No longer support backslash, question mark, or quotes in printer names (Issue #4966)

diff --git a/CHANGES.md b/CHANGES.md
index 865d4976c7e8a820801a3cec55c517bc2f7b6a32..0dc43a05574731bce9c9d17acdcfa1c361295ea3 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -5,6 +5,8 @@ CHANGES - 2.3b1 - 2017-11-01
 Changes in CUPS v2.3b1
 ----------------------
 
+- No longer support backslash, question mark, or quotes in printer names
+  (Issue #4966)
 - Dropped RSS subscription management from the web interface (Issue #5012)
 - The lpadmin command now provides a better error message when an unsupported
   System V interface script is used (Issue #5111)

diff --git a/cgi-bin/admin.c b/cgi-bin/admin.c
index cfdf3ff0134e4143c458d089bfe2f6975e3f1124..179a8d68eab79a49a51af364574e502c769c8d3a 100644 (file)
--- a/cgi-bin/admin.c
+++ b/cgi-bin/admin.c
@@ -695,16 +695,13 @@ do_am_printer(http_t *http,               /* I - HTTP connection */
   if ((name = cgiGetVariable("PRINTER_NAME")) != NULL)
   {
     for (ptr = name; *ptr; ptr ++)
-      if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '#')
+      if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '\\' || *ptr == '?' || *ptr == '\'' || *ptr == '\"' || *ptr == '#')
        break;
 
     if (*ptr || ptr == name || strlen(name) > 127)
     {
       cgiSetVariable("ERROR",
-                    cgiText(_("The printer name may only contain up to "
-                              "127 printable characters and may not "
-                              "contain spaces, slashes (/), or the "
-                              "pound sign (#).")));
+                    cgiText(_("The printer name may only contain up to 127 printable characters and may not contain spaces, slashes (/ \\), quotes (' \"), question mark (?), or the pound sign (#).")));
       cgiStartHTML(title);
       cgiCopyTemplateLang("error.tmpl");
       cgiEndHTML();

diff --git a/systemv/lpadmin.c b/systemv/lpadmin.c
index b36ea48c4368769c030cba151dfedceb85632aed..48dcd76f66b3fa5211d3e4cc9ce464859c145f88 100644 (file)
--- a/systemv/lpadmin.c
+++ b/systemv/lpadmin.c
@@ -1591,8 +1591,7 @@ validate_name(const char *name)           /* I - Name to check */
   for (ptr = name; *ptr; ptr ++)
     if (*ptr == '@')
       break;
-    else if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' ||
-             *ptr == '#')
+    else if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '\\' || *ptr == '?' || *ptr == '\'' || *ptr == '\"' || *ptr == '#')
       return (0);
 
  /*