Fix: Satisfy all with multiple Require directives

- conf.c: Prevent level overwrite when multiple Require
  directives are used in same Location block
- auth.c: Implement AND logic for Satisfy all with
  multiple Require conditions instead of OR logic

Fixes #1304

diff --git a/scheduler/auth.c b/scheduler/auth.c
index f8787f563a8c6c086eeaada1fbfbb1a5a1f1068d..3cf111009fef4efd692247a3fe20216875040233 100644 (file)
--- a/scheduler/auth.c
+++ b/scheduler/auth.c
@@ -2000,40 +2000,64 @@ cupsdIsAuthorized(cupsd_client_t *con,  /* I - Connection */
       }
 #endif /* HAVE_AUTHORIZATION_H */
 
+      
+      int name_result = 0; // 0=not matched, 1=matched
+
+      
       for (name = (char *)cupsArrayFirst(best->names);
-          name;
-          name = (char *)cupsArrayNext(best->names))
+           name;
+           name = (char *)cupsArrayNext(best->names))
       {
-       if (!_cups_strcasecmp(name, "@OWNER") && owner &&
-           ((pw && !strcmp(pw->pw_name, ownername)) ||
-            (!pw && type == CUPSD_AUTH_NONE && !_cups_strcasecmp(username, ownername))))
-         return (HTTP_STATUS_OK);
-       else if (!_cups_strcasecmp(name, "@SYSTEM"))
-       {
-         /* Do @SYSTEM later, when every other entry fails */
-         continue;
-       }
-       else if (name[0] == '@')
-       {
-         if (cupsdCheckGroup(username, pw, name + 1))
-           return (HTTP_STATUS_OK);
-       }
-       else if (pw && !strcmp(pw->pw_name, name))
-         return (HTTP_STATUS_OK);
-       else if (!pw && type == CUPSD_AUTH_NONE && !_cups_strcasecmp(username, name))
-         return (HTTP_STATUS_OK);
+        if (!_cups_strcasecmp(name, "@SYSTEM"))
+          continue; // baad mein check hoga
+
+        if (!_cups_strcasecmp(name, "@OWNER") && owner &&
+            ((pw && !strcmp(pw->pw_name, ownername)) ||
+             (!pw && type == CUPSD_AUTH_NONE && !_cups_strcasecmp(username, ownername))))
+        {
+          name_result = 1;
+        }
+        else if (name[0] == '@')
+        {
+          if (cupsdCheckGroup(username, pw, name + 1))
+            name_result = 1;
+        }
+        else if (pw && !strcmp(pw->pw_name, name))
+          name_result = 1;
+        else if (!pw && type == CUPSD_AUTH_NONE && !_cups_strcasecmp(username, name))
+          name_result = 1;
       }
 
+      // @SYSTEM check
       for (name = (char *)cupsArrayFirst(best->names);
-          name;
-          name = (char *)cupsArrayNext(best->names))
+           name;
+           name = (char *)cupsArrayNext(best->names))
       {
-       if (!_cups_strcasecmp(name, "@SYSTEM"))
-       {
-         for (i = 0; i < NumSystemGroups; i ++)
-           if (cupsdCheckGroup(username, pw, SystemGroups[i]) && check_admin_access(con))
-             return (HTTP_STATUS_OK);
-       }
+        if (!_cups_strcasecmp(name, "@SYSTEM"))
+        {
+          for (i = 0; i < NumSystemGroups; i ++)
+          {
+            if (cupsdCheckGroup(username, pw, SystemGroups[i]) && check_admin_access(con))
+            {
+              name_result = 1;
+              break;
+            }
+          }
+        }
+      }
+
+      
+      if (best->satisfy == CUPSD_AUTH_SATISFY_ALL)
+      {
+        if (name_result)
+          return (HTTP_STATUS_OK);
+        else
+          return (HTTP_STATUS_FORBIDDEN);
+      }
+      else
+      {
+        if (name_result)
+          return (HTTP_STATUS_OK);
       }
     }
     else

diff --git a/scheduler/conf.c b/scheduler/conf.c
index e55afdbd7ef13778cfed3ac48a23e44cdc86c123..cc00742cba05894efbfe6ca8f719f20597baa9be 100644 (file)
--- a/scheduler/conf.c
+++ b/scheduler/conf.c
@@ -2453,9 +2453,17 @@ parse_aaa(cupsd_location_t *loc, /* I - Location */
 
     if (!_cups_strcasecmp(value, "valid-user") ||
         !_cups_strcasecmp(value, "user"))
-      loc->level = CUPSD_AUTH_USER;
+    {
+      // Only set level if not already set to USER
+      if (loc->level == CUPSD_AUTH_ANON)
+        loc->level = CUPSD_AUTH_USER;
+    }
     else if (!_cups_strcasecmp(value, "group"))
-      loc->level = CUPSD_AUTH_GROUP;
+    {
+      // Only upgrade to GROUP if no USER level set yet
+      if (loc->level == CUPSD_AUTH_ANON)
+        loc->level = CUPSD_AUTH_GROUP;
+    }
     else
     {
       cupsdLogMessage(CUPSD_LOG_WARN, "Unknown Require type %s on line %d of %s.",