From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Tue, 6 Dec 2022 14:21:07 +0000 (-0500)
Subject: Fix some cupsd.conf file issues:
X-Git-Tag: v2.4.3~92
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aa31325cb1e0cc7ee3b210fd408f22426d952dd4;p=thirdparty%2Fcups.git

Fix some cupsd.conf file issues:

- CUPS-Get-Document wasn't password-protected by default.
- The compiled-in default policy wasn't the same as the cupsd.conf default.
---

diff --git a/conf/cupsd.conf.in b/conf/cupsd.conf.in
index a07536f3e4..f69aa39030 100644
--- a/conf/cupsd.conf.in
+++ b/conf/cupsd.conf.in
@@ -94,7 +94,13 @@ IdleExitTimeout @EXIT_TIMEOUT@
   </Limit>
 
   # Only the owner or an administrator can cancel or authenticate a job...
-  <Limit Cancel-Job CUPS-Authenticate-Job>
+  <Limit Cancel-Job>
+    Require user @OWNER @CUPS_DEFAULT_PRINTOPERATOR_AUTH@
+    Order deny,allow
+  </Limit>
+
+  <Limit CUPS-Authenticate-Job>
+    AuthType Default
     Require user @OWNER @CUPS_DEFAULT_PRINTOPERATOR_AUTH@
     Order deny,allow
   </Limit>
diff --git a/scheduler/conf.c b/scheduler/conf.c
index 8467328a55..c8b4d1d6a4 100644
--- a/scheduler/conf.c
+++ b/scheduler/conf.c
@@ -1359,136 +1359,150 @@ cupsdReadConfiguration(void)
       DefaultPolicyPtr = p = cupsdAddPolicy("default");
 
       cupsdLogMessage(CUPSD_LOG_INFO, "<Policy default>");
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "JobPrivateAccess default");
-      cupsdAddString(&(p->job_access), "@OWNER");
-      cupsdAddString(&(p->job_access), "@SYSTEM");
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "JobPrivateValues default");
-      cupsdAddString(&(p->job_attrs), "job-name");
-      cupsdAddString(&(p->job_attrs), "job-originating-host-name");
-      cupsdAddString(&(p->job_attrs), "job-originating-user-name");
-      cupsdAddString(&(p->job_attrs), "phone");
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "SubscriptionPrivateAccess default");
-      cupsdAddString(&(p->sub_access), "@OWNER");
-      cupsdAddString(&(p->sub_access), "@SYSTEM");
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "SubscriptionPrivateValues default");
-      cupsdAddString(&(p->job_attrs), "notify-events");
-      cupsdAddString(&(p->job_attrs), "notify-pull-method");
-      cupsdAddString(&(p->job_attrs), "notify-recipient-uri");
-      cupsdAddString(&(p->job_attrs), "notify-subscriber-user-name");
-      cupsdAddString(&(p->job_attrs), "notify-user-data");
-
-      cupsdLogMessage(CUPSD_LOG_INFO,
-                      "<Limit Create-Job Print-Job Print-URI Validate-Job>");
-      cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
-
-      po = cupsdAddPolicyOp(p, NULL, IPP_CREATE_JOB);
-      po->order_type = CUPSD_AUTH_ALLOW;
-
-      cupsdAddPolicyOp(p, po, IPP_PRINT_JOB);
-      cupsdAddPolicyOp(p, po, IPP_PRINT_URI);
-      cupsdAddPolicyOp(p, po, IPP_VALIDATE_JOB);
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
-
-      cupsdLogMessage(CUPSD_LOG_INFO,
-                      "<Limit Send-Document Send-URI Cancel-Job Hold-Job "
-                      "Release-Job Restart-Job Purge-Jobs "
-		      "Set-Job-Attributes Create-Job-Subscription "
-		      "Renew-Subscription Cancel-Subscription "
-		      "Get-Notifications Reprocess-Job Cancel-Current-Job "
-		      "Suspend-Current-Job Resume-Job "
-		      "Cancel-My-Jobs Close-Job CUPS-Move-Job "
-		      "CUPS-Authenticate-Job CUPS-Get-Document>");
-      cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
-
-      po = cupsdAddPolicyOp(p, NULL, IPP_SEND_DOCUMENT);
-      po->order_type = CUPSD_AUTH_ALLOW;
-      po->level      = CUPSD_AUTH_USER;
-
-      cupsdAddName(po, "@OWNER");
-      cupsdAddName(po, "@SYSTEM");
-      cupsdLogMessage(CUPSD_LOG_INFO, "Require user @OWNER @SYSTEM");
-
-      cupsdAddPolicyOp(p, po, IPP_SEND_URI);
-      cupsdAddPolicyOp(p, po, IPP_CANCEL_JOB);
-      cupsdAddPolicyOp(p, po, IPP_HOLD_JOB);
-      cupsdAddPolicyOp(p, po, IPP_RELEASE_JOB);
-      cupsdAddPolicyOp(p, po, IPP_RESTART_JOB);
-      cupsdAddPolicyOp(p, po, IPP_PURGE_JOBS);
-      cupsdAddPolicyOp(p, po, IPP_SET_JOB_ATTRIBUTES);
-      cupsdAddPolicyOp(p, po, IPP_CREATE_JOB_SUBSCRIPTION);
-      cupsdAddPolicyOp(p, po, IPP_RENEW_SUBSCRIPTION);
-      cupsdAddPolicyOp(p, po, IPP_CANCEL_SUBSCRIPTION);
-      cupsdAddPolicyOp(p, po, IPP_GET_NOTIFICATIONS);
-      cupsdAddPolicyOp(p, po, IPP_REPROCESS_JOB);
-      cupsdAddPolicyOp(p, po, IPP_CANCEL_CURRENT_JOB);
-      cupsdAddPolicyOp(p, po, IPP_SUSPEND_CURRENT_JOB);
-      cupsdAddPolicyOp(p, po, IPP_RESUME_JOB);
-      cupsdAddPolicyOp(p, po, IPP_CANCEL_MY_JOBS);
-      cupsdAddPolicyOp(p, po, IPP_CLOSE_JOB);
-      cupsdAddPolicyOp(p, po, CUPS_MOVE_JOB);
-      cupsdAddPolicyOp(p, po, CUPS_AUTHENTICATE_JOB);
-      cupsdAddPolicyOp(p, po, CUPS_GET_DOCUMENT);
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
-
-      cupsdLogMessage(CUPSD_LOG_INFO,
-                      "<Limit Pause-Printer Resume-Printer "
-                      "Set-Printer-Attributes Enable-Printer "
-		      "Disable-Printer Pause-Printer-After-Current-Job "
-		      "Hold-New-Jobs Release-Held-New-Jobs "
-		      "Deactivate-Printer Activate-Printer Restart-Printer "
-		      "Shutdown-Printer Startup-Printer Promote-Job "
-		      "Schedule-Job-After Cancel-Jobs CUPS-Add-Printer "
-		      "CUPS-Delete-Printer CUPS-Add-Class CUPS-Delete-Class "
-		      "CUPS-Accept-Jobs CUPS-Reject-Jobs CUPS-Set-Default>");
-      cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
-      cupsdLogMessage(CUPSD_LOG_INFO, "AuthType Default");
-
-      po = cupsdAddPolicyOp(p, NULL, IPP_PAUSE_PRINTER);
-      po->order_type = CUPSD_AUTH_ALLOW;
-      po->type       = CUPSD_AUTH_DEFAULT;
-      po->level      = CUPSD_AUTH_USER;
-
-      cupsdAddName(po, "@SYSTEM");
-      cupsdLogMessage(CUPSD_LOG_INFO, "Require user @SYSTEM");
-
-      cupsdAddPolicyOp(p, po, IPP_RESUME_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_SET_PRINTER_ATTRIBUTES);
-      cupsdAddPolicyOp(p, po, IPP_ENABLE_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_DISABLE_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_PAUSE_PRINTER_AFTER_CURRENT_JOB);
-      cupsdAddPolicyOp(p, po, IPP_HOLD_NEW_JOBS);
-      cupsdAddPolicyOp(p, po, IPP_RELEASE_HELD_NEW_JOBS);
-      cupsdAddPolicyOp(p, po, IPP_DEACTIVATE_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_ACTIVATE_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_RESTART_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_SHUTDOWN_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_STARTUP_PRINTER);
-      cupsdAddPolicyOp(p, po, IPP_PROMOTE_JOB);
-      cupsdAddPolicyOp(p, po, IPP_SCHEDULE_JOB_AFTER);
-      cupsdAddPolicyOp(p, po, IPP_CANCEL_JOBS);
-      cupsdAddPolicyOp(p, po, CUPS_ADD_PRINTER);
-      cupsdAddPolicyOp(p, po, CUPS_DELETE_PRINTER);
-      cupsdAddPolicyOp(p, po, CUPS_ADD_CLASS);
-      cupsdAddPolicyOp(p, po, CUPS_DELETE_CLASS);
-      cupsdAddPolicyOp(p, po, CUPS_ACCEPT_JOBS);
-      cupsdAddPolicyOp(p, po, CUPS_REJECT_JOBS);
-      cupsdAddPolicyOp(p, po, CUPS_SET_DEFAULT);
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "<Limit All>");
-      cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
-
-      po = cupsdAddPolicyOp(p, NULL, IPP_ANY_OPERATION);
-      po->order_type = CUPSD_AUTH_ALLOW;
-
-      cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+	cupsdLogMessage(CUPSD_LOG_INFO, "JobPrivateAccess default");
+	cupsdAddString(&(p->job_access), "@OWNER");
+	cupsdAddString(&(p->job_access), "@SYSTEM");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "JobPrivateValues default");
+	cupsdAddString(&(p->job_attrs), "job-name");
+	cupsdAddString(&(p->job_attrs), "job-originating-host-name");
+	cupsdAddString(&(p->job_attrs), "job-originating-user-name");
+	cupsdAddString(&(p->job_attrs), "phone");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "SubscriptionPrivateAccess default");
+	cupsdAddString(&(p->sub_access), "@OWNER");
+	cupsdAddString(&(p->sub_access), "@SYSTEM");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "SubscriptionPrivateValues default");
+	cupsdAddString(&(p->job_attrs), "notify-events");
+	cupsdAddString(&(p->job_attrs), "notify-pull-method");
+	cupsdAddString(&(p->job_attrs), "notify-recipient-uri");
+	cupsdAddString(&(p->job_attrs), "notify-subscriber-user-name");
+	cupsdAddString(&(p->job_attrs), "notify-user-data");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit Create-Job Print-Job Print-URI Validate-Job>");
+	  po = cupsdAddPolicyOp(p, NULL, IPP_CREATE_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_PRINT_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_PRINT_URI);
+	  cupsdAddPolicyOp(p, po, IPP_VALIDATE_JOB);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job>");
+	  po = cupsdAddPolicyOp(p, NULL, IPP_SEND_DOCUMENT);
+	  cupsdAddPolicyOp(p, po, IPP_SEND_URI);
+	  cupsdAddPolicyOp(p, po, IPP_HOLD_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_RELEASE_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_RESTART_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_PURGE_JOBS);
+	  cupsdAddPolicyOp(p, po, IPP_SET_JOB_ATTRIBUTES);
+	  cupsdAddPolicyOp(p, po, IPP_CREATE_JOB_SUBSCRIPTION);
+	  cupsdAddPolicyOp(p, po, IPP_RENEW_SUBSCRIPTION);
+	  cupsdAddPolicyOp(p, po, IPP_CANCEL_SUBSCRIPTION);
+	  cupsdAddPolicyOp(p, po, IPP_GET_NOTIFICATIONS);
+	  cupsdAddPolicyOp(p, po, IPP_REPROCESS_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_CANCEL_CURRENT_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_SUSPEND_CURRENT_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_RESUME_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_CANCEL_MY_JOBS);
+	  cupsdAddPolicyOp(p, po, IPP_CLOSE_JOB);
+	  cupsdAddPolicyOp(p, po, CUPS_MOVE_JOB);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Require user @OWNER @SYSTEM");
+	  po->level = CUPSD_AUTH_USER;
+	  cupsdAddName(po, "@OWNER");
+	  cupsdAddName(po, "@SYSTEM");
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit CUPS-Authenticate-Job>");
+	  po = cupsdAddPolicyOp(p, NULL, CUPS_GET_DOCUMENT);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "AuthType Default");
+	  po->type = CUPSD_AUTH_DEFAULT;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Require user @OWNER @SYSTEM");
+	  po->level = CUPSD_AUTH_USER;
+	  cupsdAddName(po, "@OWNER");
+	  cupsdAddName(po, "@SYSTEM");
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit Pause-Printer Resume-Printer  Set-Printer-Attributes Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Add-Printer CUPS-Delete-Printer CUPS-Add-Class CUPS-Delete-Class CUPS-Accept-Jobs CUPS-Reject-Jobs CUPS-Set-Default>");
+	  po = cupsdAddPolicyOp(p, NULL, IPP_PAUSE_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_RESUME_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_SET_PRINTER_ATTRIBUTES);
+	  cupsdAddPolicyOp(p, po, IPP_ENABLE_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_DISABLE_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_PAUSE_PRINTER_AFTER_CURRENT_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_HOLD_NEW_JOBS);
+	  cupsdAddPolicyOp(p, po, IPP_RELEASE_HELD_NEW_JOBS);
+	  cupsdAddPolicyOp(p, po, IPP_DEACTIVATE_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_ACTIVATE_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_RESTART_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_SHUTDOWN_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_STARTUP_PRINTER);
+	  cupsdAddPolicyOp(p, po, IPP_PROMOTE_JOB);
+	  cupsdAddPolicyOp(p, po, IPP_SCHEDULE_JOB_AFTER);
+	  cupsdAddPolicyOp(p, po, IPP_CANCEL_JOBS);
+	  cupsdAddPolicyOp(p, po, CUPS_ADD_PRINTER);
+	  cupsdAddPolicyOp(p, po, CUPS_DELETE_PRINTER);
+	  cupsdAddPolicyOp(p, po, CUPS_ADD_CLASS);
+	  cupsdAddPolicyOp(p, po, CUPS_DELETE_CLASS);
+	  cupsdAddPolicyOp(p, po, CUPS_ACCEPT_JOBS);
+	  cupsdAddPolicyOp(p, po, CUPS_REJECT_JOBS);
+	  cupsdAddPolicyOp(p, po, CUPS_SET_DEFAULT);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "AuthType Default");
+	  po->type = CUPSD_AUTH_DEFAULT;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Require user @SYSTEM");
+	  po->level = CUPSD_AUTH_USER;
+	  cupsdAddName(po, "@SYSTEM");
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit Cancel-Job>");
+	  po = cupsdAddPolicyOp(p, NULL, IPP_CANCEL_JOB);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Require user @OWNER " CUPS_DEFAULT_PRINTOPERATOR_AUTH);
+	  po->level = CUPSD_AUTH_USER;
+	  cupsdAddName(po, "@OWNER");
+	  cupsdAddName(po, CUPS_DEFAULT_PRINTOPERATOR_AUTH);
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit CUPS-Authenticate-Job>");
+	  po = cupsdAddPolicyOp(p, NULL, CUPS_AUTHENTICATE_JOB);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "AuthType Default");
+	  po->type = CUPSD_AUTH_DEFAULT;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Require user @OWNER " CUPS_DEFAULT_PRINTOPERATOR_AUTH);
+	  po->level = CUPSD_AUTH_USER;
+	  cupsdAddName(po, "@OWNER");
+	  cupsdAddName(po, CUPS_DEFAULT_PRINTOPERATOR_AUTH);
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
+
+	cupsdLogMessage(CUPSD_LOG_INFO, "<Limit All>");
+	  po = cupsdAddPolicyOp(p, NULL, IPP_ANY_OPERATION);
+
+	  cupsdLogMessage(CUPSD_LOG_INFO, "Order Deny,Allow");
+	  po->order_type = CUPSD_AUTH_ALLOW;
+	cupsdLogMessage(CUPSD_LOG_INFO, "</Limit>");
       cupsdLogMessage(CUPSD_LOG_INFO, "</Policy>");
     }
   }