From 3c27d2a6ddf50a4cb02c0b7a464eaf7b6f1ea601 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 16 Jul 2019 09:16:22 -0400
Subject: [PATCH] Always check the group membership list (Issue #5613)

---
 CHANGES.md       |  3 +++
 scheduler/auth.c | 23 ++++++++++++++++-------
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 58db8c216..96141157c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -11,6 +11,9 @@ Changes in CUPS v2.3.0
 - Removed dead code from the scheduler (Issue #5593)
 - "make" failed with GZIP options (Issue #5595)
 - Fixed a NULL pointer dereference bug in `httpGetSubField2` (Issue #5598)
+- The scheduler now uses both the group's membership list as well as the
+  various OS-specific membership functions to determine whether a user belongs
+  to a named group (Issue #5613)
 - Fixed an issue with unsupported "sides" values in the IPP backend
   (rdar://51775322)
 - The scheduler would restart continuously when idle and printers were not
diff --git a/scheduler/auth.c b/scheduler/auth.c
index c910c131d..5bb80edc9 100644
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -1166,7 +1166,23 @@ cupsdCheckGroup(
 
     groupid = group->gr_gid;
 
+    for (i = 0; group->gr_mem[i]; i ++)
+    {
+     /*
+      * User appears in the group membership...
+      */
+
+      if (!_cups_strcasecmp(username, group->gr_mem[i]))
+	return (1);
+    }
+
 #ifdef HAVE_GETGROUPLIST
+   /*
+    * If the user isn't in the group membership list, try the results from
+    * getgrouplist() which is supposed to return the full list of groups a user
+    * belongs to...
+    */
+
     if (user)
     {
       int	ngroups;		/* Number of groups */
@@ -1187,13 +1203,6 @@ cupsdCheckGroup(
         if ((int)groupid == (int)groups[i])
 	  return (1);
     }
-
-#else
-    for (i = 0; group->gr_mem[i]; i ++)
-    {
-      if (!_cups_strcasecmp(username, group->gr_mem[i]))
-	return (1);
-    }
 #endif /* HAVE_GETGROUPLIST */
   }
   else
-- 
2.39.5