- Added a workaround for certain web browsers that do not support multiple

  authentication schemes in a single response header (Issue #5289)

diff --git a/CHANGES.md b/CHANGES.md
index 8fb9d6cfddea26748935fb9e4aaf7b76e5e1a4a9..3d0f4f1239ec1ffa4c11bf802a2cb0e5e5b69e2e 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,4 +1,4 @@
-CHANGES - 2.3rc1 - 2018-04-11
+CHANGES - 2.3rc1 - 2018-04-16
 =============================
 
 Changes in CUPS v2.3rc1
@@ -10,6 +10,8 @@ Changes in CUPS v2.3rc1
   the supplied HTTP connection (Issue #5288)
 - Fixed another crash in the scheduler when adding an IPP Everywhere printer
   (Issue #5290)
+- Added a workaround for certain web browsers that do not support multiple
+  authentication schemes in a single response header (Issue #5289)
 - Fixed a parsing bug in the new authentication code.
 
 

diff --git a/scheduler/client.c b/scheduler/client.c
index f388499dcf9da9de8ff1c7a88e7a5db4412a9c60..95c34877d454f8b12e3db4fabd90fea684c9756d 100644 (file)
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -1,13 +1,14 @@
 /*
  * Client routines for the CUPS scheduler.
  *
- * Copyright 2007-2017 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
  * This file contains Kerberos support code, copyright 2006 by
  * Jelmer Vernooij.
  *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
+ * Licensed under Apache License v2.0.  See the file "LICENSE" for more
+ * information.
  */
 
 /*
@@ -813,6 +814,18 @@ cupsdReadClient(cupsd_client_t *con)       /* I - Client to read from */
 
   if (status == HTTP_STATUS_OK)
   {
+   /*
+    * Record whether the client is a web browser.  "Mozilla" was the original
+    * and it seems that every web browser in existence now uses that as the
+    * prefix with additional information identifying *which* browser.
+    *
+    * Chrome (at least) has problems with multiple WWW-Authenticate values in
+    * a single header, so we only report Basic or Negotiate to web browsers and
+    * leave the multiple choices to the native CUPS client...
+    */
+
+    con->is_browser = !strncmp(httpGetField(con->http, HTTP_FIELD_USER_AGENT), "Mozilla/", 8);
+
     if (httpGetField(con->http, HTTP_FIELD_ACCEPT_LANGUAGE)[0])
     {
      /*
@@ -2103,8 +2116,7 @@ cupsdSendHeader(
       strlcpy(auth_str, "Negotiate", sizeof(auth_str));
     }
 
-    if (con->best && auth_type != CUPSD_AUTH_NEGOTIATE &&
-        !_cups_strcasecmp(httpGetHostname(con->http, NULL, 0), "localhost"))
+    if (con->best && auth_type != CUPSD_AUTH_NEGOTIATE && !con->is_browser && !_cups_strcasecmp(httpGetHostname(con->http, NULL, 0), "localhost"))
     {
      /*
       * Add a "trc" (try root certification) parameter for local non-Kerberos

diff --git a/scheduler/client.h b/scheduler/client.h
index aaca8279af5c3c6e0b313553987dff275a4d5175..fc7af5400d4be636ea6a167092200c9a8809731f 100644 (file)
--- a/scheduler/client.h
+++ b/scheduler/client.h
@@ -1,10 +1,11 @@
 /*
  * Client definitions for the CUPS scheduler.
  *
- * Copyright 2007-2016 by Apple Inc.
- * Copyright 1997-2007 by Easy Software Products, all rights reserved.
+ * Copyright © 2007-2018 by Apple Inc.
+ * Copyright © 1997-2007 by Easy Software Products, all rights reserved.
  *
- * Licensed under Apache License v2.0.  See the file "LICENSE" for more information.
+ * Licensed under Apache License v2.0.  See the file "LICENSE" for more
+ * information.
  */
 
 #ifdef HAVE_AUTHORIZATION_H
@@ -26,6 +27,7 @@ struct cupsd_client_s
   struct timeval       start;          /* Request start time */
   http_state_t         operation;      /* Request operation */
   off_t                        bytes;          /* Bytes transferred for this request */
+  int                  is_browser;     /* Is the client a web browser? */
   int                  type;           /* AuthType for username */
   char                 username[HTTP_MAX_VALUE],
                                        /* Username from Authorization: line */