From: Gerald Carter <jerry@samba.org>
Date: Fri, 10 Dec 2004 21:08:34 +0000 (+0000)
Subject: r4134: check the setprinter(3) based on the access permissions on the handle and... 
X-Git-Tag: samba-misc-tags/initial-v3-0-unstable~5507
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=426634df9c221fbe4f48b4ff9d1b4b8426a581f7;p=thirdparty%2Fsamba.git

r4134: check the setprinter(3) based on the access permissions on the handle and avoid the call to print_access_chaeck()
---

diff --git a/source/rpc_server/srv_spoolss_nt.c b/source/rpc_server/srv_spoolss_nt.c
index 78b5fb61fac..9aa46d1a5a9 100644
--- a/source/rpc_server/srv_spoolss_nt.c
+++ b/source/rpc_server/srv_spoolss_nt.c
@@ -5860,6 +5860,17 @@ static WERROR update_printer_sec(POLICY_HND *handle, uint32 level,
 		result = WERR_BADFID;
 		goto done;
 	}
+	
+	/* Check the user has permissions to change the security
+	   descriptor.  By experimentation with two NT machines, the user
+	   requires Full Access to the printer to change security
+	   information. */
+
+	if ( Printer->access_granted != PRINTER_ACCESS_ADMINISTER ) {
+		DEBUG(4,("update_printer_sec: updated denied by printer permissions\n"));
+		result = WERR_ACCESS_DENIED;
+		goto done;
+	}
 
 	/* NT seems to like setting the security descriptor even though
 	   nothing may have actually changed. */
@@ -5909,20 +5920,6 @@ static WERROR update_printer_sec(POLICY_HND *handle, uint32 level,
 		goto done;
 	}
 
-	/* Work out which user is performing the operation */
-
-	get_current_user(&user, p);
-
-	/* Check the user has permissions to change the security
-	   descriptor.  By experimentation with two NT machines, the user
-	   requires Full Access to the printer to change security
-	   information. */
-
-	if (!print_access_check(&user, snum, PRINTER_ACCESS_ADMINISTER)) {
-		result = WERR_ACCESS_DENIED;
-		goto done;
-	}
-
 	result = nt_printing_setsec(Printer->sharename, new_secdesc_ctr);
 
  done: