Change print_access_check to take auth_serversupplied_info instead of current_user

Reason: This is the main user of p->current_user which I would like to remove

diff --git a/source/include/proto.h b/source/include/proto.h
index 6525b838f163d395465d745cbad033b01a5af93c..602e2646fd3a314c4a9c4649e9cd4946a993a3ec 100644 (file)
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -6691,7 +6691,8 @@ WERROR nt_printing_setsec(const char *sharename, SEC_DESC_BUF *secdesc_ctr);
 bool nt_printing_getsec(TALLOC_CTX *ctx, const char *sharename, SEC_DESC_BUF **secdesc_ctr);
 void map_printer_permissions(SEC_DESC *sd);
 void map_job_permissions(SEC_DESC *sd);
-bool print_access_check(struct current_user *user, int snum, int access_type);
+bool print_access_check(struct auth_serversupplied_info *server_info, int snum,
+                       int access_type);
 bool print_time_access_check(const char *servicename);
 char* get_server_name( Printer_entry *printer );
 
@@ -6747,20 +6748,27 @@ char *print_job_fname(const char* sharename, uint32 jobid);
 NT_DEVICEMODE *print_job_devmode(const char* sharename, uint32 jobid);
 bool print_job_set_place(const char *sharename, uint32 jobid, int place);
 bool print_job_set_name(const char *sharename, uint32 jobid, char *name);
-bool print_job_delete(struct current_user *user, int snum, uint32 jobid, WERROR *errcode);
-bool print_job_pause(struct current_user *user, int snum, uint32 jobid, WERROR *errcode);
-bool print_job_resume(struct current_user *user, int snum, uint32 jobid, WERROR *errcode);
+bool print_job_delete(struct auth_serversupplied_info *server_info, int snum,
+                     uint32 jobid, WERROR *errcode);
+bool print_job_pause(struct auth_serversupplied_info *server_info, int snum,
+                    uint32 jobid, WERROR *errcode);
+bool print_job_resume(struct auth_serversupplied_info *server_info, int snum,
+                     uint32 jobid, WERROR *errcode);
 ssize_t print_job_write(int snum, uint32 jobid, const char *buf, SMB_OFF_T pos, size_t size);
 int print_queue_length(int snum, print_status_struct *pstatus);
-uint32 print_job_start(struct current_user *user, int snum, char *jobname, NT_DEVICEMODE *nt_devmode );
+uint32 print_job_start(struct auth_serversupplied_info *server_info, int snum,
+                      char *jobname, NT_DEVICEMODE *nt_devmode );
 void print_job_endpage(int snum, uint32 jobid);
 bool print_job_end(int snum, uint32 jobid, enum file_close_type close_type);
 int print_queue_status(int snum, 
                       print_queue_struct **ppqueue,
                       print_status_struct *status);
-bool print_queue_pause(struct current_user *user, int snum, WERROR *errcode);
-bool print_queue_resume(struct current_user *user, int snum, WERROR *errcode);
-bool print_queue_purge(struct current_user *user, int snum, WERROR *errcode);
+bool print_queue_pause(struct auth_serversupplied_info *server_info, int snum,
+                      WERROR *errcode);
+bool print_queue_resume(struct auth_serversupplied_info *server_info, int snum,
+                       WERROR *errcode);
+bool print_queue_purge(struct auth_serversupplied_info *server_info, int snum,
+                      WERROR *errcode);
 
 /* The following definitions come from printing/printing_db.c  */
 

diff --git a/source/printing/nt_printing.c b/source/printing/nt_printing.c
index c13ab5a1809b20011e54a4798db044eeeb3ce37e..68d4a2ffd614c45c0ee3f4a5763397b8911a7bbb 100644 (file)
--- a/source/printing/nt_printing.c
+++ b/source/printing/nt_printing.c
@@ -5763,7 +5763,8 @@ void map_job_permissions(SEC_DESC *sd)
     3)  "printer admins" (may result in numerous calls to winbind)
 
  ****************************************************************************/
-bool print_access_check(struct current_user *user, int snum, int access_type)
+bool print_access_check(struct auth_serversupplied_info *server_info, int snum,
+                       int access_type)
 {
        SEC_DESC_BUF *secdesc = NULL;
        uint32 access_granted;
@@ -5775,12 +5776,10 @@ bool print_access_check(struct current_user *user, int snum, int access_type)
        
        /* If user is NULL then use the current_user structure */
 
-       if (!user)
-               user = &current_user;
-
        /* Always allow root or SE_PRINT_OPERATROR to do anything */
 
-       if ( user->ut.uid == 0 || user_has_privileges(user->nt_user_token, &se_printop ) ) {
+       if (server_info->utok.uid == 0
+           || user_has_privileges(server_info->ptok, &se_printop ) ) {
                return True;
        }
 
@@ -5827,7 +5826,7 @@ bool print_access_check(struct current_user *user, int snum, int access_type)
        }
 
        /* Check access */
-       result = se_access_check(secdesc->sd, user->nt_user_token, access_type,
+       result = se_access_check(secdesc->sd, server_info->ptok, access_type,
                                 &access_granted, &status);
 
        DEBUG(4, ("access check was %s\n", result ? "SUCCESS" : "FAILURE"));
@@ -5835,8 +5834,8 @@ bool print_access_check(struct current_user *user, int snum, int access_type)
         /* see if we need to try the printer admin list */
 
         if ((access_granted == 0) &&
-           (token_contains_name_in_list(uidtoname(user->ut.uid), NULL, NULL,
-                                        user->nt_user_token,
+           (token_contains_name_in_list(uidtoname(server_info->utok.uid),
+                                        NULL, NULL, server_info->ptok,
                                         lp_printer_admin(snum)))) {
                talloc_destroy(mem_ctx);
                return True;

diff --git a/source/printing/printfsp.c b/source/printing/printfsp.c
index 1fde16b802d79040876246cd542b308dbc9c37f2..4a2b26d2cd2f7a05b5ed607129139951c6a48804 100644 (file)
--- a/source/printing/printfsp.c
+++ b/source/printing/printfsp.c
@@ -51,7 +51,7 @@ NTSTATUS print_fsp_open(connection_struct *conn, const char *fname,
                fstrcat(name, p);
        }
 
-       jobid = print_job_start(&current_user, SNUM(conn), name, NULL);
+       jobid = print_job_start(conn->server_info, SNUM(conn), name, NULL);
        if (jobid == -1) {
                status = map_nt_error_from_unix(errno);
                file_free(fsp);

diff --git a/source/printing/printing.c b/source/printing/printing.c
index aa67f08d821b0a65181917af8876cb14081bbb60..a425b87907f60ce9ce05581ec43dd7868dd56ccb 100644 (file)
--- a/source/printing/printing.c
+++ b/source/printing/printing.c
@@ -1979,28 +1979,24 @@ static bool print_job_delete1(int snum, uint32 jobid)
  Return true if the current user owns the print job.
 ****************************************************************************/
 
-static bool is_owner(struct current_user *user, const char *servicename,
+static bool is_owner(struct auth_serversupplied_info *server_info,
+                    const char *servicename,
                     uint32 jobid)
 {
        struct printjob *pjob = print_job_find(servicename, jobid);
-       user_struct *vuser;
 
-       if (!pjob || !user)
+       if (!pjob || !server_info)
                return False;
 
-       if ((vuser = get_valid_user_struct(user->vuid)) != NULL) {
-               return strequal(pjob->user,
-                               vuser->server_info->sanitized_username);
-       } else {
-               return strequal(pjob->user, uidtoname(user->ut.uid));
-       }
+       return strequal(pjob->user, server_info->sanitized_username);
 }
 
 /****************************************************************************
  Delete a print job.
 ****************************************************************************/
 
-bool print_job_delete(struct current_user *user, int snum, uint32 jobid, WERROR *errcode)
+bool print_job_delete(struct auth_serversupplied_info *server_info, int snum,
+                     uint32 jobid, WERROR *errcode)
 {
        const char* sharename = lp_const_servicename( snum );
        struct printjob *pjob;
@@ -2009,13 +2005,13 @@ bool print_job_delete(struct current_user *user, int snum, uint32 jobid, WERROR
 
        *errcode = WERR_OK;
                
-       owner = is_owner(user, lp_const_servicename(snum), jobid);
+       owner = is_owner(server_info, lp_const_servicename(snum), jobid);
        
        /* Check access against security descriptor or whether the user
           owns their job. */
 
        if (!owner && 
-           !print_access_check(user, snum, JOB_ACCESS_ADMINISTER)) {
+           !print_access_check(server_info, snum, JOB_ACCESS_ADMINISTER)) {
                DEBUG(3, ("delete denied by security descriptor\n"));
                *errcode = WERR_ACCESS_DENIED;
 
@@ -2023,7 +2019,8 @@ bool print_job_delete(struct current_user *user, int snum, uint32 jobid, WERROR
                sys_adminlog( LOG_ERR, 
                              "Permission denied-- user not allowed to delete, \
 pause, or resume print job. User name: %s. Printer name: %s.",
-                             uidtoname(user->ut.uid), PRINTERNAME(snum) );
+                             uidtoname(server_info->utok.uid),
+                             PRINTERNAME(snum) );
                /* END_ADMIN_LOG */
 
                return False;
@@ -2067,7 +2064,8 @@ pause, or resume print job. User name: %s. Printer name: %s.",
  Pause a job.
 ****************************************************************************/
 
-bool print_job_pause(struct current_user *user, int snum, uint32 jobid, WERROR *errcode)
+bool print_job_pause(struct auth_serversupplied_info *server_info, int snum,
+                    uint32 jobid, WERROR *errcode)
 {
        const char* sharename = lp_const_servicename(snum);
        struct printjob *pjob;
@@ -2076,7 +2074,7 @@ bool print_job_pause(struct current_user *user, int snum, uint32 jobid, WERROR *
 
        pjob = print_job_find(sharename, jobid);
        
-       if (!pjob || !user) {
+       if (!pjob || !server_info) {
                DEBUG(10, ("print_job_pause: no pjob or user for jobid %u\n",
                        (unsigned int)jobid ));
                return False;
@@ -2088,15 +2086,16 @@ bool print_job_pause(struct current_user *user, int snum, uint32 jobid, WERROR *
                return False;
        }
 
-       if (!is_owner(user, lp_const_servicename(snum), jobid) &&
-           !print_access_check(user, snum, JOB_ACCESS_ADMINISTER)) {
+       if (!is_owner(server_info, lp_const_servicename(snum), jobid) &&
+           !print_access_check(server_info, snum, JOB_ACCESS_ADMINISTER)) {
                DEBUG(3, ("pause denied by security descriptor\n"));
 
                /* BEGIN_ADMIN_LOG */
                sys_adminlog( LOG_ERR, 
                        "Permission denied-- user not allowed to delete, \
 pause, or resume print job. User name: %s. Printer name: %s.",
-                               uidtoname(user->ut.uid), PRINTERNAME(snum) );
+                             uidtoname(server_info->utok.uid),
+                             PRINTERNAME(snum) );
                /* END_ADMIN_LOG */
 
                *errcode = WERR_ACCESS_DENIED;
@@ -2127,7 +2126,8 @@ pause, or resume print job. User name: %s. Printer name: %s.",
  Resume a job.
 ****************************************************************************/
 
-bool print_job_resume(struct current_user *user, int snum, uint32 jobid, WERROR *errcode)
+bool print_job_resume(struct auth_serversupplied_info *server_info, int snum,
+                     uint32 jobid, WERROR *errcode)
 {
        const char *sharename = lp_const_servicename(snum);
        struct printjob *pjob;
@@ -2135,8 +2135,8 @@ bool print_job_resume(struct current_user *user, int snum, uint32 jobid, WERROR
        struct printif *current_printif = get_printer_fns( snum );
 
        pjob = print_job_find(sharename, jobid);
-       
-       if (!pjob || !user) {
+
+       if (!pjob || !server_info) {
                DEBUG(10, ("print_job_resume: no pjob or user for jobid %u\n",
                        (unsigned int)jobid ));
                return False;
@@ -2148,8 +2148,8 @@ bool print_job_resume(struct current_user *user, int snum, uint32 jobid, WERROR
                return False;
        }
 
-       if (!is_owner(user, lp_const_servicename(snum), jobid) &&
-           !print_access_check(user, snum, JOB_ACCESS_ADMINISTER)) {
+       if (!is_owner(server_info, lp_const_servicename(snum), jobid) &&
+           !print_access_check(server_info, snum, JOB_ACCESS_ADMINISTER)) {
                DEBUG(3, ("resume denied by security descriptor\n"));
                *errcode = WERR_ACCESS_DENIED;
 
@@ -2157,7 +2157,8 @@ bool print_job_resume(struct current_user *user, int snum, uint32 jobid, WERROR
                sys_adminlog( LOG_ERR, 
                         "Permission denied-- user not allowed to delete, \
 pause, or resume print job. User name: %s. Printer name: %s.",
-                       uidtoname(user->ut.uid), PRINTERNAME(snum) );
+                             uidtoname(server_info->utok.uid),
+                             PRINTERNAME(snum) );
                /* END_ADMIN_LOG */
                return False;
        }
@@ -2357,12 +2358,12 @@ static bool add_to_jobs_changed(struct tdb_print_db *pdb, uint32 jobid)
  Start spooling a job - return the jobid.
 ***************************************************************************/
 
-uint32 print_job_start(struct current_user *user, int snum, char *jobname, NT_DEVICEMODE *nt_devmode )
+uint32 print_job_start(struct auth_serversupplied_info *server_info, int snum,
+                      char *jobname, NT_DEVICEMODE *nt_devmode )
 {
        uint32 jobid;
        char *path;
        struct printjob pjob;
-       user_struct *vuser;
        const char *sharename = lp_const_servicename(snum);
        struct tdb_print_db *pdb = get_print_db_byname(sharename);
        int njobs;
@@ -2372,7 +2373,7 @@ uint32 print_job_start(struct current_user *user, int snum, char *jobname, NT_DE
        if (!pdb)
                return (uint32)-1;
 
-       if (!print_access_check(user, snum, PRINTER_ACCESS_USE)) {
+       if (!print_access_check(server_info, snum, PRINTER_ACCESS_USE)) {
                DEBUG(3, ("print_job_start: job start denied by security descriptor\n"));
                release_print_db(pdb);
                return (uint32)-1;
@@ -2437,17 +2438,12 @@ uint32 print_job_start(struct current_user *user, int snum, char *jobname, NT_DE
        
        fstrcpy(pjob.jobname, jobname);
 
-       if ((vuser = get_valid_user_struct(user->vuid)) != NULL) {
-               fstrcpy(pjob.user, lp_printjob_username(snum));
-               standard_sub_basic(
-                       vuser->server_info->sanitized_username,
-                       pdb_get_domain(vuser->server_info->sam_account),
-                       pjob.user, sizeof(pjob.user)-1);
-               /* ensure NULL termination */ 
-               pjob.user[sizeof(pjob.user)-1] = '\0'; 
-       } else {
-               fstrcpy(pjob.user, uidtoname(user->ut.uid));
-       }
+       fstrcpy(pjob.user, lp_printjob_username(snum));
+       standard_sub_basic(server_info->sanitized_username,
+                          pdb_get_domain(server_info->sam_account),
+                          pjob.user, sizeof(pjob.user)-1);
+       /* ensure NULL termination */
+       pjob.user[sizeof(pjob.user)-1] = '\0';
 
        fstrcpy(pjob.queuename, lp_const_servicename(snum));
 
@@ -2775,12 +2771,14 @@ int print_queue_status(int snum,
  Pause a queue.
 ****************************************************************************/
 
-bool print_queue_pause(struct current_user *user, int snum, WERROR *errcode)
+bool print_queue_pause(struct auth_serversupplied_info *server_info, int snum,
+                      WERROR *errcode)
 {
        int ret;
        struct printif *current_printif = get_printer_fns( snum );
        
-       if (!print_access_check(user, snum, PRINTER_ACCESS_ADMINISTER)) {
+       if (!print_access_check(server_info, snum,
+                               PRINTER_ACCESS_ADMINISTER)) {
                *errcode = WERR_ACCESS_DENIED;
                return False;
        }
@@ -2811,12 +2809,14 @@ bool print_queue_pause(struct current_user *user, int snum, WERROR *errcode)
  Resume a queue.
 ****************************************************************************/
 
-bool print_queue_resume(struct current_user *user, int snum, WERROR *errcode)
+bool print_queue_resume(struct auth_serversupplied_info *server_info, int snum,
+                       WERROR *errcode)
 {
        int ret;
        struct printif *current_printif = get_printer_fns( snum );
 
-       if (!print_access_check(user, snum, PRINTER_ACCESS_ADMINISTER)) {
+       if (!print_access_check(server_info, snum,
+                               PRINTER_ACCESS_ADMINISTER)) {
                *errcode = WERR_ACCESS_DENIED;
                return False;
        }
@@ -2847,7 +2847,8 @@ bool print_queue_resume(struct current_user *user, int snum, WERROR *errcode)
  Purge a queue - implemented by deleting all jobs that we can delete.
 ****************************************************************************/
 
-bool print_queue_purge(struct current_user *user, int snum, WERROR *errcode)
+bool print_queue_purge(struct auth_serversupplied_info *server_info, int snum,
+                      WERROR *errcode)
 {
        print_queue_struct *queue;
        print_status_struct status;
@@ -2857,14 +2858,16 @@ bool print_queue_purge(struct current_user *user, int snum, WERROR *errcode)
        /* Force and update so the count is accurate (i.e. not a cached count) */
        print_queue_update(snum, True);
        
-       can_job_admin = print_access_check(user, snum, JOB_ACCESS_ADMINISTER);
+       can_job_admin = print_access_check(server_info, snum,
+                                          JOB_ACCESS_ADMINISTER);
        njobs = print_queue_status(snum, &queue, &status);
        
        if ( can_job_admin )
                become_root();
 
        for (i=0;i<njobs;i++) {
-               bool owner = is_owner(user, lp_const_servicename(snum), queue[i].job);
+               bool owner = is_owner(server_info, lp_const_servicename(snum),
+                                     queue[i].job);
 
                if (owner || can_job_admin) {
                        print_job_delete1(snum, queue[i].job);

diff --git a/source/rpc_server/srv_spoolss_nt.c b/source/rpc_server/srv_spoolss_nt.c
index eaf563eaa9301e6dd52d8f3df35392fa45cddd8f..d58b16c206c4deb2bd84fdca4411f322dd34e275 100644 (file)
--- a/source/rpc_server/srv_spoolss_nt.c
+++ b/source/rpc_server/srv_spoolss_nt.c
@@ -1706,7 +1706,7 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
 
                if (!user_ok_token(uidtoname(p->pipe_user.ut.uid), NULL,
                                   p->pipe_user.nt_user_token, snum) ||
-                   !print_access_check(&p->pipe_user, snum,
+                   !print_access_check(p->server_info, snum,
                                        printer_default->access_required)) {
                        DEBUG(3, ("access DENIED for printer open\n"));
                        close_printer_handle(p, handle);
@@ -5863,7 +5863,8 @@ WERROR _spoolss_startdocprinter(pipes_struct *p, SPOOL_Q_STARTDOCPRINTER *q_u, S
 
        jobname = unistr2_to_ascii_talloc(ctx, &info_1->docname);
 
-       Printer->jobid = print_job_start(&p->pipe_user, snum, jobname, Printer->nt_devmode);
+       Printer->jobid = print_job_start(p->server_info, snum, jobname,
+                                        Printer->nt_devmode);
 
        /* An error occured in print_job_start() so return an appropriate
           NT error code. */
@@ -5950,18 +5951,18 @@ static WERROR control_printer(POLICY_HND *handle, uint32 command,
 
        switch (command) {
        case PRINTER_CONTROL_PAUSE:
-               if (print_queue_pause(&p->pipe_user, snum, &errcode)) {
+               if (print_queue_pause(p->server_info, snum, &errcode)) {
                        errcode = WERR_OK;
                }
                break;
        case PRINTER_CONTROL_RESUME:
        case PRINTER_CONTROL_UNPAUSE:
-               if (print_queue_resume(&p->pipe_user, snum, &errcode)) {
+               if (print_queue_resume(p->server_info, snum, &errcode)) {
                        errcode = WERR_OK;
                }
                break;
        case PRINTER_CONTROL_PURGE:
-               if (print_queue_purge(&p->pipe_user, snum, &errcode)) {
+               if (print_queue_purge(p->server_info, snum, &errcode)) {
                        errcode = WERR_OK;
                }
                break;
@@ -5993,7 +5994,7 @@ WERROR _spoolss_abortprinter(pipes_struct *p, SPOOL_Q_ABORTPRINTER *q_u, SPOOL_R
        if (!get_printer_snum(p, handle, &snum, NULL))
                return WERR_BADFID;
 
-       print_job_delete( &p->pipe_user, snum, Printer->jobid, &errcode );
+       print_job_delete(p->server_info, snum, Printer->jobid, &errcode );
 
        return errcode;
 }
@@ -6886,18 +6887,18 @@ WERROR _spoolss_setjob(pipes_struct *p, SPOOL_Q_SETJOB *q_u, SPOOL_R_SETJOB *r_u
        switch (command) {
        case JOB_CONTROL_CANCEL:
        case JOB_CONTROL_DELETE:
-               if (print_job_delete(&p->pipe_user, snum, jobid, &errcode)) {
+               if (print_job_delete(p->server_info, snum, jobid, &errcode)) {
                        errcode = WERR_OK;
                }
                break;
        case JOB_CONTROL_PAUSE:
-               if (print_job_pause(&p->pipe_user, snum, jobid, &errcode)) {
+               if (print_job_pause(p->server_info, snum, jobid, &errcode)) {
                        errcode = WERR_OK;
                }
                break;
        case JOB_CONTROL_RESTART:
        case JOB_CONTROL_RESUME:
-               if (print_job_resume(&p->pipe_user, snum, jobid, &errcode)) {
+               if (print_job_resume(p->server_info, snum, jobid, &errcode)) {
                        errcode = WERR_OK;
                }
                break;

diff --git a/source/smbd/lanman.c b/source/smbd/lanman.c
index 226e0d578966e115145649a1271e2ec6a9e1c8cf..29703ffd1e03a45f1679208ef6bdc6fdf74bc7a7 100644 (file)
--- a/source/smbd/lanman.c
+++ b/source/smbd/lanman.c
@@ -2682,15 +2682,15 @@ static bool api_RDosPrintJobDel(connection_struct *conn,uint16 vuid,
        
        switch (function) {
        case 81:                /* delete */ 
-               if (print_job_delete(&current_user, snum, jobid, &werr)) 
+               if (print_job_delete(conn->server_info, snum, jobid, &werr))
                        errcode = NERR_Success;
                break;
        case 82:                /* pause */
-               if (print_job_pause(&current_user, snum, jobid, &werr)) 
+               if (print_job_pause(conn->server_info, snum, jobid, &werr))
                        errcode = NERR_Success;
                break;
        case 83:                /* resume */
-               if (print_job_resume(&current_user, snum, jobid, &werr)) 
+               if (print_job_resume(conn->server_info, snum, jobid, &werr))
                        errcode = NERR_Success;
                break;
        }
@@ -2751,13 +2751,19 @@ static bool api_WPrintQueueCtrl(connection_struct *conn,uint16 vuid,
 
        switch (function) {
        case 74: /* Pause queue */
-               if (print_queue_pause(&current_user, snum, &werr)) errcode = NERR_Success;
+               if (print_queue_pause(conn->server_info, snum, &werr)) {
+                       errcode = NERR_Success;
+               }
                break;
        case 75: /* Resume queue */
-               if (print_queue_resume(&current_user, snum, &werr)) errcode = NERR_Success;
+               if (print_queue_resume(conn->server_info, snum, &werr)) {
+                       errcode = NERR_Success;
+               }
                break;
        case 103: /* Purge */
-               if (print_queue_purge(&current_user, snum, &werr)) errcode = NERR_Success;
+               if (print_queue_purge(conn->server_info, snum, &werr)) {
+                       errcode = NERR_Success;
+               }
                break;
        }