One quick fix to prevent write access to the CUPS spool directory.

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@11943 a1ca3aef-8c08-0410-bb20-df032aa958be

diff --git a/scheduler/process.c b/scheduler/process.c
index b25ac5674ea8ef677960701c20ff681b16280676..a036dfa075a0501c72d8adaec63b2cffdea53843 100644 (file)
--- a/scheduler/process.c
+++ b/scheduler/process.c
@@ -290,6 +290,10 @@ cupsdCreateProfile(int job_id,             /* I - Job ID or 0 for none */
                   "))\n",
                   testroot);
   }
+  cupsFilePrintf(fp,
+                "(deny file-write* file-read-data file-read-metadata\n"
+                "       (regex #\"^%s$\" #\"^%s/\"))\n",
+                request, request);
   if (job_id)
   {
     /* Allow job filters to read the current job files... */