAdd(ra, "uri-security-supported");
-    }
-    else if (!strcmp(value, "subscription-template"))
-    {
-      cupsArrayAdd(ra, "notify-attributes");
-      cupsArrayAdd(ra, "notify-charset");
-      cupsArrayAdd(ra, "notify-events");
-      cupsArrayAdd(ra, "notify-lease-duration");
-      cupsArrayAdd(ra, "notify-natural-language");
-      cupsArrayAdd(ra, "notify-pull-method");
-      cupsArrayAdd(ra, "notify-recipient-uri");
-      cupsArrayAdd(ra, "notify-time-interval");
-      cupsArrayAdd(ra, "notify-user-data");
-    }
-    else
-      cupsArrayAdd(ra, value);
+    char       *name;                  /* Option name */
+
+    cupsArrayRemove(ra, "printer-defaults");
+
+    for (name = (char *)cupsArrayFirst(CommonDefaults);
+        name;
+        name = (char *)cupsArrayNext(CommonDefaults))
+      if (!cupsArrayFind(ra, name))
+        cupsArrayAdd(ra, name);
   }
 
   return (ra);
@@ -4662,7 +5235,7 @@ create_subscription(
   http_status_t        status;                 /* Policy status */
   int                  i;              /* Looping var */
   ipp_attribute_t      *attr;          /* Current attribute */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
   char                 scheme[HTTP_MAX_URI],
                                        /* Scheme portion of URI */
                        userpass[HTTP_MAX_URI],
@@ -4676,23 +5249,26 @@ create_subscription(
   cupsd_job_t          *job;           /* Job */
   int                  jobid;          /* Job ID */
   cupsd_subscription_t *sub;           /* Subscription object */
-  const char           *username,      /* requesting-user-name or authenticated username */
+  const char           *username,      /* requesting-user-name or
+                                          authenticated username */
                        *recipient,     /* notify-recipient-uri */
                        *pullmethod;    /* notify-pull-method */
   ipp_attribute_t      *user_data;     /* notify-user-data */
   int                  interval,       /* notify-time-interval */
                        lease;          /* notify-lease-duration */
   unsigned             mask;           /* notify-events */
+  ipp_attribute_t      *notify_events,/* notify-events(-default) */
+                       *notify_lease;  /* notify-lease-duration(-default) */
 
 
 #ifdef DEBUG
   for (attr = con->request->attrs; attr; attr = attr->next)
   {
     if (attr->group_tag != IPP_TAG_ZERO)
-      cupsdLogMessage(CUPSD_LOG_DEBUG, "g%04x v%04x %s", attr->group_tag,
+      cupsdLogMessage(CUPSD_LOG_DEBUG2, "g%04x v%04x %s", attr->group_tag,
                       attr->value_tag, attr->name);
     else
-      cupsdLogMessage(CUPSD_LOG_DEBUG, "----SEP----");
+      cupsdLogMessage(CUPSD_LOG_DEBUG2, "----SEP----");
   }
 #endif /* DEBUG */
 
@@ -4723,14 +5299,14 @@ create_subscription(
     dtype   = CUPS_PRINTER_CLASS;
     printer = NULL;
   }
-  else if (!cupsdValidateDest(host, resource, &dtype, &printer))
+  else if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -4740,15 +5316,16 @@ create_subscription(
 
   if (printer)
   {
-    if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
+    if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con,
+                                   NULL)) != HTTP_OK)
     {
-      send_http_error(con, status);
+      send_http_error(con, status, printer);
       return;
     }
   }
   else if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -4770,7 +5347,7 @@ create_subscription(
   if (!attr)
   {
     send_ipp_status(con, IPP_BAD_REQUEST,
-                    _("No subscription attributes in request!"));
+                    _("No subscription attributes in request."));
     return;
   }
 
@@ -4790,9 +5367,26 @@ create_subscription(
     jobid      = 0;
     mask       = CUPSD_EVENT_NONE;
 
+    if (printer)
+    {
+      notify_events = ippFindAttribute(printer->attrs, "notify-events-default",
+                                       IPP_TAG_KEYWORD);
+      notify_lease  = ippFindAttribute(printer->attrs,
+                                       "notify-lease-duration-default",
+                                       IPP_TAG_INTEGER);
+
+      if (notify_lease)
+        lease = notify_lease->values[0].integer;
+    }
+    else
+    {
+      notify_events = NULL;
+      notify_lease  = NULL;
+    }
+
     while (attr && attr->group_tag != IPP_TAG_ZERO)
     {
-      if (!strcmp(attr->name, "notify-recipient") &&
+      if (!strcmp(attr->name, "notify-recipient-uri") &&
           attr->value_tag == IPP_TAG_URI)
       {
        /*
@@ -4811,7 +5405,7 @@ create_subscription(
                            resource, sizeof(resource)) < HTTP_URI_OK)
         {
           send_ipp_status(con, IPP_NOT_POSSIBLE,
-                         _("Bad notify-recipient URI \"%s\"!"), recipient);
+                         _("Bad notify-recipient-uri \"%s\"."), recipient);
          ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
                        "notify-status-code", IPP_URI_SCHEME);
          return;
@@ -4822,12 +5416,22 @@ create_subscription(
         if (access(notifier, X_OK))
        {
           send_ipp_status(con, IPP_NOT_POSSIBLE,
-                         _("notify-recipient URI \"%s\" uses unknown scheme!"),
-                         recipient);
+                         _("notify-recipient-uri URI \"%s\" uses unknown "
+                           "scheme."), recipient);
          ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
                        "notify-status-code", IPP_URI_SCHEME);
          return;
        }
+
+        if (!strcmp(scheme, "rss") && !check_rss_recipient(recipient))
+       {
+          send_ipp_status(con, IPP_NOT_POSSIBLE,
+                         _("notify-recipient-uri URI \"%s\" is already used."),
+                         recipient);
+         ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
+                       "notify-status-code", IPP_ATTRIBUTES);
+         return;
+       }
       }
       else if (!strcmp(attr->name, "notify-pull-method") &&
                attr->value_tag == IPP_TAG_KEYWORD)
@@ -4837,7 +5441,7 @@ create_subscription(
         if (strcmp(pullmethod, "ippget"))
        {
           send_ipp_status(con, IPP_NOT_POSSIBLE,
-                         _("Bad notify-pull-method \"%s\"!"), pullmethod);
+                         _("Bad notify-pull-method \"%s\"."), pullmethod);
          ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_ENUM,
                        "notify-status-code", IPP_ATTRIBUTES);
          return;
@@ -4849,7 +5453,7 @@ create_subscription(
               strcmp(attr->values[0].string.text, "utf-8"))
       {
         send_ipp_status(con, IPP_CHARSET,
-                       _("Character set \"%s\" not supported!"),
+                       _("Character set \"%s\" not supported."),
                        attr->values[0].string.text);
        return;
       }
@@ -4858,7 +5462,7 @@ create_subscription(
                strcmp(attr->values[0].string.text, DefaultLanguage)))
       {
         send_ipp_status(con, IPP_CHARSET,
-                       _("Language \"%s\" not supported!"),
+                       _("Language \"%s\" not supported."),
                        attr->values[0].string.text);
        return;
       }
@@ -4869,7 +5473,7 @@ create_subscription(
        {
           send_ipp_status(con, IPP_REQUEST_VALUE,
                          _("The notify-user-data value is too large "
-                           "(%d > 63 octets)!"),
+                           "(%d > 63 octets)."),
                          attr->values[0].unknown.length);
          return;
        }
@@ -4878,10 +5482,7 @@ create_subscription(
       }
       else if (!strcmp(attr->name, "notify-events") &&
                attr->value_tag == IPP_TAG_KEYWORD)
-      {
-        for (i = 0; i < attr->num_values; i ++)
-         mask |= cupsdEventValue(attr->values[i].string.text);
-      }
+        notify_events = attr;
       else if (!strcmp(attr->name, "notify-lease-duration") &&
                attr->value_tag == IPP_TAG_INTEGER)
         lease = attr->values[0].integer;
@@ -4895,6 +5496,12 @@ create_subscription(
       attr = attr->next;
     }
 
+    if (notify_events)
+    {
+      for (i = 0; i < notify_events->num_values; i ++)
+       mask |= cupsdEventValue(notify_events->values[i].string.text);
+    }
+
     if (recipient)
       cupsdLogMessage(CUPSD_LOG_DEBUG, "recipient=\"%s\"", recipient);
     if (pullmethod)
@@ -4914,7 +5521,7 @@ create_subscription(
       else
       {
         send_ipp_status(con, IPP_BAD_REQUEST,
-                       _("notify-events not specified!"));
+                       _("notify-events not specified."));
        return;
       }
     }
@@ -4932,24 +5539,30 @@ create_subscription(
     {
       if ((job = cupsdFindJob(jobid)) == NULL)
       {
-       send_ipp_status(con, IPP_NOT_FOUND, _("Job %d not found!"), jobid);
+       send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
+                       jobid);
        return;
       }
     }
     else
       job = NULL;
 
-    sub = cupsdAddSubscription(mask, printer, job, recipient, 0);
+    if ((sub = cupsdAddSubscription(mask, printer, job, recipient, 0)) == NULL)
+    {
+      send_ipp_status(con, IPP_TOO_MANY_SUBSCRIPTIONS,
+                     _("There are too many subscriptions."));
+      return;
+    }
 
     if (job)
-      cupsdLogMessage(CUPSD_LOG_DEBUG, "Added subscription %d for job %d",
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Added subscription #%d for job %d.",
                      sub->id, job->id);
     else if (printer)
       cupsdLogMessage(CUPSD_LOG_DEBUG,
-                      "Added subscription %d for printer \"%s\"",
+                      "Added subscription #%d for printer \"%s\".",
                      sub->id, printer->name);
     else
-      cupsdLogMessage(CUPSD_LOG_DEBUG, "Added subscription %d for server",
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "Added subscription #%d for server.",
                      sub->id);
 
     sub->interval = interval;
@@ -4975,8 +5588,7 @@ create_subscription(
       attr = attr->next;
   }
 
-  cupsdSaveAllSubscriptions();
-
+  cupsdMarkDirty(CUPSD_DIRTY_SUBSCRIPTIONS);
 }
 
 
@@ -4989,13 +5601,7 @@ delete_printer(cupsd_client_t  *con,     /* I - Client connection */
                ipp_attribute_t *uri)   /* I - URI of printer or class */
 {
   http_status_t        status;                 /* Policy status */
-  const char   *dest;                  /* Destination */
-  cups_ptype_t dtype;                  /* Destination type (printer or class) */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
-               username[HTTP_MAX_URI], /* Username portion of URI */
-               host[HTTP_MAX_URI],     /* Host portion of URI */
-               resource[HTTP_MAX_URI]; /* Resource portion of URI */
-  int          port;                   /* Port portion of URI */
+  cups_ptype_t dtype;                  /* Destination type (printer/class) */
   cupsd_printer_t *printer;            /* Printer/class */
   char         filename[1024];         /* Script/PPD filename */
 
@@ -5007,18 +5613,14 @@ delete_printer(cupsd_client_t  *con,    /* I - Client connection */
   * Do we have a valid URI?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((dest = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -5028,7 +5630,7 @@ delete_printer(cupsd_client_t  *con,      /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -5036,7 +5638,7 @@ delete_printer(cupsd_client_t  *con,      /* I - Client connection */
   * Remove old jobs...
   */
 
-  cupsdCancelJobs(dest, NULL, 1);
+  cupsdCancelJobs(printer->name, NULL, 1);
 
  /*
   * Remove old subscriptions and send a "deleted printer" event...
@@ -5045,38 +5647,60 @@ delete_printer(cupsd_client_t  *con,    /* I - Client connection */
   cupsdAddEvent(CUPSD_EVENT_PRINTER_DELETED, printer, NULL,
                 "%s \"%s\" deleted by \"%s\".",
                (dtype & CUPS_PRINTER_CLASS) ? "Class" : "Printer",
-               dest, get_username(con));
+               printer->name, get_username(con));
 
   cupsdExpireSubscriptions(printer, NULL);
+
  /*
   * Remove any old PPD or script files...
   */
 
-  snprintf(filename, sizeof(filename), "%s/interfaces/%s", ServerRoot, dest);
+  snprintf(filename, sizeof(filename), "%s/interfaces/%s", ServerRoot,
+           printer->name);
+  unlink(filename);
+  snprintf(filename, sizeof(filename), "%s/interfaces/%s.O", ServerRoot,
+           printer->name);
+  unlink(filename);
+
+  snprintf(filename, sizeof(filename), "%s/ppd/%s.ppd", ServerRoot,
+           printer->name);
+  unlink(filename);
+  snprintf(filename, sizeof(filename), "%s/ppd/%s.ppd.O", ServerRoot,
+           printer->name);
   unlink(filename);
 
-  snprintf(filename, sizeof(filename), "%s/ppd/%s.ppd", ServerRoot, dest);
+  snprintf(filename, sizeof(filename), "%s/%s.png", CacheDir, printer->name);
   unlink(filename);
 
+  snprintf(filename, sizeof(filename), "%s/%s.data", CacheDir, printer->name);
+  unlink(filename);
+
+ /*
+  * Unregister color profiles...
+  */
+
+  cupsdUnregisterColor(printer);
+
   if (dtype & CUPS_PRINTER_CLASS)
   {
-    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" deleted by \"%s\".", dest,
-                    get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" deleted by \"%s\".",
+                    printer->name, get_username(con));
 
     cupsdDeletePrinter(printer, 0);
-    cupsdSaveAllClasses();
+    cupsdMarkDirty(CUPSD_DIRTY_CLASSES);
   }
   else
   {
-    cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" deleted by \"%s\".", dest,
-                    get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" deleted by \"%s\".",
+                    printer->name, get_username(con));
 
-    cupsdDeletePrinter(printer, 0);
-    cupsdSaveAllPrinters();
+    if (cupsdDeletePrinter(printer, 0))
+      cupsdMarkDirty(CUPSD_DIRTY_CLASSES);
+
+    cupsdMarkDirty(CUPSD_DIRTY_PRINTERS);
   }
 
-  cupsdWritePrintcap();
+  cupsdMarkDirty(CUPSD_DIRTY_PRINTCAP);
 
  /*
   * Return with no errors...
@@ -5105,7 +5729,7 @@ get_default(cupsd_client_t *con)  /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -5120,7 +5744,7 @@ get_default(cupsd_client_t *con)  /* I - Client connection */
     con->response->request.status.status_code = IPP_OK;
   }
   else
-    send_ipp_status(con, IPP_NOT_FOUND, _("No default printer"));
+    send_ipp_status(con, IPP_NOT_FOUND, _("No default printer."));
 }
 
 
@@ -5132,12 +5756,19 @@ static void
 get_devices(cupsd_client_t *con)       /* I - Client connection */
 {
   http_status_t                status;         /* Policy status */
-  ipp_attribute_t      *limit,         /* Limit attribute */
-                       *requested;     /* requested-attributes attribute */
+  ipp_attribute_t      *limit,         /* limit attribute */
+                       *timeout,       /* timeout attribute */
+                       *requested,     /* requested-attributes attribute */
+                       *exclude,       /* exclude-schemes attribute */
+                       *include;       /* include-schemes attribute */
   char                 command[1024],  /* cups-deviced command */
-                       options[1024],  /* Options to pass to command */
-                       requested_str[256];
+                       options[2048],  /* Options to pass to command */
+                       requested_str[256],
                                        /* String for requested attributes */
+                       exclude_str[512],
+                                       /* String for excluded schemes */
+                       include_str[512];
+                                       /* String for included schemes */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_devices(%p[%d])", con, con->http.fd);
@@ -5148,7 +5779,7 @@ get_devices(cupsd_client_t *con)  /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -5156,21 +5787,38 @@ get_devices(cupsd_client_t *con)        /* I - Client connection */
   * Run cups-deviced command with the given options...
   */
 
-  limit = ippFindAttribute(con->request, "limit", IPP_TAG_INTEGER);
+  limit     = ippFindAttribute(con->request, "limit", IPP_TAG_INTEGER);
+  timeout   = ippFindAttribute(con->request, "timeout", IPP_TAG_INTEGER);
   requested = ippFindAttribute(con->request, "requested-attributes",
                                IPP_TAG_KEYWORD);
+  exclude   = ippFindAttribute(con->request, "exclude-schemes", IPP_TAG_NAME);
+  include   = ippFindAttribute(con->request, "include-schemes", IPP_TAG_NAME);
 
   if (requested)
     url_encode_attr(requested, requested_str, sizeof(requested_str));
   else
     strlcpy(requested_str, "requested-attributes=all", sizeof(requested_str));
 
+  if (exclude)
+    url_encode_attr(exclude, exclude_str, sizeof(exclude_str));
+  else
+    exclude_str[0] = '\0';
+
+  if (include)
+    url_encode_attr(include, include_str, sizeof(include_str));
+  else
+    include_str[0] = '\0';
+
   snprintf(command, sizeof(command), "%s/daemon/cups-deviced", ServerBin);
   snprintf(options, sizeof(options),
-           "%d+%d+%d+%s",
+           "%d+%d+%d+%d+%s%s%s%s%s",
            con->request->request.op.request_id,
-           limit ? limit->values[0].integer : 0, (int)User,
-          requested_str);
+           limit ? limit->values[0].integer : 0,
+          timeout ? timeout->values[0].integer : 15,
+          (int)User,
+          requested_str,
+          exclude_str[0] ? "%20" : "", exclude_str,
+          include_str[0] ? "%20" : "", include_str);
 
   if (cupsdSendCommand(con, command, options, 1))
   {
@@ -5194,6 +5842,152 @@ get_devices(cupsd_client_t *con)        /* I - Client connection */
 }
 
 
+/*
+ * 'get_document()' - Get a copy of a job file.
+ */
+
+static void
+get_document(cupsd_client_t  *con,     /* I - Client connection */
+             ipp_attribute_t *uri)     /* I - Job URI */
+{
+  http_status_t        status;                 /* Policy status */
+  ipp_attribute_t *attr;               /* Current attribute */
+  int          jobid;                  /* Job ID */
+  int          docnum;                 /* Document number */
+  cupsd_job_t  *job;                   /* Current job */
+  char         scheme[HTTP_MAX_URI],   /* Method portion of URI */
+               username[HTTP_MAX_URI], /* Username portion of URI */
+               host[HTTP_MAX_URI],     /* Host portion of URI */
+               resource[HTTP_MAX_URI]; /* Resource portion of URI */
+  int          port;                   /* Port portion of URI */
+  char         filename[1024],         /* Filename for document */
+               format[1024];           /* Format for document */
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_document(%p[%d], %s)", con,
+                  con->http.fd, uri->values[0].string.text);
+
+ /*
+  * See if we have a job URI or a printer URI...
+  */
+
+  if (!strcmp(uri->name, "printer-uri"))
+  {
+   /*
+    * Got a printer URI; see if we also have a job-id attribute...
+    */
+
+    if ((attr = ippFindAttribute(con->request, "job-id",
+                                 IPP_TAG_INTEGER)) == NULL)
+    {
+      send_ipp_status(con, IPP_BAD_REQUEST,
+                      _("Got a printer-uri attribute but no job-id."));
+      return;
+    }
+
+    jobid = attr->values[0].integer;
+  }
+  else
+  {
+   /*
+    * Got a job URI; parse it to get the job ID...
+    */
+
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
+                   sizeof(host), &port, resource, sizeof(resource));
+
+    if (strncmp(resource, "/jobs/", 6))
+    {
+     /*
+      * Not a valid URI!
+      */
+
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
+                      uri->values[0].string.text);
+      return;
+    }
+
+    jobid = atoi(resource + 6);
+  }
+
+ /*
+  * See if the job exists...
+  */
+
+  if ((job = cupsdFindJob(jobid)) == NULL)
+  {
+   /*
+    * Nope - return a "not found" error...
+    */
+
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
+    return;
+  }
+
+ /*
+  * Check policy...
+  */
+
+  if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con,
+                                 job->username)) != HTTP_OK)
+  {
+    send_http_error(con, status, NULL);
+    return;
+  }
+
+ /*
+  * Get the document number...
+  */
+
+  if ((attr = ippFindAttribute(con->request, "document-number",
+                               IPP_TAG_INTEGER)) == NULL)
+  {
+    send_ipp_status(con, IPP_BAD_REQUEST,
+                    _("Missing document-number attribute."));
+    return;
+  }
+
+  if ((docnum = attr->values[0].integer) < 1 || docnum > job->num_files ||
+      attr->num_values > 1)
+  {
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("Document #%d does not exist in job #%d."), docnum,
+                   jobid);
+    return;
+  }
+
+  snprintf(filename, sizeof(filename), "%s/d%05d-%03d", RequestRoot, jobid,
+           docnum);
+  if ((con->file = open(filename, O_RDONLY)) == -1)
+  {
+    cupsdLogMessage(CUPSD_LOG_ERROR,
+                    "Unable to open document %d in job %d - %s", docnum, jobid,
+                   strerror(errno));
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("Unable to open document #%d in job #%d."), docnum,
+                   jobid);
+    return;
+  }
+
+  fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
+
+  cupsdLoadJob(job);
+
+  snprintf(format, sizeof(format), "%s/%s", job->filetypes[docnum - 1]->super,
+           job->filetypes[docnum - 1]->type);
+
+  ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_MIMETYPE, "document-format",
+               NULL, format);
+  ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER, "document-number",
+                docnum);
+  if ((attr = ippFindAttribute(job->attrs, "document-name",
+                               IPP_TAG_NAME)) != NULL)
+    ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_NAME, "document-name",
+                 NULL, attr->values[0].string.text);
+}
+
+
 /*
  * 'get_job_attrs()' - Get job attributes.
  */
@@ -5206,12 +6000,15 @@ get_job_attrs(cupsd_client_t  *con,     /* I - Client connection */
   ipp_attribute_t *attr;               /* Current attribute */
   int          jobid;                  /* Job ID */
   cupsd_job_t  *job;                   /* Current job */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  cupsd_printer_t *printer;            /* Current printer */
+  cupsd_policy_t *policy;              /* Current security policy */
+  char         scheme[HTTP_MAX_URI],   /* Scheme portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
   int          port;                   /* Port portion of URI */
-  cups_array_t *ra;                    /* Requested attributes array */
+  cups_array_t *ra,                    /* Requested attributes array */
+               *exclude;               /* Private attributes array */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_job_attrs(%p[%d], %s)", con,
@@ -5231,7 +6028,7 @@ get_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -5243,8 +6040,8 @@ get_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
 
     if (strncmp(resource, "/jobs/", 6))
@@ -5253,8 +6050,7 @@ get_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -5272,7 +6068,7 @@ get_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -5280,12 +6076,22 @@ get_job_attrs(cupsd_client_t  *con,     /* I - Client connection */
   * Check policy...
   */
 
-  if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
+  if ((printer = job->printer) == NULL)
+    printer = cupsdFindDest(job->dest);
+
+  if (printer)
+    policy = printer->op_policy_ptr;
+  else
+    policy = DefaultPolicyPtr;
+
+  if ((status = cupsdCheckPolicy(policy, con, job->username)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
+  exclude = cupsdGetPrivateAttrs(policy, con, printer, job->username);
+
  /*
   * Copy attributes...
   */
@@ -5293,7 +6099,7 @@ get_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
   cupsdLoadJob(job);
 
   ra = create_requested_array(con->request);
-  copy_job_attrs(con, job, ra);
+  copy_job_attrs(con, job, ra, exclude);
   cupsArrayDelete(ra);
 
   con->response->request.status.status_code = IPP_OK;
@@ -5311,21 +6117,25 @@ get_jobs(cupsd_client_t  *con,          /* I - Client connection */
   http_status_t        status;                 /* Policy status */
   ipp_attribute_t *attr;               /* Current attribute */
   const char   *dest;                  /* Destination */
-  cups_ptype_t dtype;                  /* Destination type (printer or class) */
+  cups_ptype_t dtype;                  /* Destination type (printer/class) */
   cups_ptype_t dmask;                  /* Destination type mask */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Scheme portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
   int          port;                   /* Port portion of URI */
-  int          completed;              /* Completed jobs? */
+  int          job_comparison;         /* Job comparison */
+  ipp_jstate_t job_state;              /* job-state value */
   int          first_job_id;           /* First job ID */
   int          limit;                  /* Maximum number of jobs to return */
   int          count;                  /* Number of jobs that match */
+  ipp_attribute_t *job_ids;            /* job-ids attribute */
   cupsd_job_t  *job;                   /* Current job pointer */
   cupsd_printer_t *printer;            /* Printer */
   cups_array_t *list;                  /* Which job list... */
-  cups_array_t *ra;                    /* Requested attributes array */
+  cups_array_t *ra,                    /* Requested attributes array */
+               *exclude;               /* Private attributes array */
+  cupsd_policy_t *policy;              /* Current policy */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs(%p[%d], %s)", con, con->http.fd,
@@ -5335,12 +6145,17 @@ get_jobs(cupsd_client_t  *con,          /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
+  if (strcmp(uri->name, "printer-uri"))
+  {
+    send_ipp_status(con, IPP_BAD_REQUEST, _("No printer-uri in request."));
+    return;
+  }
+
+  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                  sizeof(scheme), username, sizeof(username), host,
                  sizeof(host), &port, resource, sizeof(resource));
 
-  if (!strcmp(resource, "/") ||
-      (!strncmp(resource, "/jobs", 5) && strlen(resource) <= 6))
+  if (!strcmp(resource, "/") || !strcmp(resource, "/jobs"))
   {
     dest    = NULL;
     dtype   = (cups_ptype_t)0;
@@ -5361,57 +6176,114 @@ get_jobs(cupsd_client_t  *con,         /* I - Client connection */
     dmask   = CUPS_PRINTER_CLASS;
     printer = NULL;
   }
-  else if ((dest = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  else if ((dest = cupsdValidateDest(uri->values[0].string.text, &dtype,
+                                     &printer)) == NULL)
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
   else
+  {
+    dtype &= CUPS_PRINTER_CLASS;
     dmask = CUPS_PRINTER_CLASS;
+  }
 
  /*
   * Check policy...
   */
 
   if (printer)
+    policy = printer->op_policy_ptr;
+  else
+    policy = DefaultPolicyPtr;
+
+  if ((status = cupsdCheckPolicy(policy, con, NULL)) != HTTP_OK)
   {
-    if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
-    {
-      send_http_error(con, status);
-      return;
-    }
-  }
-  else if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
-  {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
+  job_ids = ippFindAttribute(con->request, "job-ids", IPP_TAG_INTEGER);
+
  /*
   * See if the "which-jobs" attribute have been specified...
   */
 
   if ((attr = ippFindAttribute(con->request, "which-jobs",
-                               IPP_TAG_KEYWORD)) != NULL &&
-      !strcmp(attr->values[0].string.text, "completed"))
+                               IPP_TAG_KEYWORD)) != NULL && job_ids)
+  {
+    send_ipp_status(con, IPP_CONFLICT,
+                    _("The %s attribute cannot be provided with job-ids."),
+                    "which-jobs");
+    return;
+  }
+  else if (!attr || !strcmp(attr->values[0].string.text, "not-completed"))
   {
-    completed = 1;
-    list      = Jobs;
+    job_comparison = -1;
+    job_state      = IPP_JOB_STOPPED;
+    list           = ActiveJobs;
   }
-  else if (attr && !strcmp(attr->values[0].string.text, "all"))
+  else if (!strcmp(attr->values[0].string.text, "completed"))
   {
-    completed = 0;
-    list      = Jobs;
+    job_comparison = 1;
+    job_state      = IPP_JOB_CANCELED;
+    list           = Jobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "aborted"))
+  {
+    job_comparison = 0;
+    job_state      = IPP_JOB_ABORTED;
+    list           = Jobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "all"))
+  {
+    job_comparison = 1;
+    job_state      = IPP_JOB_PENDING;
+    list           = Jobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "canceled"))
+  {
+    job_comparison = 0;
+    job_state      = IPP_JOB_CANCELED;
+    list           = Jobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "pending"))
+  {
+    job_comparison = 0;
+    job_state      = IPP_JOB_PENDING;
+    list           = ActiveJobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "pending-held"))
+  {
+    job_comparison = 0;
+    job_state      = IPP_JOB_HELD;
+    list           = ActiveJobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "processing"))
+  {
+    job_comparison = 0;
+    job_state      = IPP_JOB_PROCESSING;
+    list           = PrintingJobs;
+  }
+  else if (!strcmp(attr->values[0].string.text, "processing-stopped"))
+  {
+    job_comparison = 0;
+    job_state      = IPP_JOB_STOPPED;
+    list           = ActiveJobs;
   }
   else
   {
-    completed = 0;
-    list      = ActiveJobs;
+    send_ipp_status(con, IPP_ATTRIBUTES,
+                    _("The which-jobs value \"%s\" is not supported."),
+                   attr->values[0].string.text);
+    ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_KEYWORD,
+                 "which-jobs", NULL, attr->values[0].string.text);
+    return;
   }
 
  /*
@@ -5420,13 +6292,33 @@ get_jobs(cupsd_client_t  *con,          /* I - Client connection */
 
   if ((attr = ippFindAttribute(con->request, "limit",
                                IPP_TAG_INTEGER)) != NULL)
+  {
+    if (job_ids)
+    {
+      send_ipp_status(con, IPP_CONFLICT,
+                     _("The %s attribute cannot be provided with job-ids."),
+                     "limit");
+      return;
+    }
+
     limit = attr->values[0].integer;
+  }
   else
-    limit = 1000000;
+    limit = 0;
 
   if ((attr = ippFindAttribute(con->request, "first-job-id",
                                IPP_TAG_INTEGER)) != NULL)
+  {
+    if (job_ids)
+    {
+      send_ipp_status(con, IPP_CONFLICT,
+                     _("The %s attribute cannot be provided with job-ids."),
+                     "first-job-id");
+      return;
+    }
+
     first_job_id = attr->values[0].integer;
+  }
   else
     first_job_id = 1;
 
@@ -5435,8 +6327,14 @@ get_jobs(cupsd_client_t  *con,           /* I - Client connection */
   */
 
   if ((attr = ippFindAttribute(con->request, "my-jobs",
-                               IPP_TAG_BOOLEAN)) != NULL &&
-      attr->values[0].boolean)
+                               IPP_TAG_BOOLEAN)) != NULL && job_ids)
+  {
+    send_ipp_status(con, IPP_CONFLICT,
+                    _("The %s attribute cannot be provided with job-ids."),
+                    "my-jobs");
+    return;
+  }
+  else if (attr && attr->values[0].boolean)
     strlcpy(username, get_username(con), sizeof(username));
   else
     username[0] = '\0';
@@ -5447,44 +6345,109 @@ get_jobs(cupsd_client_t  *con,         /* I - Client connection */
   * OK, build a list of jobs for this printer...
   */
 
-  for (count = 0, job = (cupsd_job_t *)cupsArrayFirst(list);
-       count < limit && job;
-       job = (cupsd_job_t *)cupsArrayNext(list))
+  if (job_ids)
   {
-   /*
-    * Filter out jobs that don't match...
-    */
+    int        i;                              /* Looping var */
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: job->id = %d", job->id);
+    for (i = 0; i < job_ids->num_values; i ++)
+    {
+      if (!cupsdFindJob(job_ids->values[i].integer))
+        break;
+    }
 
-    if ((dest && strcmp(job->dest, dest)) &&
-        (!job->printer || !dest || strcmp(job->printer->name, dest)))
-      continue;
-    if ((job->dtype & dmask) != dtype &&
-        (!job->printer || (job->printer->type & dmask) != dtype))
-      continue;
-    if (username[0] && strcasecmp(username, job->username))
-      continue;
+    if (i < job_ids->num_values)
+    {
+      send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
+                      job_ids->values[i].integer);
+      return;
+    }
 
-    if (completed && job->state_value <= IPP_JOB_STOPPED)
-      continue;
+    for (i = 0; i < job_ids->num_values; i ++)
+    {
+      job = cupsdFindJob(job_ids->values[i].integer);
 
-    if (job->id < first_job_id)
-      continue;
+      cupsdLoadJob(job);
+
+      if (!job->attrs)
+      {
+       cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: No attributes for job %d",
+                       job->id);
+       continue;
+      }
 
-    cupsdLoadJob(job);
+      if (i > 0)
+       ippAddSeparator(con->response);
 
-    if (!job->attrs)
-      continue;
+      exclude = cupsdGetPrivateAttrs(job->printer ?
+                                         job->printer->op_policy_ptr :
+                                        policy, con, job->printer,
+                                        job->username);
 
-    if (count > 0)
-      ippAddSeparator(con->response);
+      copy_job_attrs(con, job, ra, exclude);
+    }
+  }
+  else
+  {
+    for (count = 0, job = (cupsd_job_t *)cupsArrayFirst(list);
+        (limit <= 0 || count < limit) && job;
+        job = (cupsd_job_t *)cupsArrayNext(list))
+    {
+     /*
+      * Filter out jobs that don't match...
+      */
+
+      cupsdLogMessage(CUPSD_LOG_DEBUG2,
+                     "get_jobs: job->id=%d, dest=\"%s\", username=\"%s\", "
+                     "state_value=%d, attrs=%p", job->id, job->dest,
+                     job->username, job->state_value, job->attrs);
+
+      if (!job->dest || !job->username)
+       cupsdLoadJob(job);
+
+      if (!job->dest || !job->username)
+       continue;
+
+      if ((dest && strcmp(job->dest, dest)) &&
+         (!job->printer || !dest || strcmp(job->printer->name, dest)))
+       continue;
+      if ((job->dtype & dmask) != dtype &&
+         (!job->printer || (job->printer->type & dmask) != dtype))
+       continue;
+
+      if ((job_comparison < 0 && job->state_value > job_state) ||
+          (job_comparison == 0 && job->state_value != job_state) ||
+          (job_comparison > 0 && job->state_value < job_state))
+       continue;
+
+      if (job->id < first_job_id)
+       continue;
+
+      cupsdLoadJob(job);
+
+      if (!job->attrs)
+      {
+       cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: No attributes for job %d",
+                       job->id);
+       continue;
+      }
+
+      if (username[0] && _cups_strcasecmp(username, job->username))
+       continue;
+
+      if (count > 0)
+       ippAddSeparator(con->response);
+
+      count ++;
 
-    count ++;
+      exclude = cupsdGetPrivateAttrs(job->printer ?
+                                         job->printer->op_policy_ptr :
+                                        policy, con, job->printer,
+                                        job->username);
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: count = %d", count);
+      copy_job_attrs(con, job, ra, exclude);
+    }
 
-    copy_job_attrs(con, job, ra);
+    cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: count=%d", count);
   }
 
   cupsArrayDelete(ra);
@@ -5509,7 +6472,7 @@ get_notifications(cupsd_client_t *con)    /* I - Client connection */
   int                  interval;       /* Poll interval */
 
 
-  cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_subscription_attrs(con=%p[%d])",
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_notifications(con=%p[%d])",
                   con, con->http.fd);
 
  /*
@@ -5524,7 +6487,7 @@ get_notifications(cupsd_client_t *con)    /* I - Client connection */
   if (!ids)
   {
     send_ipp_status(con, IPP_BAD_REQUEST,
-                    _("Missing notify-subscription-ids attribute!"));
+                    _("Missing notify-subscription-ids attribute."));
     return;
   }
 
@@ -5540,8 +6503,7 @@ get_notifications(cupsd_client_t *con)    /* I - Client connection */
       * Bad subscription ID...
       */
 
-      send_ipp_status(con, IPP_NOT_FOUND,
-                      _("notify-subscription-id %d no good!"),
+      send_ipp_status(con, IPP_NOT_FOUND, _("Subscription #%d does not exist."),
                      ids->values[i].integer);
       return;
     }
@@ -5554,7 +6516,7 @@ get_notifications(cupsd_client_t *con)    /* I - Client connection */
                                                DefaultPolicyPtr,
                                    con, sub->owner)) != HTTP_OK)
     {
-      send_http_error(con, status);
+      send_http_error(con, status, sub->dest);
       return;
     }
 
@@ -5607,7 +6569,7 @@ get_notifications(cupsd_client_t *con)    /* I - Client connection */
     * If we don't have any new events, nothing to do here...
     */
 
-    if (min_seq > (sub->first_event_id + sub->num_events))
+    if (min_seq > (sub->first_event_id + cupsArrayCount(sub->events)))
       continue;
 
    /*
@@ -5619,14 +6581,160 @@ get_notifications(cupsd_client_t *con) /* I - Client connection */
     else
       j = min_seq - sub->first_event_id;
 
-    for (; j < sub->num_events; j ++)
+    for (; j < cupsArrayCount(sub->events); j ++)
     {
       ippAddSeparator(con->response);
 
-      copy_attrs(con->response, sub->events[j]->attrs, NULL,
-                IPP_TAG_EVENT_NOTIFICATION, 0);
+      copy_attrs(con->response,
+                 ((cupsd_event_t *)cupsArrayIndex(sub->events, j))->attrs, NULL,
+                IPP_TAG_EVENT_NOTIFICATION, 0, NULL);
+    }
+  }
+}
+
+
+/*
+ * 'get_ppd()' - Get a named PPD from the local system.
+ */
+
+static void
+get_ppd(cupsd_client_t  *con,          /* I - Client connection */
+        ipp_attribute_t *uri)          /* I - Printer URI or PPD name */
+{
+  http_status_t                status;         /* Policy status */
+  cupsd_printer_t      *dest;          /* Destination */
+  cups_ptype_t         dtype;          /* Destination type */
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_ppd(%p[%d], %p[%s=%s])", con,
+                  con->http.fd, uri, uri->name, uri->values[0].string.text);
+
+  if (!strcmp(uri->name, "ppd-name"))
+  {
+   /*
+    * Return a PPD file from cups-driverd...
+    */
+
+    char       command[1024],  /* cups-driverd command */
+               options[1024],  /* Options to pass to command */
+               ppd_name[1024]; /* ppd-name */
+
+
+   /*
+    * Check policy...
+    */
+
+    if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
+    {
+      send_http_error(con, status, NULL);
+      return;
+    }
+
+   /*
+    * Run cups-driverd command with the given options...
+    */
+
+    snprintf(command, sizeof(command), "%s/daemon/cups-driverd", ServerBin);
+    url_encode_string(uri->values[0].string.text, ppd_name, sizeof(ppd_name));
+    snprintf(options, sizeof(options), "get+%d+%s",
+             con->request->request.op.request_id, ppd_name);
+
+    if (cupsdSendCommand(con, command, options, 0))
+    {
+     /*
+      * Command started successfully, don't send an IPP response here...
+      */
+
+      ippDelete(con->response);
+      con->response = NULL;
+    }
+    else
+    {
+     /*
+      * Command failed, return "internal error" so the user knows something
+      * went wrong...
+      */
+
+      send_ipp_status(con, IPP_INTERNAL_ERROR,
+                     _("cups-driverd failed to execute."));
     }
   }
+  else if (!strcmp(uri->name, "printer-uri") &&
+           cupsdValidateDest(uri->values[0].string.text, &dtype, &dest))
+  {
+    int        i;                      /* Looping var */
+    char       filename[1024];         /* PPD filename */
+
+
+   /*
+    * Check policy...
+    */
+
+    if ((status = cupsdCheckPolicy(dest->op_policy_ptr, con, NULL)) != HTTP_OK)
+    {
+      send_http_error(con, status, dest);
+      return;
+    }
+
+   /*
+    * See if we need the PPD for a class or remote printer...
+    */
+
+    snprintf(filename, sizeof(filename), "%s/ppd/%s.ppd", ServerRoot,
+             dest->name);
+
+    if ((dtype & CUPS_PRINTER_REMOTE) && access(filename, 0))
+    {
+      con->response->request.status.status_code = CUPS_SEE_OTHER;
+      ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_URI,
+                   "printer-uri", NULL, dest->uri);
+      return;
+    }
+    else if (dtype & CUPS_PRINTER_CLASS)
+    {
+      for (i = 0; i < dest->num_printers; i ++)
+        if (!(dest->printers[i]->type & CUPS_PRINTER_CLASS))
+       {
+         snprintf(filename, sizeof(filename), "%s/ppd/%s.ppd", ServerRoot,
+                  dest->printers[i]->name);
+
+          if (!access(filename, 0))
+           break;
+        }
+
+      if (i < dest->num_printers)
+        dest = dest->printers[i];
+      else
+      {
+        con->response->request.status.status_code = CUPS_SEE_OTHER;
+       ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_URI,
+                    "printer-uri", NULL, dest->printers[0]->uri);
+        return;
+      }
+    }
+
+   /*
+    * Found the printer with the PPD file, now see if there is one...
+    */
+
+    if ((con->file = open(filename, O_RDONLY)) < 0)
+    {
+      send_ipp_status(con, IPP_NOT_FOUND,
+                      _("The PPD file \"%s\" could not be opened: %s"),
+                     uri->values[0].string.text, strerror(errno));
+      return;
+    }
+
+    fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
+
+    con->pipe_pid = 0;
+
+    con->response->request.status.status_code = IPP_OK;
+  }
+  else
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The PPD file \"%s\" could not be found."),
+                    uri->values[0].string.text);
 }
 
 
@@ -5639,13 +6747,37 @@ get_ppds(cupsd_client_t *con)           /* I - Client connection */
 {
   http_status_t                status;         /* Policy status */
   ipp_attribute_t      *limit,         /* Limit attribute */
+                       *device,        /* ppd-device-id attribute */
+                       *language,      /* ppd-natural-language attribute */
                        *make,          /* ppd-make attribute */
-                       *requested;     /* requested-attributes attribute */
-  char                 command[1024],  /* cups-deviced command */
-                       options[1024],  /* Options to pass to command */
+                       *model,         /* ppd-make-and-model attribute */
+                       *model_number,  /* ppd-model-number attribute */
+                       *product,       /* ppd-product attribute */
+                       *psversion,     /* ppd-psverion attribute */
+                       *type,          /* ppd-type attribute */
+                       *requested,     /* requested-attributes attribute */
+                       *exclude,       /* exclude-schemes attribute */
+                       *include;       /* include-schemes attribute */
+  char                 command[1024],  /* cups-driverd command */
+                       options[4096],  /* Options to pass to command */
+                       device_str[256],/* Escaped ppd-device-id string */
+                       language_str[256],
+                                       /* Escaped ppd-natural-language */
+                       make_str[256],  /* Escaped ppd-make string */
+                       model_str[256], /* Escaped ppd-make-and-model string */
+                       model_number_str[256],
+                                       /* ppd-model-number string */
+                       product_str[256],
+                                       /* Escaped ppd-product string */
+                       psversion_str[256],
+                                       /* Escaped ppd-psversion string */
+                       type_str[256],  /* Escaped ppd-type string */
                        requested_str[256],
                                        /* String for requested attributes */
-                       make_str[256];  /* Escaped ppd-make string */
+                       exclude_str[512],
+                                       /* String for excluded schemes */
+                       include_str[512];
+                                       /* String for included schemes */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_ppds(%p[%d])", con, con->http.fd);
@@ -5656,7 +6788,7 @@ get_ppds(cupsd_client_t *con)             /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -5664,26 +6796,97 @@ get_ppds(cupsd_client_t *con)           /* I - Client connection */
   * Run cups-driverd command with the given options...
   */
 
-  limit     = ippFindAttribute(con->request, "limit", IPP_TAG_INTEGER);
-  make      = ippFindAttribute(con->request, "ppd-make", IPP_TAG_TEXT);
-  requested = ippFindAttribute(con->request, "requested-attributes",
-                               IPP_TAG_KEYWORD);
+  limit        = ippFindAttribute(con->request, "limit", IPP_TAG_INTEGER);
+  device       = ippFindAttribute(con->request, "ppd-device-id", IPP_TAG_TEXT);
+  language     = ippFindAttribute(con->request, "ppd-natural-language",
+                                  IPP_TAG_LANGUAGE);
+  make         = ippFindAttribute(con->request, "ppd-make", IPP_TAG_TEXT);
+  model        = ippFindAttribute(con->request, "ppd-make-and-model",
+                                  IPP_TAG_TEXT);
+  model_number = ippFindAttribute(con->request, "ppd-model-number",
+                                  IPP_TAG_INTEGER);
+  product      = ippFindAttribute(con->request, "ppd-product", IPP_TAG_TEXT);
+  psversion    = ippFindAttribute(con->request, "ppd-psversion", IPP_TAG_TEXT);
+  type         = ippFindAttribute(con->request, "ppd-type", IPP_TAG_KEYWORD);
+  requested    = ippFindAttribute(con->request, "requested-attributes",
+                                  IPP_TAG_KEYWORD);
+  exclude      = ippFindAttribute(con->request, "exclude-schemes",
+                                  IPP_TAG_NAME);
+  include      = ippFindAttribute(con->request, "include-schemes",
+                                  IPP_TAG_NAME);
 
   if (requested)
     url_encode_attr(requested, requested_str, sizeof(requested_str));
   else
-    strlcpy(requested_str, "requested-attributes=all", sizeof(requested_str));
+    strlcpy(requested_str, "requested-attributes=all", sizeof(requested_str));
+
+  if (device)
+    url_encode_attr(device, device_str, sizeof(device_str));
+  else
+    device_str[0] = '\0';
+
+  if (language)
+    url_encode_attr(language, language_str, sizeof(language_str));
+  else
+    language_str[0] = '\0';
 
   if (make)
     url_encode_attr(make, make_str, sizeof(make_str));
   else
     make_str[0] = '\0';
 
+  if (model)
+    url_encode_attr(model, model_str, sizeof(model_str));
+  else
+    model_str[0] = '\0';
+
+  if (model_number)
+    snprintf(model_number_str, sizeof(model_number_str), "ppd-model-number=%d",
+             model_number->values[0].integer);
+  else
+    model_number_str[0] = '\0';
+
+  if (product)
+    url_encode_attr(product, product_str, sizeof(product_str));
+  else
+    product_str[0] = '\0';
+
+  if (psversion)
+    url_encode_attr(psversion, psversion_str, sizeof(psversion_str));
+  else
+    psversion_str[0] = '\0';
+
+  if (type)
+    url_encode_attr(type, type_str, sizeof(type_str));
+  else
+    type_str[0] = '\0';
+
+  if (exclude)
+    url_encode_attr(exclude, exclude_str, sizeof(exclude_str));
+  else
+    exclude_str[0] = '\0';
+
+  if (include)
+    url_encode_attr(include, include_str, sizeof(include_str));
+  else
+    include_str[0] = '\0';
+
   snprintf(command, sizeof(command), "%s/daemon/cups-driverd", ServerBin);
-  snprintf(options, sizeof(options), "list+%d+%d+%s%s%s",
+  snprintf(options, sizeof(options),
+           "list+%d+%d+%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
            con->request->request.op.request_id,
            limit ? limit->values[0].integer : 0,
-          requested_str, make ? "%20" : "", make_str);
+          requested_str,
+          device ? "%20" : "", device_str,
+          language ? "%20" : "", language_str,
+          make ? "%20" : "", make_str,
+          model ? "%20" : "", model_str,
+          model_number ? "%20" : "", model_number_str,
+          product ? "%20" : "", product_str,
+          psversion ? "%20" : "", psversion_str,
+          type ? "%20" : "", type_str,
+          exclude_str[0] ? "%20" : "", exclude_str,
+          include_str[0] ? "%20" : "", include_str);
 
   if (cupsdSendCommand(con, command, options, 0))
   {
@@ -5716,16 +6919,7 @@ get_printer_attrs(cupsd_client_t  *con,  /* I - Client connection */
                  ipp_attribute_t *uri) /* I - Printer URI */
 {
   http_status_t                status;         /* Policy status */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
-  char                 method[HTTP_MAX_URI],
-                                       /* Method portion of URI */
-                       username[HTTP_MAX_URI],
-                                       /* Username portion of URI */
-                       host[HTTP_MAX_URI],
-                                       /* Host portion of URI */
-                       resource[HTTP_MAX_URI];
-                                       /* Resource portion of URI */
-  int                  port;           /* Port portion of URI */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
   cupsd_printer_t      *printer;       /* Printer/class */
   cups_array_t         *ra;            /* Requested attributes array */
 
@@ -5737,18 +6931,14 @@ get_printer_attrs(cupsd_client_t  *con, /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if (!cupsdValidateDest(host, resource, &dtype, &printer))
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -5758,7 +6948,7 @@ get_printer_attrs(cupsd_client_t  *con,   /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
     return;
   }
 
@@ -5776,6 +6966,61 @@ get_printer_attrs(cupsd_client_t  *con,  /* I - Client connection */
 }
 
 
+/*
+ * 'get_printer_supported()' - Get printer supported values.
+ */
+
+static void
+get_printer_supported(
+    cupsd_client_t  *con,              /* I - Client connection */
+    ipp_attribute_t *uri)              /* I - Printer URI */
+{
+  http_status_t                status;         /* Policy status */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
+  cupsd_printer_t      *printer;       /* Printer/class */
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_printer_supported(%p[%d], %s)", con,
+                  con->http.fd, uri->values[0].string.text);
+
+ /*
+  * Is the destination valid?
+  */
+
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
+  {
+   /*
+    * Bad URI...
+    */
+
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The printer or class does not exist."));
+    return;
+  }
+
+ /*
+  * Check policy...
+  */
+
+  if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
+  {
+    send_http_error(con, status, printer);
+    return;
+  }
+
+ /*
+  * Return a list of attributes that can be set via Set-Printer-Attributes.
+  */
+
+  ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_ADMINDEFINE,
+                "printer-info", 0);
+  ippAddInteger(con->response, IPP_TAG_PRINTER, IPP_TAG_ADMINDEFINE,
+                "printer-location", 0);
+
+  con->response->request.status.status_code = IPP_OK;
+}
+
+
 /*
  * 'get_printers()' - Get a list of printers or classes.
  */
@@ -5786,7 +7031,7 @@ get_printers(cupsd_client_t *con, /* I - Client connection */
 {
   http_status_t        status;                 /* Policy status */
   ipp_attribute_t *attr;               /* Current attribute */
-  int          limit;                  /* Maximum number of printers to return */
+  int          limit;                  /* Max number of printers to return */
   int          count;                  /* Number of printers that match */
   cupsd_printer_t *printer;            /* Current printer pointer */
   int          printer_type,           /* printer-type attribute */
@@ -5795,6 +7040,7 @@ get_printers(cupsd_client_t *con, /* I - Client connection */
   const char   *username;              /* Current user */
   char         *first_printer_name;    /* first-printer-name attribute */
   cups_array_t *ra;                    /* Requested attributes array */
+  int          local;                  /* Local connection? */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_printers(%p[%d], %x)", con,
@@ -5806,7 +7052,7 @@ get_printers(cupsd_client_t *con, /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -5852,6 +7098,8 @@ get_printers(cupsd_client_t *con, /* I - Client connection */
   else
     printer_mask = 0;
 
+  local = httpAddrLocalhost(&(con->clientaddr));
+
   if ((attr = ippFindAttribute(con->request, "printer-location",
                                IPP_TAG_TEXT)) != NULL)
     location = attr->values[0].string.text;
@@ -5884,26 +7132,21 @@ get_printers(cupsd_client_t *con,       /* I - Client connection */
        count < limit && printer;
        printer = (cupsd_printer_t *)cupsArrayNext(Printers))
   {
+    if (!local && !printer->shared)
+      continue;
+
     if ((!type || (printer->type & CUPS_PRINTER_CLASS) == type) &&
         (printer->type & printer_mask) == printer_type &&
-       (!location || !printer->location ||
-        !strcasecmp(printer->location, location)))
+       (!location ||
+        (printer->location && !_cups_strcasecmp(printer->location, location))))
     {
-     /*
-      * If HideImplicitMembers is enabled, see if this printer or class
-      * is a member of an implicit class...
-      */
-
-      if (ImplicitClasses && HideImplicitMembers &&
-          printer->in_implicit_class)
-        continue;
-
      /*
       * If a username is specified, see if it is allowed or denied
       * access...
       */
 
-      if (printer->num_users && username && !user_allowed(printer, username))
+      if (cupsArrayCount(printer->users) && username &&
+         !user_allowed(printer, username))
         continue;
 
      /*
@@ -5940,7 +7183,9 @@ get_subscription_attrs(
 {
   http_status_t                status;         /* Policy status */
   cupsd_subscription_t *sub;           /* Subscription */
-  cups_array_t         *ra;            /* Requested attributes array */
+  cupsd_policy_t       *policy;        /* Current security policy */
+  cups_array_t         *ra,            /* Requested attributes array */
+                       *exclude;       /* Private attributes array */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
@@ -5957,8 +7202,8 @@ get_subscription_attrs(
     * Bad subscription ID...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND,
-                    _("notify-subscription-id %d no good!"), sub_id);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Subscription #%d does not exist."),
+                    sub_id);
     return;
   }
 
@@ -5966,14 +7211,19 @@ get_subscription_attrs(
   * Check policy...
   */
 
-  if ((status = cupsdCheckPolicy(sub->dest ? sub->dest->op_policy_ptr :
-                                             DefaultPolicyPtr,
-                                 con, sub->owner)) != HTTP_OK)
+  if (sub->dest)
+    policy = sub->dest->op_policy_ptr;
+  else
+    policy = DefaultPolicyPtr;
+
+  if ((status = cupsdCheckPolicy(policy, con, sub->owner)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, sub->dest);
     return;
   }
 
+  exclude = cupsdGetPrivateAttrs(policy, con, sub->dest, sub->owner);
+
  /*
   * Copy the subscription attributes to the response using the
   * requested-attributes attribute that may be provided by the client.
@@ -5981,7 +7231,7 @@ get_subscription_attrs(
 
   ra = create_requested_array(con->request);
 
-  copy_subscription_attrs(con, sub, ra);
+  copy_subscription_attrs(con, sub, ra, exclude);
 
   cupsArrayDelete(ra);
 
@@ -6003,9 +7253,9 @@ get_subscriptions(cupsd_client_t  *con,   /* I - Client connection */
   cupsd_subscription_t *sub;           /* Subscription */
   cups_array_t         *ra;            /* Requested attributes array */
   ipp_attribute_t      *attr;          /* Attribute */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
-  char                 method[HTTP_MAX_URI],
-                                       /* Method portion of URI */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
+  char                 scheme[HTTP_MAX_URI],
+                                       /* Scheme portion of URI */
                        username[HTTP_MAX_URI],
                                        /* Username portion of URI */
                        host[HTTP_MAX_URI],
@@ -6015,6 +7265,8 @@ get_subscriptions(cupsd_client_t  *con,   /* I - Client connection */
   int                  port;           /* Port portion of URI */
   cupsd_job_t          *job;           /* Job pointer */
   cupsd_printer_t      *printer;       /* Printer */
+  cupsd_policy_t       *policy;        /* Policy */
+  cups_array_t         *exclude;       /* Private attributes array */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
@@ -6025,8 +7277,8 @@ get_subscriptions(cupsd_client_t  *con,   /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
+  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                  sizeof(scheme), username, sizeof(username), host,
                  sizeof(host), &port, resource, sizeof(resource));
 
   if (!strcmp(resource, "/") ||
@@ -6044,19 +7296,19 @@ get_subscriptions(cupsd_client_t  *con, /* I - Client connection */
 
     if (!job)
     {
-      send_ipp_status(con, IPP_NOT_FOUND, _("Job #%s does not exist!"),
-                      resource + 6);
+      send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
+                      atoi(resource + 6));
       return;
     }
   }
-  else if (!cupsdValidateDest(host, resource, &dtype, &printer))
+  else if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
   else if ((attr = ippFindAttribute(con->request, "notify-job-id",
@@ -6066,7 +7318,7 @@ get_subscriptions(cupsd_client_t  *con,   /* I - Client connection */
 
     if (!job)
     {
-      send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"),
+      send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."),
                       attr->values[0].integer);
       return;
     }
@@ -6078,11 +7330,14 @@ get_subscriptions(cupsd_client_t  *con, /* I - Client connection */
   * Check policy...
   */
 
-  if ((status = cupsdCheckPolicy(printer ? printer->op_policy_ptr :
-                                           DefaultPolicyPtr,
-                                 con, NULL)) != HTTP_OK)
+  if (printer)
+    policy = printer->op_policy_ptr;
+  else
+    policy = DefaultPolicyPtr;
+
+  if ((status = cupsdCheckPolicy(policy, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
     return;
   }
 
@@ -6114,10 +7369,15 @@ get_subscriptions(cupsd_client_t  *con, /* I - Client connection */
        sub;
        sub = (cupsd_subscription_t *)cupsArrayNext(Subscriptions))
     if ((!printer || sub->dest == printer) && (!job || sub->job == job) &&
-        (!username[0] || !strcasecmp(username, sub->owner)))
+        (!username[0] || !_cups_strcasecmp(username, sub->owner)))
     {
       ippAddSeparator(con->response);
-      copy_subscription_attrs(con, sub, ra);
+
+      exclude = cupsdGetPrivateAttrs(sub->dest ? sub->dest->op_policy_ptr :
+                                                policy, con, sub->dest,
+                                                sub->owner);
+
+      copy_subscription_attrs(con, sub, ra, exclude);
 
       count ++;
       if (limit && count >= limit)
@@ -6161,10 +7421,10 @@ static void
 hold_job(cupsd_client_t  *con,         /* I - Client connection */
          ipp_attribute_t *uri)         /* I - Job or Printer URI */
 {
-  ipp_attribute_t *attr,               /* Current job-hold-until */
-               *newattr;               /* New job-hold-until */
+  ipp_attribute_t *attr;               /* Current job-hold-until */
+  const char   *when;                  /* New value */
   int          jobid;                  /* Job ID */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Method portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
@@ -6189,7 +7449,7 @@ hold_job(cupsd_client_t  *con,            /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -6201,8 +7461,8 @@ hold_job(cupsd_client_t  *con,            /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
 
     if (strncmp(resource, "/jobs/", 6))
@@ -6212,7 +7472,7 @@ hold_job(cupsd_client_t  *con,            /* I - Client connection */
       */
 
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+                      _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -6230,7 +7490,7 @@ hold_job(cupsd_client_t  *con,            /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -6240,59 +7500,114 @@ hold_job(cupsd_client_t  *con,         /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                   cupsdFindDest(job->dest));
     return;
   }
 
  /*
-  * Hold the job and return...
+  * See if the job is in a state that allows holding...
   */
 
-  cupsdHoldJob(job);
+  if (job->state_value > IPP_JOB_STOPPED)
+  {
+   /*
+    * Return a "not-possible" error...
+    */
 
-  cupsdAddEvent(CUPSD_EVENT_JOB_STATE, job->printer, job,
-                "Job held by user.");
+    send_ipp_status(con, IPP_NOT_POSSIBLE,
+                   _("Job #%d is finished and cannot be altered."),
+                   job->id);
+    return;
+  }
 
-  if ((newattr = ippFindAttribute(con->request, "job-hold-until",
-                                  IPP_TAG_KEYWORD)) == NULL)
-    newattr = ippFindAttribute(con->request, "job-hold-until", IPP_TAG_NAME);
+ /*
+  * Hold the job and return...
+  */
 
-  if ((attr = ippFindAttribute(job->attrs, "job-hold-until",
-                               IPP_TAG_KEYWORD)) == NULL)
-    attr = ippFindAttribute(job->attrs, "job-hold-until", IPP_TAG_NAME);
+  if ((attr = ippFindAttribute(con->request, "job-hold-until",
+                              IPP_TAG_KEYWORD)) == NULL)
+    attr = ippFindAttribute(con->request, "job-hold-until", IPP_TAG_NAME);
 
   if (attr)
   {
-   /*
-    * Free the old hold value and copy the new one over...
-    */
+    when = attr->values[0].string.text;
 
-    _cupsStrFree(attr->values[0].string.text);
+    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, cupsdFindDest(job->dest), job,
+                 "Job job-hold-until value changed by user.");
+  }
+  else
+    when = "indefinite";
 
-    if (newattr)
-    {
-      attr->value_tag = newattr->value_tag;
-      attr->values[0].string.text =
-          _cupsStrAlloc(newattr->values[0].string.text);
-    }
-    else
-    {
-      attr->value_tag = IPP_TAG_KEYWORD;
-      attr->values[0].string.text = _cupsStrAlloc("indefinite");
-    }
+  cupsdSetJobHoldUntil(job, when, 1);
+  cupsdSetJobState(job, IPP_JOB_HELD, CUPSD_JOB_DEFAULT, "Job held by \"%s\".",
+                   username);
+
+  con->response->request.status.status_code = IPP_OK;
+}
+
+
+/*
+ * 'hold_new_jobs()' - Hold pending/new jobs on a printer or class.
+ */
+
+static void
+hold_new_jobs(cupsd_client_t  *con,    /* I - Connection */
+              ipp_attribute_t *uri)    /* I - Printer URI */
+{
+  http_status_t                status;         /* Policy status */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
+  cupsd_printer_t      *printer;       /* Printer data */
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "hold_new_jobs(%p[%d], %s)", con,
+                  con->http.fd, uri->values[0].string.text);
 
+ /*
+  * Is the destination valid?
+  */
+
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
+  {
    /*
-    * Hold job until specified time...
+    * Bad URI...
     */
 
-    cupsdSetJobHoldUntil(job, attr->values[0].string.text);
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The printer or class does not exist."));
+    return;
+  }
+
+ /*
+  * Check policy...
+  */
 
-    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, job->printer, job,
-                  "Job job-hold-until value changed by user.");
+  if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
+  {
+    send_http_error(con, status, printer);
+    return;
   }
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d was held by \"%s\".", jobid,
-                  username);
+ /*
+  * Hold pending/new jobs sent to the printer...
+  */
+
+  printer->holding_new_jobs = 1;
+
+  cupsdSetPrinterReasons(printer, "+hold-new-jobs");
+
+  if (dtype & CUPS_PRINTER_CLASS)
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Class \"%s\" now holding pending/new jobs (\"%s\").",
+                    printer->name, get_username(con));
+  else
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Printer \"%s\" now holding pending/new jobs (\"%s\").",
+                    printer->name, get_username(con));
+
+ /*
+  * Everything was ok, so return OK status...
+  */
 
   con->response->request.status.status_code = IPP_OK;
 }
@@ -6312,8 +7627,8 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
   cupsd_job_t  *job;                   /* Current job */
   const char   *src;                   /* Source printer/class */
   cups_ptype_t stype,                  /* Source type (printer or class) */
-               dtype;                  /* Destination type (printer or class) */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+               dtype;                  /* Destination type (printer/class) */
+  char         scheme[HTTP_MAX_URI],   /* Scheme portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
@@ -6337,32 +7652,18 @@ move_job(cupsd_client_t  *con,          /* I - Client connection */
     */
 
     send_ipp_status(con, IPP_BAD_REQUEST,
-                    _("job-printer-uri attribute missing!"));
+                    _("job-printer-uri attribute missing."));
     return;
   }
-    
-  httpSeparateURI(HTTP_URI_CODING_ALL, attr->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
 
-  if (!cupsdValidateDest(host, resource, &dtype, &dprinter))
+  if (!cupsdValidateDest(attr->values[0].string.text, &dtype, &dprinter))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
-    return;
-  }
-
- /*
-  * Check policy...
-  */
-
-  if ((status = cupsdCheckPolicy(dprinter->op_policy_ptr, con, NULL)) != HTTP_OK)
-  {
-    send_http_error(con, status);
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -6370,8 +7671,8 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
   * See if we have a job URI or a printer URI...
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
+  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                  sizeof(scheme), username, sizeof(username), host,
                  sizeof(host), &port, resource, sizeof(resource));
 
   if (!strcmp(uri->name, "printer-uri"))
@@ -6387,14 +7688,15 @@ move_job(cupsd_client_t  *con,          /* I - Client connection */
       * Move all jobs...
       */
 
-      if ((src = cupsdValidateDest(host, resource, &stype, &sprinter)) == NULL)
+      if ((src = cupsdValidateDest(uri->values[0].string.text, &stype,
+                                   &sprinter)) == NULL)
       {
        /*
        * Bad URI...
        */
 
        send_ipp_status(con, IPP_NOT_FOUND,
-                       _("The printer or class was not found."));
+                       _("The printer or class does not exist."));
        return;
       }
 
@@ -6413,7 +7715,7 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
        */
 
        send_ipp_status(con, IPP_NOT_FOUND,
-                       _("Job #%d does not exist!"), attr->values[0].integer);
+                       _("Job #%d does not exist."), attr->values[0].integer);
        return;
       }
       else
@@ -6439,8 +7741,7 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -6457,8 +7758,7 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
       * Nope - return a "not found" error...
       */
 
-      send_ipp_status(con, IPP_NOT_FOUND,
-                      _("Job #%d does not exist!"), jobid);
+      send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
       return;
     }
     else
@@ -6472,6 +7772,17 @@ move_job(cupsd_client_t  *con,           /* I - Client connection */
     }
   }
 
+ /*
+  * Check the policy of the destination printer...
+  */
+
+  if ((status = cupsdCheckPolicy(dprinter->op_policy_ptr, con,
+                                 job ? job->username : NULL)) != HTTP_OK)
+  {
+    send_http_error(con, status, dprinter);
+    return;
+  }
+
  /*
   * Now move the job or jobs...
   */
@@ -6489,7 +7800,7 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
       */
 
       send_ipp_status(con, IPP_NOT_POSSIBLE,
-                      _("Job #%d is finished and cannot be altered!"),
+                      _("Job #%d is finished and cannot be altered."),
                      job->id);
       return;
     }
@@ -6500,7 +7811,8 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
 
     if (!validate_user(job, con, job->username, username, sizeof(username)))
     {
-      send_http_error(con, HTTP_UNAUTHORIZED);
+      send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                      cupsdFindDest(job->dest));
       return;
     }
 
@@ -6525,7 +7837,7 @@ move_job(cupsd_client_t  *con,            /* I - Client connection */
       * completed...
       */
 
-      if (strcasecmp(job->dest, src) ||
+      if (_cups_strcasecmp(job->dest, src) ||
           job->state_value > IPP_JOB_STOPPED)
        continue;
 
@@ -6580,7 +7892,9 @@ ppd_parse_line(const char *line,  /* I - Line */
   * Read the option name...
   */
 
-  for (line += 8, olen --; isalnum(*line & 255); line ++)
+  for (line += 8, olen --;
+       *line > ' ' && *line < 0x7f && *line != ':' && *line != '/';
+       line ++)
     if (olen > 0)
     {
       *option++ = *line;
@@ -6608,7 +7922,9 @@ ppd_parse_line(const char *line,  /* I - Line */
   while (isspace(*line & 255))
     line ++;
 
-  for (clen --; isalnum(*line & 255); line ++)
+  for (clen --;
+       *line > ' ' && *line < 0x7f && *line != ':' && *line != '/';
+       line ++)
     if (clen > 0)
     {
       *choice++ = *line;
@@ -6635,6 +7951,7 @@ print_job(cupsd_client_t  *con,           /* I - Client connection */
 {
   ipp_attribute_t *attr;               /* Current attribute */
   ipp_attribute_t *format;             /* Document-format attribute */
+  const char   *default_format;        /* document-format-default value */
   cupsd_job_t  *job;                   /* New job */
   char         filename[1024];         /* Job filename */
   mime_type_t  *filetype;              /* Type of file */
@@ -6668,7 +7985,7 @@ print_job(cupsd_client_t  *con,           /* I - Client connection */
       )
     {
       send_ipp_status(con, IPP_ATTRIBUTES,
-                      _("Unsupported compression \"%s\"!"),
+                      _("Unsupported compression \"%s\"."),
                      attr->values[0].string.text);
       ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_KEYWORD,
                   "compression", NULL, attr->values[0].string.text);
@@ -6687,7 +8004,22 @@ print_job(cupsd_client_t  *con,          /* I - Client connection */
 
   if (!con->filename)
   {
-    send_ipp_status(con, IPP_BAD_REQUEST, _("No file!?!"));
+    send_ipp_status(con, IPP_BAD_REQUEST, _("No file in print request."));
+    return;
+  }
+
+ /*
+  * Is the destination valid?
+  */
+
+  if (!cupsdValidateDest(uri->values[0].string.text, NULL, &printer))
+  {
+   /*
+    * Bad URI...
+    */
+
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -6702,22 +8034,39 @@ print_job(cupsd_client_t  *con,         /* I - Client connection */
     * Grab format from client...
     */
 
-    if (sscanf(format->values[0].string.text, "%15[^/]/%31[^;]", super, type) != 2)
+    if (sscanf(format->values[0].string.text, "%15[^/]/%255[^;]", super,
+               type) != 2)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Could not scan type \"%s\"!"),
+                      _("Bad document-format \"%s\"."),
                      format->values[0].string.text);
       return;
     }
   }
+  else if ((default_format = cupsGetOption("document-format",
+                                           printer->num_options,
+                                          printer->options)) != NULL)
+  {
+   /*
+    * Use default document format...
+    */
+
+    if (sscanf(default_format, "%15[^/]/%255[^;]", super, type) != 2)
+    {
+      send_ipp_status(con, IPP_BAD_REQUEST,
+                      _("Bad document-format \"%s\"."),
+                     default_format);
+      return;
+    }
+  }
   else
   {
    /*
-    * No document format attribute?  Auto-type it!
+    * Auto-type it!
     */
 
-    strcpy(super, "application");
-    strcpy(type, "octet-stream");
+    strlcpy(super, "application", sizeof(super));
+    strlcpy(type, "octet-stream", sizeof(type));
   }
 
   if (!strcmp(super, "application") && !strcmp(type, "octet-stream"))
@@ -6729,42 +8078,50 @@ print_job(cupsd_client_t  *con,         /* I - Client connection */
     ipp_attribute_t    *doc_name;      /* document-name attribute */
 
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG, "print_job: auto-typing file...");
+    cupsdLogMessage(CUPSD_LOG_DEBUG, "[Job ???] Auto-typing file...");
 
     doc_name = ippFindAttribute(con->request, "document-name", IPP_TAG_NAME);
     filetype = mimeFileType(MimeDatabase, con->filename,
                             doc_name ? doc_name->values[0].string.text : NULL,
                            &compression);
 
-    if (filetype)
-    {
-     /*
-      * Replace the document-format attribute value with the auto-typed one.
-      */
+    if (!filetype)
+      filetype = mimeType(MimeDatabase, super, type);
 
-      snprintf(mimetype, sizeof(mimetype), "%s/%s", filetype->super,
-               filetype->type);
+    cupsdLogMessage(CUPSD_LOG_INFO, "[Job ???] Request file type is %s/%s.",
+                   filetype->super, filetype->type);
+  }
+  else
+    filetype = mimeType(MimeDatabase, super, type);
 
-      if (format)
-      {
-         _cupsStrFree(format->values[0].string.text);
+  if (filetype &&
+      (!format ||
+       (!strcmp(super, "application") && !strcmp(type, "octet-stream"))))
+  {
+   /*
+    * Replace the document-format attribute value with the auto-typed or
+    * default one.
+    */
 
-       format->values[0].string.text = _cupsStrAlloc(mimetype);
-      }
-      else
-        ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_MIMETYPE,
-                    "document-format", NULL, mimetype);
+    snprintf(mimetype, sizeof(mimetype), "%s/%s", filetype->super,
+             filetype->type);
+
+    if (format)
+    {
+      _cupsStrFree(format->values[0].string.text);
+
+      format->values[0].string.text = _cupsStrAlloc(mimetype);
     }
     else
-      filetype = mimeType(MimeDatabase, super, type);
+      ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_MIMETYPE,
+                  "document-format", NULL, mimetype);
   }
-  else
-    filetype = mimeType(MimeDatabase, super, type);
-
-  if (!filetype)
+  else if (!filetype)
   {
     send_ipp_status(con, IPP_DOCUMENT_FORMAT,
-                    _("Unsupported format \'%s/%s\'!"), super, type);
+                    _("Unsupported document-format \"%s\"."),
+                   format ? format->values[0].string.text :
+                            "application/octet-stream");
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Hint: Do you have the raw file printing rules enabled?");
 
@@ -6775,22 +8132,20 @@ print_job(cupsd_client_t  *con,         /* I - Client connection */
     return;
   }
 
-  cupsdLogMessage(CUPSD_LOG_DEBUG, "print_job: request file type is %s/%s.",
-                 filetype->super, filetype->type);
-
  /*
   * Read any embedded job ticket info from PS files...
   */
 
-  if (!strcasecmp(filetype->super, "application") &&
-      !strcasecmp(filetype->type, "postscript"))
-    read_ps_job_ticket(con);
+  if (!_cups_strcasecmp(filetype->super, "application") &&
+      (!_cups_strcasecmp(filetype->type, "postscript") ||
+       !_cups_strcasecmp(filetype->type, "pdf")))
+    read_job_ticket(con);
 
  /*
   * Create the job object...
   */
 
-  if ((job = add_job(con, uri, &printer, filetype)) == NULL)
+  if ((job = add_job(con, printer, filetype)) == NULL)
     return;
 
  /*
@@ -6824,33 +8179,19 @@ print_job(cupsd_client_t  *con,         /* I - Client connection */
   * See if we need to add the ending sheet...
   */
 
-  attr = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME);
-
-  if (!(printer->type & (CUPS_PRINTER_REMOTE | CUPS_PRINTER_IMPLICIT)) &&
-      attr && attr->num_values > 1)
-  {
-   /*
-    * Yes...
-    */
-
-    cupsdLogMessage(CUPSD_LOG_INFO, "Adding end banner page \"%s\" to job %d.",
-                    attr->values[1].string.text, job->id);
-
-    kbytes = copy_banner(con, job, attr->values[1].string.text);
-
-    cupsdUpdateQuota(printer, job->username, 0, kbytes);
-  }
+  if (cupsdTimeoutJob(job))
+    return;
 
  /*
   * Log and save the job...
   */
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d queued on \"%s\" by \"%s\".", job->id,
-                  job->dest, job->username);
-  cupsdLogMessage(CUPSD_LOG_DEBUG, "Job %d hold_until = %d", job->id,
-                  (int)job->hold_until);
-
-  cupsdSaveJob(job);
+  cupsdLogJob(job, CUPSD_LOG_INFO,
+             "File of type %s/%s queued by \"%s\".",
+             filetype->super, filetype->type, job->username);
+  cupsdLogJob(job, CUPSD_LOG_DEBUG, "hold_until=%d", (int)job->hold_until);
+  cupsdLogJob(job, CUPSD_LOG_INFO, "Queued on \"%s\" by \"%s\".",
+             job->dest, job->username);
 
  /*
   * Start the job if possible...
@@ -6861,16 +8202,16 @@ print_job(cupsd_client_t  *con,         /* I - Client connection */
 
 
 /*
- * 'read_ps_job_ticket()' - Reads a job ticket embedded in a PS file.
+ * 'read_job_ticket()' - Read a job ticket embedded in a print file.
  *
- * This function only gets called when printing a single PostScript
+ * This function only gets called when printing a single PDF or PostScript
  * file using the Print-Job operation.  It doesn't work for Create-Job +
  * Send-File, since the job attributes need to be set at job creation
- * time for banners to work.  The embedded PS job ticket stuff is here
- * only to allow the Windows printer driver for CUPS to pass in JCL
+ * time for banners to work.  The embedded job ticket stuff is here
+ * primarily to allow the Windows printer driver for CUPS to pass in JCL
  * options and IPP attributes which otherwise would be lost.
  *
- * The format of a PS job ticket is simple:
+ * The format of a job ticket is simple:
  *
  *     %cupsJobTicket: attr1=value1 attr2=value2 ... attrN=valueN
  *
@@ -6880,8 +8221,8 @@ print_job(cupsd_client_t  *con,           /* I - Client connection */
  *     %cupsJobTicket: attrN=valueN
  *
  * Job ticket lines must appear immediately after the first line that
- * specifies PostScript format (%!PS-Adobe-3.0), and CUPS will stop
- * looking for job ticket info when it finds a line that does not begin
+ * specifies PostScript (%!PS-Adobe-3.0) or PDF (%PDF) format, and CUPS
+ * stops looking for job ticket info when it finds a line that does not begin
  * with "%cupsJobTicket:".
  *
  * The maximum length of a job ticket line, including the prefix, is
@@ -6894,7 +8235,7 @@ print_job(cupsd_client_t  *con,           /* I - Client connection */
  */
 
 static void
-read_ps_job_ticket(cupsd_client_t *con)        /* I - Client connection */
+read_job_ticket(cupsd_client_t *con)   /* I - Client connection */
 {
   cups_file_t          *fp;            /* File to read from */
   char                 line[256];      /* Line data */
@@ -6913,8 +8254,7 @@ read_ps_job_ticket(cupsd_client_t *con)   /* I - Client connection */
   if ((fp = cupsFileOpen(con->filename, "rb")) == NULL)
   {
     cupsdLogMessage(CUPSD_LOG_ERROR,
-                    "read_ps_job_ticket: Unable to open PostScript print file "
-                   "- %s",
+                    "Unable to open print file for job ticket - %s",
                     strerror(errno));
     return;
   }
@@ -6926,14 +8266,13 @@ read_ps_job_ticket(cupsd_client_t *con) /* I - Client connection */
   if (cupsFileGets(fp, line, sizeof(line)) == NULL)
   {
     cupsdLogMessage(CUPSD_LOG_ERROR,
-                    "read_ps_job_ticket: Unable to read from PostScript print "
-                   "file - %s",
+                    "Unable to read from print file for job ticket - %s",
                     strerror(errno));
     cupsFileClose(fp);
     return;
   }
 
-  if (strncmp(line, "%!PS-Adobe-", 11))
+  if (strncmp(line, "%!PS-Adobe-", 11) && strncmp(line, "%PDF-", 5))
   {
    /*
     * Not a DSC-compliant file, so no job ticket info will be available...
@@ -7026,14 +8365,14 @@ read_ps_job_ticket(cupsd_client_t *con) /* I - Client connection */
       if (con->request->last == attr2)
         con->request->last = prev2;
 
-      _ippFreeAttr(attr2);
+      ippDeleteAttribute(NULL, attr2);
     }
 
    /*
     * Add new option by copying it...
     */
 
-    copy_attribute(con->request, attr, 0);
+    ippCopyAttribute(con->request, attr, 0);
   }
 
  /*
@@ -7051,16 +8390,10 @@ read_ps_job_ticket(cupsd_client_t *con) /* I - Client connection */
 
 static void
 reject_jobs(cupsd_client_t  *con,      /* I - Client connection */
-            ipp_attribute_t *uri)      /* I - Printer or class URI */
-{
-  http_status_t        status;                 /* Policy status */
-  cups_ptype_t dtype;                  /* Destination type (printer or class) */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
-               username[HTTP_MAX_URI], /* Username portion of URI */
-               host[HTTP_MAX_URI],     /* Host portion of URI */
-               resource[HTTP_MAX_URI]; /* Resource portion of URI */
-  int          port;                   /* Port portion of URI */
-  const char   *name;                  /* Printer name */
+            ipp_attribute_t *uri)      /* I - Printer or class URI */
+{
+  http_status_t        status;                 /* Policy status */
+  cups_ptype_t dtype;                  /* Destination type (printer/class) */
   cupsd_printer_t *printer;            /* Printer data */
   ipp_attribute_t *attr;               /* printer-state-message text */
 
@@ -7072,18 +8405,14 @@ reject_jobs(cupsd_client_t  *con,       /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((name = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -7093,7 +8422,7 @@ reject_jobs(cupsd_client_t  *con, /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
     return;
   }
 
@@ -7105,28 +8434,97 @@ reject_jobs(cupsd_client_t  *con,       /* I - Client connection */
 
   if ((attr = ippFindAttribute(con->request, "printer-state-message",
                                IPP_TAG_TEXT)) == NULL)
-    strcpy(printer->state_message, "Rejecting Jobs");
+    strlcpy(printer->state_message, "Rejecting Jobs",
+            sizeof(printer->state_message));
   else
     strlcpy(printer->state_message, attr->values[0].string.text,
             sizeof(printer->state_message));
 
-  cupsdAddPrinterHistory(printer);
+  cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, printer, NULL,
+                "No longer accepting jobs.");
 
   if (dtype & CUPS_PRINTER_CLASS)
   {
-    cupsdSaveAllClasses();
+    cupsdMarkDirty(CUPSD_DIRTY_CLASSES);
 
     cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" rejecting jobs (\"%s\").",
-                    name, get_username(con));
+                    printer->name, get_username(con));
   }
   else
   {
-    cupsdSaveAllPrinters();
+    cupsdMarkDirty(CUPSD_DIRTY_PRINTERS);
 
     cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" rejecting jobs (\"%s\").",
-                    name, get_username(con));
+                    printer->name, get_username(con));
+  }
+
+ /*
+  * Everything was ok, so return OK status...
+  */
+
+  con->response->request.status.status_code = IPP_OK;
+}
+
+
+/*
+ * 'release_held_new_jobs()' - Release pending/new jobs on a printer or class.
+ */
+
+static void
+release_held_new_jobs(
+    cupsd_client_t  *con,              /* I - Connection */
+    ipp_attribute_t *uri)              /* I - Printer URI */
+{
+  http_status_t                status;         /* Policy status */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
+  cupsd_printer_t      *printer;       /* Printer data */
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "release_held_new_jobs(%p[%d], %s)", con,
+                  con->http.fd, uri->values[0].string.text);
+
+ /*
+  * Is the destination valid?
+  */
+
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
+  {
+   /*
+    * Bad URI...
+    */
+
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The printer or class does not exist."));
+    return;
+  }
+
+ /*
+  * Check policy...
+  */
+
+  if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
+  {
+    send_http_error(con, status, printer);
+    return;
   }
 
+ /*
+  * Hold pending/new jobs sent to the printer...
+  */
+
+  printer->holding_new_jobs = 0;
+
+  cupsdSetPrinterReasons(printer, "-hold-new-jobs");
+
+  if (dtype & CUPS_PRINTER_CLASS)
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Class \"%s\" now printing pending/new jobs (\"%s\").",
+                    printer->name, get_username(con));
+  else
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Printer \"%s\" now printing pending/new jobs (\"%s\").",
+                    printer->name, get_username(con));
+
  /*
   * Everything was ok, so return OK status...
   */
@@ -7145,7 +8543,7 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
 {
   ipp_attribute_t *attr;               /* Current attribute */
   int          jobid;                  /* Job ID */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  char         scheme[HTTP_MAX_URI],   /* Method portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
@@ -7170,7 +8568,7 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -7182,8 +8580,8 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
 
     if (strncmp(resource, "/jobs/", 6))
@@ -7192,8 +8590,7 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -7211,7 +8608,7 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -7225,7 +8622,7 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
     * Nope - return a "not possible" error...
     */
 
-    send_ipp_status(con, IPP_NOT_POSSIBLE, _("Job #%d is not held!"), jobid);
+    send_ipp_status(con, IPP_NOT_POSSIBLE, _("Job #%d is not held."), jobid);
     return;
   }
 
@@ -7235,7 +8632,8 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
     return;
   }
 
@@ -7254,8 +8652,9 @@ release_job(cupsd_client_t  *con, /* I - Client connection */
     attr->value_tag = IPP_TAG_KEYWORD;
     attr->values[0].string.text = _cupsStrAlloc("no-hold");
 
-    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, job->printer, job,
+    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, cupsdFindDest(job->dest), job,
                   "Job job-hold-until value changed by user.");
+    ippSetString(job->attrs, &job->reasons, 0, "none");
   }
 
  /*
@@ -7264,13 +8663,14 @@ release_job(cupsd_client_t  *con,       /* I - Client connection */
 
   cupsdReleaseJob(job);
 
-  cupsdAddEvent(CUPSD_EVENT_JOB_STATE, job->printer, job,
+  cupsdAddEvent(CUPSD_EVENT_JOB_STATE, cupsdFindDest(job->dest), job,
                 "Job released by user.");
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d was released by \"%s\".", jobid,
-                  username);
+  cupsdLogJob(job, CUPSD_LOG_INFO, "Released by \"%s\".", username);
 
   con->response->request.status.status_code = IPP_OK;
+
+  cupsdCheckJobs();
 }
 
 
@@ -7302,8 +8702,8 @@ renew_subscription(
     * Bad subscription ID...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND,
-                    _("notify-subscription-id %d no good!"), sub_id);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Subscription #%d does not exist."),
+                    sub_id);
     return;
   }
 
@@ -7314,7 +8714,7 @@ renew_subscription(
     */
 
     send_ipp_status(con, IPP_NOT_POSSIBLE,
-                    _("Job subscriptions cannot be renewed!"));
+                    _("Job subscriptions cannot be renewed."));
     return;
   }
 
@@ -7326,7 +8726,7 @@ renew_subscription(
                                              DefaultPolicyPtr,
                                  con, sub->owner)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, sub->dest);
     return;
   }
 
@@ -7350,9 +8750,12 @@ renew_subscription(
 
   sub->expire = sub->lease ? time(NULL) + sub->lease : 0;
 
-  cupsdSaveAllSubscriptions();
+  cupsdMarkDirty(CUPSD_DIRTY_SUBSCRIPTIONS);
 
   con->response->request.status.status_code = IPP_OK;
+
+  ippAddInteger(con->response, IPP_TAG_SUBSCRIPTION, IPP_TAG_INTEGER,
+                "notify-lease-duration", sub->lease);
 }
 
 
@@ -7366,12 +8769,12 @@ restart_job(cupsd_client_t  *con,       /* I - Client connection */
 {
   ipp_attribute_t *attr;               /* Current attribute */
   int          jobid;                  /* Job ID */
-  char         method[HTTP_MAX_URI],   /* Method portion of URI */
+  cupsd_job_t  *job;                   /* Job information */
+  char         scheme[HTTP_MAX_URI],   /* Method portion of URI */
                username[HTTP_MAX_URI], /* Username portion of URI */
                host[HTTP_MAX_URI],     /* Host portion of URI */
                resource[HTTP_MAX_URI]; /* Resource portion of URI */
   int          port;                   /* Port portion of URI */
-  cupsd_job_t  *job;                   /* Job information */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "restart_job(%p[%d], %s)", con,
@@ -7391,7 +8794,7 @@ restart_job(cupsd_client_t  *con, /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -7403,8 +8806,8 @@ restart_job(cupsd_client_t  *con, /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
 
     if (strncmp(resource, "/jobs/", 6))
@@ -7413,8 +8816,7 @@ restart_job(cupsd_client_t  *con, /* I - Client connection */
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -7432,7 +8834,7 @@ restart_job(cupsd_client_t  *con, /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -7446,7 +8848,7 @@ restart_job(cupsd_client_t  *con, /* I - Client connection */
     * Nope - return a "not possible" error...
     */
 
-    send_ipp_status(con, IPP_NOT_POSSIBLE, _("Job #%d is not complete!"),
+    send_ipp_status(con, IPP_NOT_POSSIBLE, _("Job #%d is not complete."),
                     jobid);
     return;
   }
@@ -7464,7 +8866,7 @@ restart_job(cupsd_client_t  *con, /* I - Client connection */
     */
 
     send_ipp_status(con, IPP_NOT_POSSIBLE,
-                    _("Job #%d cannot be restarted - no files!"), jobid);
+                    _("Job #%d cannot be restarted - no files."), jobid);
     return;
   }
 
@@ -7474,18 +8876,45 @@ restart_job(cupsd_client_t  *con,       /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
     return;
   }
 
  /*
-  * Restart the job and return...
+  * See if the job-hold-until attribute is specified...
   */
 
-  cupsdRestartJob(job);
+  if ((attr = ippFindAttribute(con->request, "job-hold-until",
+                               IPP_TAG_KEYWORD)) == NULL)
+    attr = ippFindAttribute(con->request, "job-hold-until", IPP_TAG_NAME);
+
+  if (attr && strcmp(attr->values[0].string.text, "no-hold"))
+  {
+   /*
+    * Return the job to a held state...
+    */
+
+    cupsdLogJob(job, CUPSD_LOG_DEBUG,
+               "Restarted by \"%s\" with job-hold-until=%s.",
+                username, attr->values[0].string.text);
+    cupsdSetJobHoldUntil(job, attr->values[0].string.text, 0);
+
+    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED | CUPSD_EVENT_JOB_STATE,
+                  NULL, job, "Job restarted by user with job-hold-until=%s",
+                 attr->values[0].string.text);
+  }
+  else
+  {
+   /*
+    * Restart the job...
+    */
+
+    cupsdRestartJob(job);
+    cupsdCheckJobs();
+  }
 
-  cupsdLogMessage(CUPSD_LOG_INFO, "Job %d was restarted by \"%s\".", jobid,
-                  username);
+  cupsdLogJob(job, CUPSD_LOG_INFO, "Restarted by \"%s\".", username);
 
   con->response->request.status.status_code = IPP_OK;
 }
@@ -7496,22 +8925,25 @@ restart_job(cupsd_client_t  *con,       /* I - Client connection */
  */
 
 static void
-save_auth_info(cupsd_client_t *con,    /* I - Client connection */
-               cupsd_job_t    *job)    /* I - Job */
+save_auth_info(
+    cupsd_client_t  *con,              /* I - Client connection */
+    cupsd_job_t     *job,              /* I - Job */
+    ipp_attribute_t *auth_info)                /* I - auth-info attribute, if any */
 {
-  int          i;                      /* Looping var */
-  char         filename[1024];         /* Job authentication filename */
-  cups_file_t  *fp;                    /* Job authentication file */
-  char         line[1024];             /* Line for file */
+  int                  i;              /* Looping var */
+  char                 filename[1024]; /* Job authentication filename */
+  cups_file_t          *fp;            /* Job authentication file */
+  char                 line[65536];    /* Line for file */
+  cupsd_printer_t      *dest;          /* Destination printer/class */
 
 
  /*
   * This function saves the in-memory authentication information for
   * a job so that it can be used to authenticate with a remote host.
   * The information is stored in a file that is readable only by the
-  * root user.  The username and password are Base-64 encoded, each
-  * on a separate line, followed by random number (up to 1024) of
-  * newlines to limit the amount of information that is exposed.
+  * root user.  The fields are Base-64 encoded, each on a separate line,
+  * followed by random number (up to 1024) of newlines to limit the
+  * amount of information that is exposed.
   *
   * Because of the potential for exposing of authentication information,
   * this functionality is only enabled when running cupsd as root.
@@ -7531,6 +8963,9 @@ save_auth_info(cupsd_client_t *con,       /* I - Client connection */
   if (RunUser)
     return;
 
+  if ((dest = cupsdFindDest(job->dest)) == NULL)
+    return;
+
  /*
   * Create the authentication file and change permissions...
   */
@@ -7547,25 +8982,106 @@ save_auth_info(cupsd_client_t *con,    /* I - Client connection */
   fchown(cupsFileNumber(fp), 0, 0);
   fchmod(cupsFileNumber(fp), 0400);
 
- /*
-  * Write the authenticated username...
-  */
+  cupsFilePuts(fp, "CUPSD-AUTH-V3\n");
 
-  httpEncode64_2(line, sizeof(line), con->username, strlen(con->username));
-  cupsFilePrintf(fp, "%s\n", line);
+  for (i = 0;
+       i < (int)(sizeof(job->auth_env) / sizeof(job->auth_env[0]));
+       i ++)
+    cupsdClearString(job->auth_env + i);
 
- /*
-  * Write the authenticated password...
-  */
+  if (auth_info && auth_info->num_values == dest->num_auth_info_required)
+  {
+   /*
+    * Write 1 to 3 auth values...
+    */
+
+    for (i = 0;
+         i < auth_info->num_values &&
+            i < (int)(sizeof(job->auth_env) / sizeof(job->auth_env[0]));
+        i ++)
+    {
+      if (strcmp(dest->auth_info_required[i], "negotiate"))
+      {
+       httpEncode64_2(line, sizeof(line), auth_info->values[i].string.text,
+                      strlen(auth_info->values[i].string.text));
+       cupsFilePutConf(fp, dest->auth_info_required[i], line);
+      }
+      else
+       cupsFilePutConf(fp, dest->auth_info_required[i],
+                       auth_info->values[i].string.text);
+
+      if (!strcmp(dest->auth_info_required[i], "username"))
+        cupsdSetStringf(job->auth_env + i, "AUTH_USERNAME=%s",
+                       auth_info->values[i].string.text);
+      else if (!strcmp(dest->auth_info_required[i], "domain"))
+        cupsdSetStringf(job->auth_env + i, "AUTH_DOMAIN=%s",
+                       auth_info->values[i].string.text);
+      else if (!strcmp(dest->auth_info_required[i], "password"))
+        cupsdSetStringf(job->auth_env + i, "AUTH_PASSWORD=%s",
+                       auth_info->values[i].string.text);
+      else if (!strcmp(dest->auth_info_required[i], "negotiate"))
+        cupsdSetStringf(job->auth_env + i, "AUTH_NEGOTIATE=%s",
+                       auth_info->values[i].string.text);
+      else
+        i --;
+    }
+  }
+  else if (auth_info && auth_info->num_values == 2 &&
+           dest->num_auth_info_required == 1 &&
+           !strcmp(dest->auth_info_required[0], "negotiate"))
+  {
+   /*
+    * Allow fallback to username+password for Kerberized queues...
+    */
+
+    httpEncode64_2(line, sizeof(line), auth_info->values[0].string.text,
+                   strlen(auth_info->values[0].string.text));
+    cupsFilePutConf(fp, "username", line);
+
+    cupsdSetStringf(job->auth_env + 0, "AUTH_USERNAME=%s",
+                    auth_info->values[0].string.text);
+
+    httpEncode64_2(line, sizeof(line), auth_info->values[1].string.text,
+                   strlen(auth_info->values[1].string.text));
+    cupsFilePutConf(fp, "password", line);
+
+    cupsdSetStringf(job->auth_env + 1, "AUTH_PASSWORD=%s",
+                    auth_info->values[1].string.text);
+  }
+  else if (con->username[0])
+  {
+   /*
+    * Write the authenticated username...
+    */
+
+    httpEncode64_2(line, sizeof(line), con->username, strlen(con->username));
+    cupsFilePutConf(fp, "username", line);
+
+    cupsdSetStringf(job->auth_env + 0, "AUTH_USERNAME=%s", con->username);
+
+   /*
+    * Write the authenticated password...
+    */
+
+    httpEncode64_2(line, sizeof(line), con->password, strlen(con->password));
+    cupsFilePutConf(fp, "password", line);
+
+    cupsdSetStringf(job->auth_env + 1, "AUTH_PASSWORD=%s", con->password);
+  }
 
-  httpEncode64_2(line, sizeof(line), con->password, strlen(con->password));
-  cupsFilePrintf(fp, "%s\n", line);
+#ifdef HAVE_GSSAPI
+  if (con->gss_uid > 0)
+  {
+    cupsFilePrintf(fp, "uid %d\n", (int)con->gss_uid);
+    cupsdSetStringf(&job->auth_uid, "AUTH_UID=%d", (int)con->gss_uid);
+  }
+#endif /* HAVE_GSSAPI */
 
  /*
   * Write a random number of newlines to the end of the file...
   */
 
-  for (i = (rand() % 1024); i >= 0; i --)
+  for (i = (CUPS_RAND() % 1024); i >= 0; i --)
     cupsFilePutChar(fp, '\n');
 
  /*
@@ -7585,12 +9101,14 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
              ipp_attribute_t *uri)     /* I - Printer URI */
 {
   ipp_attribute_t      *attr;          /* Current attribute */
-  ipp_attribute_t      *format;        /* Document-format attribute */
+  ipp_attribute_t      *format;        /* Request's document-format attribute */
+  ipp_attribute_t      *jformat;       /* Job's document-format attribute */
+  const char           *default_format;/* document-format-default value */
   int                  jobid;          /* Job ID number */
   cupsd_job_t          *job;           /* Current job */
   char                 job_uri[HTTP_MAX_URI],
                                        /* Job URI */
-                       method[HTTP_MAX_URI],
+                       scheme[HTTP_MAX_URI],
                                        /* Method portion of URI */
                        username[HTTP_MAX_URI],
                                        /* Username portion of URI */
@@ -7611,6 +9129,7 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
   struct stat          fileinfo;       /* File information */
   int                  kbytes;         /* Size of file */
   int                  compression;    /* Type of compression */
+  int                  start_job;      /* Start the job? */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "send_document(%p[%d], %s)", con,
@@ -7630,7 +9149,7 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -7642,8 +9161,8 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
 
     if (strncmp(resource, "/jobs/", 6))
@@ -7652,8 +9171,7 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -7671,7 +9189,7 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -7683,7 +9201,8 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
     return;
   }
 
@@ -7703,7 +9222,7 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
 #endif /* HAVE_LIBZ */
       )
     {
-      send_ipp_status(con, IPP_ATTRIBUTES, _("Unsupported compression \"%s\"!"),
+      send_ipp_status(con, IPP_ATTRIBUTES, _("Unsupported compression \"%s\"."),
                      attr->values[0].string.text);
       ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_KEYWORD,
                   "compression", NULL, attr->values[0].string.text);
@@ -7720,9 +9239,25 @@ send_document(cupsd_client_t  *con,      /* I - Client connection */
   * Do we have a file to print?
   */
 
+  if ((attr = ippFindAttribute(con->request, "last-document",
+                              IPP_TAG_BOOLEAN)) == NULL)
+  {
+    send_ipp_status(con, IPP_BAD_REQUEST,
+                    _("Missing last-document attribute in request."));
+    return;
+  }
+
   if (!con->filename)
   {
-    send_ipp_status(con, IPP_BAD_REQUEST, _("No file!?!"));
+   /*
+    * Check for an empty request with "last-document" set to true, which is
+    * used to close an "open" job by RFC 2911, section 3.3.2.
+    */
+
+    if (job->num_files > 0 && attr->values[0].boolean)
+      goto last_document;
+
+    send_ipp_status(con, IPP_BAD_REQUEST, _("No file in print request."));
     return;
   }
 
@@ -7737,21 +9272,37 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
     * Grab format from client...
     */
 
-    if (sscanf(format->values[0].string.text, "%15[^/]/%31[^;]", super, type) != 2)
+    if (sscanf(format->values[0].string.text, "%15[^/]/%255[^;]",
+               super, type) != 2)
     {
-      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad document-format \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad document-format \"%s\"."),
                      format->values[0].string.text);
       return;
     }
   }
+  else if ((default_format = cupsGetOption("document-format",
+                                           printer->num_options,
+                                          printer->options)) != NULL)
+  {
+   /*
+    * Use default document format...
+    */
+
+    if (sscanf(default_format, "%15[^/]/%255[^;]", super, type) != 2)
+    {
+      send_ipp_status(con, IPP_BAD_REQUEST,
+                      _("Bad document-format-default \"%s\"."), default_format);
+      return;
+    }
+  }
   else
   {
    /*
     * No document format attribute?  Auto-type it!
     */
 
-    strcpy(super, "application");
-    strcpy(type, "octet-stream");
+    strlcpy(super, "application", sizeof(super));
+    strlcpy(type, "octet-stream", sizeof(type));
   }
 
   if (!strcmp(super, "application") && !strcmp(type, "octet-stream"))
@@ -7763,41 +9314,48 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
     ipp_attribute_t    *doc_name;      /* document-name attribute */
 
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG, "send_document: auto-typing file...");
+    cupsdLogJob(job, CUPSD_LOG_DEBUG, "Auto-typing file...");
 
     doc_name = ippFindAttribute(con->request, "document-name", IPP_TAG_NAME);
     filetype = mimeFileType(MimeDatabase, con->filename,
                             doc_name ? doc_name->values[0].string.text : NULL,
                            &compression);
 
+    if (!filetype)
+      filetype = mimeType(MimeDatabase, super, type);
+
     if (filetype)
-    {
-     /*
-      * Replace the document-format attribute value with the auto-typed one.
-      */
+      cupsdLogJob(job, CUPSD_LOG_DEBUG, "Request file type is %s/%s.",
+                 filetype->super, filetype->type);
+  }
+  else
+    filetype = mimeType(MimeDatabase, super, type);
 
-      snprintf(mimetype, sizeof(mimetype), "%s/%s", filetype->super,
-               filetype->type);
+  if (filetype)
+  {
+   /*
+    * Replace the document-format attribute value with the auto-typed or
+    * default one.
+    */
 
-      if (format)
-      {
-       _cupsStrFree(format->values[0].string.text);
-       format->values[0].string.text = _cupsStrAlloc(mimetype);
-      }
-      else
-        ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_MIMETYPE,
-                    "document-format", NULL, mimetype);
+    snprintf(mimetype, sizeof(mimetype), "%s/%s", filetype->super,
+             filetype->type);
+
+    if ((jformat = ippFindAttribute(job->attrs, "document-format",
+                                    IPP_TAG_MIMETYPE)) != NULL)
+    {
+      _cupsStrFree(jformat->values[0].string.text);
+
+      jformat->values[0].string.text = _cupsStrAlloc(mimetype);
     }
     else
-      filetype = mimeType(MimeDatabase, super, type);
+      ippAddString(job->attrs, IPP_TAG_JOB, IPP_TAG_MIMETYPE,
+                  "document-format", NULL, mimetype);
   }
-  else
-    filetype = mimeType(MimeDatabase, super, type);
-
-  if (!filetype)
+  else if (!filetype)
   {
     send_ipp_status(con, IPP_DOCUMENT_FORMAT,
-                    _("Unsupported format \'%s/%s\'!"), super, type);
+                    _("Unsupported document-format \"%s/%s\"."), super, type);
     cupsdLogMessage(CUPSD_LOG_INFO,
                     "Hint: Do you have the raw file printing rules enabled?");
 
@@ -7814,7 +9372,7 @@ send_document(cupsd_client_t  *con,       /* I - Client connection */
              filetype->type);
 
     send_ipp_status(con, IPP_DOCUMENT_FORMAT,
-                    _("Unsupported format \'%s\'!"), mimetype);
+                    _("Unsupported document-format \"%s\"."), mimetype);
 
     ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_MIMETYPE,
                  "document-format", NULL, mimetype);
@@ -7822,10 +9380,6 @@ send_document(cupsd_client_t  *con,      /* I - Client connection */
     return;
   }
 
-  cupsdLogMessage(CUPSD_LOG_DEBUG,
-                  "send_document: request file type is %s/%s.",
-                 filetype->super, filetype->type);
-
  /*
   * Add the file to the job...
   */
@@ -7852,14 +9406,15 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
 
   cupsdClearString(&con->filename);
 
-  cupsdLogMessage(CUPSD_LOG_INFO,
-                  "File of type %s/%s queued in job #%d by \"%s\".",
-                  filetype->super, filetype->type, job->id, job->username);
+  cupsdLogJob(job, CUPSD_LOG_INFO, "File of type %s/%s queued by \"%s\".",
+             filetype->super, filetype->type, job->username);
 
  /*
   * Start the job if this is the last document...
   */
 
+  last_document:
+
   if ((attr = ippFindAttribute(con->request, "last-document",
                                IPP_TAG_BOOLEAN)) != NULL &&
       attr->values[0].boolean)
@@ -7868,29 +9423,15 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
     * See if we need to add the ending sheet...
     */
 
-    if (printer &&
-        !(printer->type & (CUPS_PRINTER_REMOTE | CUPS_PRINTER_IMPLICIT)) &&
-        (attr = ippFindAttribute(job->attrs, "job-sheets",
-                                IPP_TAG_ZERO)) != NULL &&
-        attr->num_values > 1)
-    {
-     /*
-      * Yes...
-      */
-
-      cupsdLogMessage(CUPSD_LOG_INFO,
-                      "Adding end banner page \"%s\" to job %d.",
-                     attr->values[1].string.text, job->id);
-
-      kbytes = copy_banner(con, job, attr->values[1].string.text);
-
-      cupsdUpdateQuota(printer, job->username, 0, kbytes);
-    }
+    if (cupsdTimeoutJob(job))
+      return;
 
     if (job->state_value == IPP_JOB_STOPPED)
     {
       job->state->values[0].integer = IPP_JOB_PENDING;
       job->state_value              = IPP_JOB_PENDING;
+
+      ippSetString(job->attrs, &job->reasons, 0, "none");
     }
     else if (job->state_value == IPP_JOB_HELD)
     {
@@ -7902,21 +9443,17 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
       {
        job->state->values[0].integer = IPP_JOB_PENDING;
        job->state_value              = IPP_JOB_PENDING;
+
+       ippSetString(job->attrs, &job->reasons, 0, "none");
       }
+      else
+       ippSetString(job->attrs, &job->reasons, 0, "job-hold-until-specified");
     }
 
-    cupsdSaveJob(job);
-
-   /*
-    * Start the job if possible...  Since cupsdCheckJobs() can cancel a
-    * job if it doesn't print, we need to re-find the job afterwards...
-    */
-
-    jobid = job->id;
-
-    cupsdCheckJobs();
+    job->dirty = 1;
+    cupsdMarkDirty(CUPSD_DIRTY_JOBS);
 
-    job = cupsdFindJob(jobid);
+    start_job = 1;
   }
   else
   {
@@ -7928,28 +9465,41 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
     {
       job->state->values[0].integer = IPP_JOB_HELD;
       job->state_value              = IPP_JOB_HELD;
-      job->hold_until               = time(NULL) + 60;
-      cupsdSaveJob(job);
+      job->hold_until               = time(NULL) + MultipleOperationTimeout;
+
+      ippSetString(job->attrs, &job->reasons, 0, "job-incoming");
+
+      job->dirty = 1;
+      cupsdMarkDirty(CUPSD_DIRTY_JOBS);
     }
+
+    start_job = 0;
   }
 
  /*
   * Fill in the response info...
   */
 
-  snprintf(job_uri, sizeof(job_uri), "http://%s:%d/jobs/%d", ServerName,
-          LocalPort, jobid);
-
+  httpAssembleURIf(HTTP_URI_CODING_ALL, job_uri, sizeof(job_uri), "ipp", NULL,
+                   con->clientname, con->clientport, "/jobs/%d", jobid);
   ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_URI, "job-uri", NULL,
                job_uri);
 
   ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_INTEGER, "job-id", jobid);
 
   ippAddInteger(con->response, IPP_TAG_JOB, IPP_TAG_ENUM, "job-state",
-                job ? job->state_value : IPP_JOB_CANCELED);
-  add_job_state_reasons(con, job);
+                job->state_value);
+  ippAddString(con->response, IPP_TAG_JOB, IPP_TAG_KEYWORD, "job-state-reasons",
+               NULL, job->reasons->values[0].string.text);
 
   con->response->request.status.status_code = IPP_OK;
+
+ /*
+  * Start the job if necessary...
+  */
+
+  if (start_job)
+    cupsdCheckJobs();
 }
 
 
@@ -7958,14 +9508,83 @@ send_document(cupsd_client_t  *con,     /* I - Client connection */
  */
 
 static void
-send_http_error(cupsd_client_t *con,   /* I - Client connection */
-                http_status_t  status) /* I - HTTP status code */
+send_http_error(
+    cupsd_client_t  *con,              /* I - Client connection */
+    http_status_t   status,            /* I - HTTP status code */
+    cupsd_printer_t *printer)          /* I - Printer, if any */
 {
-  cupsdLogMessage(CUPSD_LOG_ERROR, "%s: %s",
-                  ippOpString(con->request->request.op.operation_id),
-                 httpStatus(status));
+  ipp_attribute_t      *uri;           /* Request URI, if any */
+
+
+  if ((uri = ippFindAttribute(con->request, "printer-uri",
+                              IPP_TAG_URI)) == NULL)
+    uri = ippFindAttribute(con->request, "job-uri", IPP_TAG_URI);
+
+  cupsdLogMessage(status == HTTP_FORBIDDEN ? CUPSD_LOG_ERROR : CUPSD_LOG_DEBUG,
+                  "[Client %d] Returning HTTP %s for %s (%s) from %s",
+                  con->http.fd, httpStatus(status),
+                 con->request ?
+                     ippOpString(con->request->request.op.operation_id) :
+                     "no operation-id",
+                 uri ? uri->values[0].string.text : "no URI",
+                 con->http.hostname);
+
+  if (printer)
+  {
+    int                auth_type;              /* Type of authentication required */
+
+
+    auth_type = CUPSD_AUTH_NONE;
+
+    if (status == HTTP_UNAUTHORIZED &&
+        printer->num_auth_info_required > 0 &&
+        !strcmp(printer->auth_info_required[0], "negotiate") &&
+       con->request &&
+       (con->request->request.op.operation_id == IPP_PRINT_JOB ||
+        con->request->request.op.operation_id == IPP_CREATE_JOB ||
+        con->request->request.op.operation_id == CUPS_AUTHENTICATE_JOB))
+    {
+     /*
+      * Creating and authenticating jobs requires Kerberos...
+      */
+
+      auth_type = CUPSD_AUTH_NEGOTIATE;
+    }
+    else
+    {
+     /*
+      * Use policy/location-defined authentication requirements...
+      */
+
+      char     resource[HTTP_MAX_URI]; /* Resource portion of URI */
+      cupsd_location_t *auth;          /* Pointer to authentication element */
+
 
-  cupsdSendError(con, status);
+      if (printer->type & CUPS_PRINTER_CLASS)
+       snprintf(resource, sizeof(resource), "/classes/%s", printer->name);
+      else
+       snprintf(resource, sizeof(resource), "/printers/%s", printer->name);
+
+      if ((auth = cupsdFindBest(resource, HTTP_POST)) == NULL ||
+         auth->type == CUPSD_AUTH_NONE)
+       auth = cupsdFindPolicyOp(printer->op_policy_ptr,
+                                con->request ?
+                                    con->request->request.op.operation_id :
+                                    IPP_PRINT_JOB);
+
+      if (auth)
+      {
+        if (auth->type == CUPSD_AUTH_DEFAULT)
+         auth_type = cupsdDefaultAuthType();
+       else
+         auth_type = auth->type;
+      }
+    }
+
+    cupsdSendError(con, status, auth_type);
+  }
+  else
+    cupsdSendError(con, status, CUPSD_AUTH_NONE);
 
   ippDelete(con->response);
   con->response = NULL;
@@ -7980,69 +9599,52 @@ send_http_error(cupsd_client_t *con,    /* I - Client connection */
 
 static void
 send_ipp_status(cupsd_client_t *con,   /* I - Client connection */
-               ipp_status_t   status,  /* I - IPP status code */
-              const char     *message, /* I - Status message */
-              ...)                     /* I - Additional args as needed */
+                ipp_status_t   status, /* I - IPP status code */
+               const char     *message,/* I - Status message */
+               ...)                    /* I - Additional args as needed */
 {
   va_list      ap;                     /* Pointer to additional args */
   char         formatted[1024];        /* Formatted errror message */
 
 
-  if (message)
-  {
-    va_start(ap, message);
-    vsnprintf(formatted, sizeof(formatted),
-              _cupsLangString(con->language, message), ap);
-    va_end(ap);
+  va_start(ap, message);
+  vsnprintf(formatted, sizeof(formatted),
+            _cupsLangString(con->language, message), ap);
+  va_end(ap);
 
-    cupsdLogMessage(CUPSD_LOG_DEBUG, "%s %s: %s",
-                   ippOpString(con->request->request.op.operation_id),
-                   ippErrorString(status), formatted);
-  }
-  else
-    cupsdLogMessage(CUPSD_LOG_DEBUG, "%s %s",
-                   ippOpString(con->request->request.op.operation_id),
-                   ippErrorString(status));
+  cupsdLogMessage(CUPSD_LOG_DEBUG, "%s %s: %s",
+                 ippOpString(con->request->request.op.operation_id),
+                 ippErrorString(status), formatted);
 
   con->response->request.status.status_code = status;
 
   if (ippFindAttribute(con->response, "attributes-charset",
                        IPP_TAG_ZERO) == NULL)
     ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_CHARSET,
-                 "attributes-charset", NULL, DefaultCharset);
+                 "attributes-charset", NULL, "utf-8");
 
   if (ippFindAttribute(con->response, "attributes-natural-language",
                        IPP_TAG_ZERO) == NULL)
     ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_LANGUAGE,
                  "attributes-natural-language", NULL, DefaultLanguage);
 
-  if (message)
-    ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_TEXT,
-                "status-message", NULL, formatted);
+  ippAddString(con->response, IPP_TAG_OPERATION, IPP_TAG_TEXT,
+               "status-message", NULL, formatted);
 }
 
 
 /*
- * 'set_default()' - Set the default destination...
- */
-
-static void
-set_default(cupsd_client_t  *con,      /* I - Client connection */
-            ipp_attribute_t *uri)      /* I - Printer URI */
-{
-  http_status_t                status;         /* Policy status */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
-  char                 method[HTTP_MAX_URI],
-                                       /* Method portion of URI */
-                       username[HTTP_MAX_URI],
-                                       /* Username portion of URI */
-                       host[HTTP_MAX_URI],
-                                       /* Host portion of URI */
-                       resource[HTTP_MAX_URI];
-                                       /* Resource portion of URI */
-  int                  port;           /* Port portion of URI */
-  const char           *name;          /* Printer name */
-  cupsd_printer_t      *printer;       /* Printer */
+ * 'set_default()' - Set the default destination...
+ */
+
+static void
+set_default(cupsd_client_t  *con,      /* I - Client connection */
+            ipp_attribute_t *uri)      /* I - Printer URI */
+{
+  http_status_t                status;         /* Policy status */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
+  cupsd_printer_t      *printer,       /* Printer */
+                       *oldprinter;    /* Old default printer */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "set_default(%p[%d], %s)", con,
@@ -8052,18 +9654,14 @@ set_default(cupsd_client_t  *con,       /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((name = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -8073,7 +9671,7 @@ set_default(cupsd_client_t  *con, /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(DefaultPolicyPtr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, NULL);
     return;
   }
 
@@ -8081,16 +9679,22 @@ set_default(cupsd_client_t  *con,       /* I - Client connection */
   * Set it as the default...
   */
 
+  oldprinter     = DefaultPrinter;
   DefaultPrinter = printer;
 
-  cupsdSaveAllPrinters();
-  cupsdSaveAllClasses();
+  if (oldprinter)
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, oldprinter, NULL,
+                  "%s is no longer the default printer.", oldprinter->name);
 
-  cupsdWritePrintcap();
+  cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, printer, NULL,
+               "%s is now the default printer.", printer->name);
+
+  cupsdMarkDirty(CUPSD_DIRTY_PRINTERS | CUPSD_DIRTY_CLASSES |
+                 CUPSD_DIRTY_PRINTCAP);
 
   cupsdLogMessage(CUPSD_LOG_INFO,
-                  "Default destination set to \"%s\" by \"%s\".", name,
-                  get_username(con));
+                  "Default destination set to \"%s\" by \"%s\".",
+                 printer->name, get_username(con));
 
  /*
   * Everything was ok, so return OK status...
@@ -8112,7 +9716,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
                        *attr2;         /* Job attribute */
   int                  jobid;          /* Job ID */
   cupsd_job_t          *job;           /* Current job */
-  char                 method[HTTP_MAX_URI],
+  char                 scheme[HTTP_MAX_URI],
                                        /* Method portion of URI */
                        username[HTTP_MAX_URI],
                                        /* Username portion of URI */
@@ -8122,6 +9726,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
                                        /* Resource portion of URI */
   int                  port;           /* Port portion of URI */
   int                  event;          /* Events? */
+  int                  check_jobs;     /* Check jobs? */
 
 
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "set_job_attrs(%p[%d], %s)", con,
@@ -8147,7 +9752,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
                                  IPP_TAG_INTEGER)) == NULL)
     {
       send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Got a printer-uri attribute but no job-id!"));
+                      _("Got a printer-uri attribute but no job-id."));
       return;
     }
 
@@ -8159,8 +9764,8 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
     * Got a job URI; parse it to get the job ID...
     */
 
-    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                    sizeof(method), username, sizeof(username), host,
+    httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, scheme,
+                    sizeof(scheme), username, sizeof(username), host,
                    sizeof(host), &port, resource, sizeof(resource));
 
     if (strncmp(resource, "/jobs/", 6))
@@ -8169,8 +9774,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
       * Not a valid URI!
       */
 
-      send_ipp_status(con, IPP_BAD_REQUEST,
-                      _("Bad job-uri attribute \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad job-uri \"%s\"."),
                       uri->values[0].string.text);
       return;
     }
@@ -8188,7 +9792,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
     * Nope - return a "not found" error...
     */
 
-    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid);
+    send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist."), jobid);
     return;
   }
 
@@ -8203,7 +9807,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
     */
 
     send_ipp_status(con, IPP_NOT_POSSIBLE,
-                    _("Job #%d is finished and cannot be altered!"), jobid);
+                    _("Job #%d is finished and cannot be altered."), jobid);
     return;
   }
 
@@ -8213,7 +9817,8 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
 
   if (!validate_user(job, con, job->username, username, sizeof(username)))
   {
-    send_http_error(con, HTTP_UNAUTHORIZED);
+    send_http_error(con, con->username[0] ? HTTP_FORBIDDEN : HTTP_UNAUTHORIZED,
+                    cupsdFindDest(job->dest));
     return;
   }
 
@@ -8223,7 +9828,8 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
 
   cupsdLoadJob(job);
 
-  event = 0;
+  check_jobs = 0;
+  event      = 0;
 
   for (attr = con->request->attrs; attr; attr = attr->next)
   {
@@ -8237,6 +9843,7 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
        !strcmp(attr->name, "job-detailed-status-messages") ||
        !strcmp(attr->name, "job-document-access-errors") ||
        !strcmp(attr->name, "job-id") ||
+       !strcmp(attr->name, "job-impressions-completed") ||
        !strcmp(attr->name, "job-k-octets") ||
         !strcmp(attr->name, "job-originating-host-name") ||
         !strcmp(attr->name, "job-originating-user-name") ||
@@ -8250,7 +9857,6 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
        !strcmp(attr->name, "number-of-intervening-jobs") ||
        !strcmp(attr->name, "output-device-assigned") ||
        !strncmp(attr->name, "date-time-at-", 13) ||
-       !strncmp(attr->name, "job-impressions", 15) ||
        !strncmp(attr->name, "job-k-octets", 12) ||
        !strncmp(attr->name, "job-media-sheets", 16) ||
        !strncmp(attr->name, "time-at-", 8))
@@ -8262,9 +9868,8 @@ set_job_attrs(cupsd_client_t  *con,       /* I - Client connection */
       send_ipp_status(con, IPP_ATTRIBUTES_NOT_SETTABLE,
                       _("%s cannot be changed."), attr->name);
 
-      if ((attr2 = copy_attribute(con->response, attr, 0)) != NULL)
-        attr2->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
-
+      attr2 = ippCopyAttribute(con->response, attr, 0);
+      ippSetGroupTag(con->response, &attr2, IPP_TAG_UNSUPPORTED_GROUP);
       continue;
     }
 
@@ -8276,10 +9881,10 @@ set_job_attrs(cupsd_client_t  *con,     /* I - Client connection */
 
       if (attr->value_tag != IPP_TAG_INTEGER)
       {
-       send_ipp_status(con, IPP_REQUEST_VALUE, _("Bad job-priority value!"));
+       send_ipp_status(con, IPP_REQUEST_VALUE, _("Bad job-priority value."));
 
-       if ((attr2 = copy_attribute(con->response, attr, 0)) != NULL)
-          attr2->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+       attr2 = ippCopyAttribute(con->response, attr, 0);
+       ippSetGroupTag(con->response, &attr2, IPP_TAG_UNSUPPORTED_GROUP);
       }
       else if (job->state_value >= IPP_JOB_PROCESSING)
       {
@@ -8289,8 +9894,13 @@ set_job_attrs(cupsd_client_t  *con,      /* I - Client connection */
       }
       else if (con->response->request.status.status_code == IPP_OK)
       {
+        cupsdLogJob(job, CUPSD_LOG_DEBUG, "Setting job-priority to %d",
+                   attr->values[0].integer);
         cupsdSetJobPriority(job, attr->values[0].integer);
-        event |= CUPSD_EVENT_JOB_CONFIG_CHANGED;
+
+       check_jobs = 1;
+        event      |= CUPSD_EVENT_JOB_CONFIG_CHANGED |
+                     CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED;
       }
     }
     else if (!strcmp(attr->name, "job-state"))
@@ -8301,10 +9911,10 @@ set_job_attrs(cupsd_client_t  *con,     /* I - Client connection */
 
       if (attr->value_tag != IPP_TAG_ENUM)
       {
-       send_ipp_status(con, IPP_REQUEST_VALUE, _("Bad job-state value!"));
+       send_ipp_status(con, IPP_REQUEST_VALUE, _("Bad job-state value."));
 
-       if ((attr2 = copy_attribute(con->response, attr, 0)) != NULL)
-          attr2->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
+       attr2 = ippCopyAttribute(con->response, attr, 0);
+       ippSetGroupTag(con->response, &attr2, IPP_TAG_UNSUPPORTED_GROUP);
       }
       else
       {
@@ -8320,10 +9930,12 @@ set_job_attrs(cupsd_client_t  *con,     /* I - Client connection */
              }
               else if (con->response->request.status.status_code == IPP_OK)
              {
-               job->state->values[0].integer = attr->values[0].integer;
-               job->state_value              = (ipp_jstate_t)attr->values[0].integer;
-
-                event |= CUPSD_EVENT_JOB_STATE;
+               cupsdLogJob(job, CUPSD_LOG_DEBUG, "Setting job-state to %d",
+                           attr->values[0].integer);
+                cupsdSetJobState(job, attr->values[0].integer,
+                                CUPSD_JOB_DEFAULT,
+                                "Job state changed by \"%s\"", username);
+               check_jobs = 1;
              }
              break;
 
@@ -8347,7 +9959,14 @@ set_job_attrs(cupsd_client_t  *con,      /* I - Client connection */
                return;
              }
               else if (con->response->request.status.status_code == IPP_OK)
-                cupsdCancelJob(job, 0, (ipp_jstate_t)attr->values[0].integer);
+             {
+               cupsdLogJob(job, CUPSD_LOG_DEBUG, "Setting job-state to %d",
+                           attr->values[0].integer);
+                cupsdSetJobState(job, (ipp_jstate_t)attr->values[0].integer,
+                                CUPSD_JOB_DEFAULT,
+                                "Job state changed by \"%s\"", username);
+                check_jobs = 1;
+             }
              break;
        }
       }
@@ -8369,13 +9988,13 @@ set_job_attrs(cupsd_client_t  *con,     /* I - Client connection */
       if (job->attrs->last == attr2)
         job->attrs->last = job->attrs->prev;
 
-      _ippFreeAttr(attr2);
+      ippDeleteAttribute(NULL, attr2);
 
      /*
       * Then copy the attribute...
       */
 
-      copy_attribute(job->attrs, attr, 0);
+      ippCopyAttribute(job->attrs, attr, 0);
 
      /*
       * See if the job-name or job-hold-until is being changed.
@@ -8383,12 +10002,18 @@ set_job_attrs(cupsd_client_t  *con,    /* I - Client connection */
 
       if (!strcmp(attr->name, "job-hold-until"))
       {
-        cupsdSetJobHoldUntil(job, attr->values[0].string.text);
+        cupsdLogJob(job, CUPSD_LOG_DEBUG, "Setting job-hold-until to %s",
+                   attr->values[0].string.text);
+        cupsdSetJobHoldUntil(job, attr->values[0].string.text, 0);
 
        if (!strcmp(attr->values[0].string.text, "no-hold"))
+       {
          cupsdReleaseJob(job);
+          check_jobs = 1;
+       }
        else
-         cupsdHoldJob(job);
+         cupsdSetJobState(job, IPP_JOB_HELD, CUPSD_JOB_DEFAULT,
+                          "Job held by \"%s\".", username);
 
         event |= CUPSD_EVENT_JOB_CONFIG_CHANGED | CUPSD_EVENT_JOB_STATE;
       }
@@ -8410,7 +10035,7 @@ set_job_attrs(cupsd_client_t  *con,      /* I - Client connection */
         if (attr2 == job->attrs->last)
          job->attrs->last = job->attrs->prev;
 
-        _ippFreeAttr(attr2);
+        ippDeleteAttribute(NULL, attr2);
 
         event |= CUPSD_EVENT_JOB_CONFIG_CHANGED;
       }
@@ -8421,7 +10046,7 @@ set_job_attrs(cupsd_client_t  *con,      /* I - Client connection */
       * Add new option by copying it...
       */
 
-      copy_attribute(job->attrs, attr, 0);
+      ippCopyAttribute(job->attrs, attr, 0);
 
       event |= CUPSD_EVENT_JOB_CONFIG_CHANGED;
     }
@@ -8431,26 +10056,116 @@ set_job_attrs(cupsd_client_t  *con,   /* I - Client connection */
   * Save the job...
   */
 
-  cupsdSaveJob(job);
+  job->dirty = 1;
+  cupsdMarkDirty(CUPSD_DIRTY_JOBS);
 
  /*
   * Send events as needed...
   */
 
+  if (event & CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED)
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_QUEUE_ORDER_CHANGED,
+                  cupsdFindDest(job->dest), job,
+                  "Job priority changed by user.");
+
   if (event & CUPSD_EVENT_JOB_STATE)
-    cupsdAddEvent(CUPSD_EVENT_JOB_STATE, job->printer, job,
+    cupsdAddEvent(CUPSD_EVENT_JOB_STATE, cupsdFindDest(job->dest), job,
                   job->state_value == IPP_JOB_HELD ?
                      "Job held by user." : "Job restarted by user.");
 
   if (event & CUPSD_EVENT_JOB_CONFIG_CHANGED)
-    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, job->printer, job,
+    cupsdAddEvent(CUPSD_EVENT_JOB_CONFIG_CHANGED, cupsdFindDest(job->dest), job,
                   "Job options changed by user.");
 
  /*
   * Start jobs if possible...
   */
 
-  cupsdCheckJobs();
+  if (check_jobs)
+    cupsdCheckJobs();
+}
+
+
+/*
+ * 'set_printer_attrs()' - Set printer attributes.
+ */
+
+static void
+set_printer_attrs(cupsd_client_t  *con,        /* I - Client connection */
+                  ipp_attribute_t *uri)        /* I - Printer */
+{
+  http_status_t                status;         /* Policy status */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
+  cupsd_printer_t      *printer;       /* Printer/class */
+  ipp_attribute_t      *attr;          /* Printer attribute */
+  int                  changed = 0;    /* Was anything changed? */
+
+
+  cupsdLogMessage(CUPSD_LOG_DEBUG2, "set_printer_attrs(%p[%d], %s)", con,
+                  con->http.fd, uri->values[0].string.text);
+
+ /*
+  * Is the destination valid?
+  */
+
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
+  {
+   /*
+    * Bad URI...
+    */
+
+    send_ipp_status(con, IPP_NOT_FOUND,
+                    _("The printer or class does not exist."));
+    return;
+  }
+
+ /*
+  * Check policy...
+  */
+
+  if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
+  {
+    send_http_error(con, status, printer);
+    return;
+  }
+
+ /*
+  * Return a list of attributes that can be set via Set-Printer-Attributes.
+  */
+
+  if ((attr = ippFindAttribute(con->request, "printer-location",
+                               IPP_TAG_TEXT)) != NULL)
+  {
+    cupsdSetString(&printer->location, attr->values[0].string.text);
+    changed = 1;
+  }
+
+  if ((attr = ippFindAttribute(con->request, "printer-info",
+                               IPP_TAG_TEXT)) != NULL)
+  {
+    cupsdSetString(&printer->info, attr->values[0].string.text);
+    changed = 1;
+  }
+
+ /*
+  * Update the printer attributes and return...
+  */
+
+  if (changed)
+  {
+    cupsdSetPrinterAttrs(printer);
+    cupsdMarkDirty(CUPSD_DIRTY_PRINTERS);
+
+    cupsdAddEvent(CUPSD_EVENT_PRINTER_CONFIG, printer, NULL,
+                  "Printer \"%s\" description or location changed by \"%s\".",
+                 printer->name, get_username(con));
+
+    cupsdLogMessage(CUPSD_LOG_INFO,
+                    "Printer \"%s\" description or location changed by \"%s\".",
+                    printer->name, get_username(con));
+  }
+
+  con->response->request.status.status_code = IPP_OK;
 }
 
 
@@ -8507,7 +10222,7 @@ set_printer_defaults(
     }
     else if (!strcmp(attr->name, "requesting-user-name-allowed"))
     {
-      cupsdFreePrinterUsers(printer);
+      cupsdFreeStrings(&(printer->users));
 
       printer->deny_users = 0;
 
@@ -8516,12 +10231,12 @@ set_printer_defaults(
           strcmp(attr->values[0].string.text, "all")))
       {
        for (i = 0; i < attr->num_values; i ++)
-         cupsdAddPrinterUser(printer, attr->values[i].string.text);
+         cupsdAddString(&(printer->users), attr->values[i].string.text);
       }
     }
     else if (!strcmp(attr->name, "requesting-user-name-denied"))
     {
-      cupsdFreePrinterUsers(printer);
+      cupsdFreeStrings(&(printer->users));
 
       printer->deny_users = 1;
 
@@ -8530,7 +10245,7 @@ set_printer_defaults(
           strcmp(attr->values[0].string.text, "none")))
       {
        for (i = 0; i < attr->num_values; i ++)
-         cupsdAddPrinterUser(printer, attr->values[i].string.text);
+         cupsdAddString(&(printer->users), attr->values[i].string.text);
       }
     }
     else if (!strcmp(attr->name, "job-quota-period"))
@@ -8595,9 +10310,11 @@ set_printer_defaults(
       if (attr->value_tag != IPP_TAG_NAME && attr->value_tag != IPP_TAG_KEYWORD)
         continue;
 
-      if (strcmp(attr->values[0].string.text, "abort-job") &&
-          strcmp(attr->values[0].string.text, "retry-job") &&
-          strcmp(attr->values[0].string.text, "stop-printer"))
+      if (strcmp(attr->values[0].string.text, "retry-current-job") &&
+          ((printer->type & CUPS_PRINTER_CLASS) ||
+          (strcmp(attr->values[0].string.text, "abort-job") &&
+           strcmp(attr->values[0].string.text, "retry-job") &&
+           strcmp(attr->values[0].string.text, "stop-printer"))))
       {
        send_ipp_status(con, IPP_NOT_POSSIBLE,
                        _("Unknown printer-error-policy \"%s\"."),
@@ -8610,10 +10327,6 @@ set_printer_defaults(
                       attr->values[0].string.text);
       cupsdSetString(&printer->error_policy, attr->values[0].string.text);
     }
-    else if (!strcmp(attr->name, "document-format-default") ||
-             !strcmp(attr->name, "notify-lease-duration-default") ||
-             !strcmp(attr->name, "notify-events-default"))
-      continue;
 
    /*
     * Skip any other non-default attributes...
@@ -8642,6 +10355,7 @@ set_printer_defaults(
           break;
 
       case IPP_TAG_NAME :
+      case IPP_TAG_TEXT :
       case IPP_TAG_KEYWORD :
       case IPP_TAG_URI :
           printer->num_options = cupsAddOption(name,
@@ -8688,7 +10402,7 @@ set_printer_defaults(
           sprintf(value, "%dx%d%s", attr->values[0].resolution.xres,
                  attr->values[0].resolution.yres,
                  attr->values[0].resolution.units == IPP_RES_PER_INCH ?
-                     "dpi" : "dpc");
+                     "dpi" : "dpcm");
           printer->num_options = cupsAddOption(name, value,
                                               printer->num_options,
                                               &(printer->options));
@@ -8712,18 +10426,9 @@ static void
 start_printer(cupsd_client_t  *con,    /* I - Client connection */
               ipp_attribute_t *uri)    /* I - Printer URI */
 {
+  int                  i;              /* Temporary variable */
   http_status_t                status;         /* Policy status */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
-  char                 method[HTTP_MAX_URI],
-                                       /* Method portion of URI */
-                       username[HTTP_MAX_URI],
-                                       /* Username portion of URI */
-                       host[HTTP_MAX_URI],
-                                       /* Host portion of URI */
-                       resource[HTTP_MAX_URI];
-                                       /* Resource portion of URI */
-  int                  port;           /* Port portion of URI */
-  const char           *name;          /* Printer name */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
   cupsd_printer_t      *printer;       /* Printer data */
 
 
@@ -8734,18 +10439,14 @@ start_printer(cupsd_client_t  *con,    /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((name = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -8755,7 +10456,7 @@ start_printer(cupsd_client_t  *con,      /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
     return;
   }
 
@@ -8768,14 +10469,29 @@ start_printer(cupsd_client_t  *con,    /* I - Client connection */
   cupsdStartPrinter(printer, 1);
 
   if (dtype & CUPS_PRINTER_CLASS)
-    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" started by \"%s\".", name,
-                    get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" started by \"%s\".",
+                    printer->name, get_username(con));
   else
-    cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" started by \"%s\".", name,
-                    get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" started by \"%s\".",
+                    printer->name, get_username(con));
 
   cupsdCheckJobs();
 
+ /*
+  * Check quotas...
+  */
+
+  if ((i = check_quotas(con, printer)) < 0)
+  {
+    send_ipp_status(con, IPP_NOT_POSSIBLE, _("Quota limit reached."));
+    return;
+  }
+  else if (i == 0)
+  {
+    send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Not allowed to print."));
+    return;
+  }
+
  /*
   * Everything was ok, so return OK status...
   */
@@ -8793,17 +10509,7 @@ stop_printer(cupsd_client_t  *con,      /* I - Client connection */
              ipp_attribute_t *uri)     /* I - Printer URI */
 {
   http_status_t                status;         /* Policy status */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
-  char                 method[HTTP_MAX_URI],
-                                       /* Method portion of URI */
-                       username[HTTP_MAX_URI],
-                                       /* Username portion of URI */
-                       host[HTTP_MAX_URI],
-                                       /* Host portion of URI */
-                       resource[HTTP_MAX_URI];
-                                       /* Resource portion of URI */
-  int                  port;           /* Port portion of URI */
-  const char           *name;          /* Printer name */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
   cupsd_printer_t      *printer;       /* Printer data */
   ipp_attribute_t      *attr;          /* printer-state-message attribute */
 
@@ -8815,18 +10521,14 @@ stop_printer(cupsd_client_t  *con,     /* I - Client connection */
   * Is the destination valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
-
-  if ((name = cupsdValidateDest(host, resource, &dtype, &printer)) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -8836,7 +10538,7 @@ stop_printer(cupsd_client_t  *con,       /* I - Client connection */
 
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
     return;
   }
 
@@ -8846,7 +10548,7 @@ stop_printer(cupsd_client_t  *con,       /* I - Client connection */
 
   if ((attr = ippFindAttribute(con->request, "printer-state-message",
                                IPP_TAG_TEXT)) == NULL)
-    strcpy(printer->state_message, "Paused");
+    strlcpy(printer->state_message, "Paused", sizeof(printer->state_message));
   else
   {
     strlcpy(printer->state_message, attr->values[0].string.text,
@@ -8856,11 +10558,11 @@ stop_printer(cupsd_client_t  *con,     /* I - Client connection */
   cupsdStopPrinter(printer, 1);
 
   if (dtype & CUPS_PRINTER_CLASS)
-    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" stopped by \"%s\".", name,
-                    get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO, "Class \"%s\" stopped by \"%s\".",
+                    printer->name, get_username(con));
   else
-    cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" stopped by \"%s\".", name,
-                    get_username(con));
+    cupsdLogMessage(CUPSD_LOG_INFO, "Printer \"%s\" stopped by \"%s\".",
+                    printer->name, get_username(con));
 
  /*
   * Everything was ok, so return OK status...
@@ -8881,8 +10583,7 @@ url_encode_attr(ipp_attribute_t *attr,   /* I - Attribute */
 {
   int  i;                              /* Looping var */
   char *bufptr,                        /* Pointer into buffer */
-       *bufend,                        /* End of buffer */
-       *valptr;                        /* Pointer into value */
+       *bufend;                        /* End of buffer */
 
 
   strlcpy(buffer, attr->name, bufsize);
@@ -8904,25 +10605,8 @@ url_encode_attr(ipp_attribute_t *attr,  /* I - Attribute */
 
     *bufptr++ = '\'';
 
-    for (valptr = attr->values[i].string.text;
-         *valptr && bufptr < bufend;
-        valptr ++)
-      if (*valptr == ' ')
-      {
-        if (bufptr >= (bufend - 2))
-         break;
-
-        *bufptr++ = '%';
-       *bufptr++ = '2';
-       *bufptr++ = '0';
-      }
-      else if (*valptr == '\'' || *valptr == '\\')
-      {
-        *bufptr++ = '\\';
-        *bufptr++ = *valptr;
-      }
-      else
-        *bufptr++ = *valptr;
+    bufptr = url_encode_string(attr->values[i].string.text,
+                               bufptr, bufend - bufptr + 1);
 
     if (bufptr >= bufend)
       break;
@@ -8934,6 +10618,55 @@ url_encode_attr(ipp_attribute_t *attr,  /* I - Attribute */
 }
 
 
+/*
+ * 'url_encode_string()' - URL-encode a string.
+ */
+
+static char *                          /* O - End of string */
+url_encode_string(const char *s,       /* I - String */
+                  char       *buffer,  /* I - String buffer */
+                 int        bufsize)   /* I - Size of buffer */
+{
+  char *bufptr,                        /* Pointer into buffer */
+       *bufend;                        /* End of buffer */
+  static const char *hex = "0123456789ABCDEF";
+                                       /* Hex digits */
+
+
+  bufptr = buffer;
+  bufend = buffer + bufsize - 1;
+
+  while (*s && bufptr < bufend)
+  {
+    if (*s == ' ' || *s == '%' || *s == '+')
+    {
+      if (bufptr >= (bufend - 2))
+       break;
+
+      *bufptr++ = '%';
+      *bufptr++ = hex[(*s >> 4) & 15];
+      *bufptr++ = hex[*s & 15];
+
+      s ++;
+    }
+    else if (*s == '\'' || *s == '\\')
+    {
+      if (bufptr >= (bufend - 1))
+       break;
+
+      *bufptr++ = '\\';
+      *bufptr++ = *s++;
+    }
+    else
+      *bufptr++ = *s++;
+  }
+
+  *bufptr = '\0';
+
+  return (bufptr);
+}
+
+
 /*
  * 'user_allowed()' - See if a user is allowed to print to a queue.
  */
@@ -8942,35 +10675,62 @@ static int                             /* O - 0 if not allowed, 1 if allowed */
 user_allowed(cupsd_printer_t *p,       /* I - Printer or class */
              const char      *username)        /* I - Username */
 {
-  int          i;                      /* Looping var */
   struct passwd        *pw;                    /* User password data */
+  char         baseuser[256],          /* Base username */
+               *baseptr,               /* Pointer to "@" in base username */
+               *name;                  /* Current user name */
 
 
-  if (p->num_users == 0)
+  if (cupsArrayCount(p->users) == 0)
     return (1);
 
   if (!strcmp(username, "root"))
     return (1);
 
+  if (strchr(username, '@'))
+  {
+   /*
+    * Strip @REALM for username check...
+    */
+
+    strlcpy(baseuser, username, sizeof(baseuser));
+
+    if ((baseptr = strchr(baseuser, '@')) != NULL)
+      *baseptr = '\0';
+
+    username = baseuser;
+  }
+
   pw = getpwnam(username);
   endpwent();
 
-  for (i = 0; i < p->num_users; i ++)
+  for (name = (char *)cupsArrayFirst(p->users);
+       name;
+       name = (char *)cupsArrayNext(p->users))
   {
-    if (p->users[i][0] == '@')
+    if (name[0] == '@')
     {
      /*
       * Check group membership...
       */
 
-      if (cupsdCheckGroup(username, pw, p->users[i] + 1))
+      if (cupsdCheckGroup(username, pw, name + 1))
+        break;
+    }
+    else if (name[0] == '#')
+    {
+     /*
+      * Check UUID...
+      */
+
+      if (cupsdCheckGroup(username, pw, name))
         break;
     }
-    else if (!strcasecmp(username, p->users[i]))
+    else if (!_cups_strcasecmp(username, name))
       break;
   }
 
-  return ((i < p->num_users) != p->deny_users);
+  return ((name != NULL) != p->deny_users);
 }
 
 
@@ -8983,18 +10743,11 @@ validate_job(cupsd_client_t  *con,     /* I - Client connection */
             ipp_attribute_t *uri)      /* I - Printer URI */
 {
   http_status_t                status;         /* Policy status */
-  ipp_attribute_t      *attr;          /* Current attribute */
-  ipp_attribute_t      *format;        /* Document-format attribute */
-  cups_ptype_t         dtype;          /* Destination type (printer or class) */
-  char                 method[HTTP_MAX_URI],
-                                       /* Method portion of URI */
-                       username[HTTP_MAX_URI],
-                                       /* Username portion of URI */
-                       host[HTTP_MAX_URI],
-                                       /* Host portion of URI */
-                       resource[HTTP_MAX_URI];
-                                       /* Resource portion of URI */
-  int                  port;           /* Port portion of URI */
+  ipp_attribute_t      *attr,          /* Current attribute */
+                       *auth_info;     /* auth-info attribute */
+  ipp_attribute_t      *format,        /* Document-format attribute */
+                       *name;          /* Job-name attribute */
+  cups_ptype_t         dtype;          /* Destination type (printer/class) */
   char                 super[MIME_MAX_SUPER],
                                        /* Supertype of file */
                        type[MIME_MAX_TYPE];
@@ -9011,15 +10764,21 @@ validate_job(cupsd_client_t  *con,     /* I - Client connection */
   */
 
   if ((attr = ippFindAttribute(con->request, "compression",
-                               IPP_TAG_KEYWORD)) != NULL &&
-      !strcmp(attr->values[0].string.text, "none"))
+                               IPP_TAG_KEYWORD)) != NULL)
   {
-    send_ipp_status(con, IPP_ATTRIBUTES,
-                    _("Unsupported compression attribute %s!"),
-                    attr->values[0].string.text);
-    ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_KEYWORD,
-                "compression", NULL, attr->values[0].string.text);
-    return;
+    if (strcmp(attr->values[0].string.text, "none")
+#ifdef HAVE_LIBZ
+        && strcmp(attr->values[0].string.text, "gzip")
+#endif /* HAVE_LIBZ */
+      )
+    {
+      send_ipp_status(con, IPP_ATTRIBUTES,
+                      _("Unsupported 'compression' value \"%s\"."),
+                     attr->values[0].string.text);
+      ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_KEYWORD,
+                  "compression", NULL, attr->values[0].string.text);
+      return;
+    }
   }
 
  /*
@@ -9029,9 +10788,11 @@ validate_job(cupsd_client_t  *con,      /* I - Client connection */
   if ((format = ippFindAttribute(con->request, "document-format",
                                  IPP_TAG_MIMETYPE)) != NULL)
   {
-    if (sscanf(format->values[0].string.text, "%15[^/]/%31[^;]", super, type) != 2)
+    if (sscanf(format->values[0].string.text, "%15[^/]/%255[^;]",
+               super, type) != 2)
     {
-      send_ipp_status(con, IPP_BAD_REQUEST, _("Bad document-format \"%s\"!"),
+      send_ipp_status(con, IPP_BAD_REQUEST,
+                      _("Bad 'document-format' value \"%s\"."),
                      format->values[0].string.text);
       return;
     }
@@ -9042,7 +10803,7 @@ validate_job(cupsd_client_t  *con,       /* I - Client connection */
       cupsdLogMessage(CUPSD_LOG_INFO,
                       "Hint: Do you have the raw file printing rules enabled?");
       send_ipp_status(con, IPP_DOCUMENT_FORMAT,
-                      _("Unsupported format \"%s\"!"),
+                      _("Unsupported 'document-format' value \"%s\"."),
                      format->values[0].string.text);
       ippAddString(con->response, IPP_TAG_UNSUPPORTED_GROUP, IPP_TAG_MIMETYPE,
                    "document-format", NULL, format->values[0].string.text);
@@ -9051,21 +10812,97 @@ validate_job(cupsd_client_t  *con,     /* I - Client connection */
   }
 
  /*
-  * Is the destination valid?
+  * Is the job-name valid?
   */
 
-  httpSeparateURI(HTTP_URI_CODING_ALL, uri->values[0].string.text, method,
-                  sizeof(method), username, sizeof(username), host,
-                 sizeof(host), &port, resource, sizeof(resource));
+  if ((name = ippFindAttribute(con->request, "job-name", IPP_TAG_ZERO)) != NULL)
+  {
+    int bad_name = 0;                  /* Is the job-name value bad? */
+
+    if ((name->value_tag != IPP_TAG_NAME && name->value_tag != IPP_TAG_NAMELANG) ||
+        name->num_values != 1)
+    {
+      bad_name = 1;
+    }
+    else
+    {
+     /*
+      * Validate that job-name conforms to RFC 5198 (Network Unicode) and
+      * IPP Everywhere requirements for "name" values...
+      */
+
+      const unsigned char *nameptr;    /* Pointer into "job-name" attribute */
+
+      for (nameptr = (unsigned char *)name->values[0].string.text;
+           *nameptr;
+           nameptr ++)
+      {
+        if (*nameptr < ' ' && *nameptr != '\t')
+          break;
+        else if (*nameptr == 0x7f)
+          break;
+        else if ((*nameptr & 0xe0) == 0xc0)
+        {
+          if ((nameptr[1] & 0xc0) != 0x80)
+            break;
+
+          nameptr ++;
+        }
+        else if ((*nameptr & 0xf0) == 0xe0)
+        {
+          if ((nameptr[1] & 0xc0) != 0x80 ||
+              (nameptr[2] & 0xc0) != 0x80)
+           break;
+
+         nameptr += 2;
+       }
+        else if ((*nameptr & 0xf8) == 0xf0)
+        {
+          if ((nameptr[1] & 0xc0) != 0x80 ||
+             (nameptr[2] & 0xc0) != 0x80 ||
+             (nameptr[3] & 0xc0) != 0x80)
+           break;
+
+         nameptr += 3;
+       }
+        else if (*nameptr & 0x80)
+          break;
+      }
+
+      if (*nameptr)
+        bad_name = 1;
+    }
+
+    if (bad_name)
+    {
+      if (StrictConformance)
+      {
+       send_ipp_status(con, IPP_ATTRIBUTES,
+                       _("Unsupported 'job-name' value."));
+       ippCopyAttribute(con->response, name, 0);
+       return;
+      }
+      else
+      {
+        cupsdLogMessage(CUPSD_LOG_WARN,
+                        "Unsupported 'job-name' value, deleting from request.");
+        ippDeleteAttribute(con->request, name);
+      }
+    }
+  }
+
+ /*
+  * Is the destination valid?
+  */
 
-  if (cupsdValidateDest(host, resource, &dtype, &printer) == NULL)
+  if (!cupsdValidateDest(uri->values[0].string.text, &dtype, &printer))
   {
    /*
     * Bad URI...
     */
 
     send_ipp_status(con, IPP_NOT_FOUND,
-                    _("The printer or class was not found."));
+                    _("The printer or class does not exist."));
     return;
   }
 
@@ -9073,11 +10910,32 @@ validate_job(cupsd_client_t  *con,     /* I - Client connection */
   * Check policy...
   */
 
+  auth_info = ippFindAttribute(con->request, "auth-info", IPP_TAG_TEXT);
+
   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)
   {
-    send_http_error(con, status);
+    send_http_error(con, status, printer);
+    return;
+  }
+  else if (printer->num_auth_info_required == 1 &&
+           !strcmp(printer->auth_info_required[0], "negotiate") &&
+           !con->username[0])
+  {
+    send_http_error(con, HTTP_UNAUTHORIZED, printer);
+    return;
+  }
+#ifdef HAVE_SSL
+  else if (auth_info && !con->http.tls &&
+           !httpAddrLocalhost(con->http.hostaddr))
+  {
+   /*
+    * Require encryption of auth-info over non-local connections...
+    */
+
+    send_http_error(con, HTTP_UPGRADE_REQUIRED, printer);
     return;
   }
+#endif /* HAVE_SSL */
 
  /*
   * Everything was ok, so return OK status...
@@ -9091,7 +10949,7 @@ validate_job(cupsd_client_t  *con,       /* I - Client connection */
  * 'validate_name()' - Make sure the printer name only contains valid chars.
  */
 
-static int                     /* O - 0 if name is no good, 1 if name is good */
+static int                     /* O - 0 if name is no good, 1 if good */
 validate_name(const char *name)        /* I - Name to check */
 {
   const char   *ptr;           /* Pointer into name */
@@ -9102,7 +10960,7 @@ validate_name(const char *name)  /* I - Name to check */
   */
 
   for (ptr = name; *ptr; ptr ++)
-    if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '#')
+    if ((*ptr > 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '#')
       return (0);
 
  /*
@@ -9130,8 +10988,8 @@ validate_user(cupsd_job_t    *job,       /* I - Job */
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
                   "validate_user(job=%d, con=%d, owner=\"%s\", username=%p, "
                  "userlen=%d)",
-                 job ? job->id : 0, con->http.fd, owner ? owner : "(null)",
-                 username, userlen);
+                 job->id, con ? con->http.fd : 0,
+                 owner ? owner : "(null)", username, userlen);
 
  /*
   * Validate input...
@@ -9158,5 +11016,5 @@ validate_user(cupsd_job_t    *job,       /* I - Job */
 
 
 /*
- * End of "$Id: ipp.c 6052 2006-10-20 20:35:41Z mike $".
+ * End of "$Id: ipp.c 11500 2014-01-06 22:21:15Z msweet $".
  */