Skip to content

Commit 06bf607

Browse files
michaelrsweetmichaelrsweet
committed
Fix ippserver crash with a Create-System-Subscriptions request (Issue #310)
1 parent 3a95030 commit 06bf607

3 files changed

Lines changed: 71 additions & 62 deletions

File tree

‎server/auth.c‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/*
22
* Authentication code for sample IPP server implementation.
33
*
4-
* Copyright © 2018-2022 by the Printer Working Group
4+
* Copyright © 2018-2026 by the Printer Working Group
55
* Copyright © 2018 by Apple Inc.
66
*
77
* Licensed under Apache License v2.0. See the file "LICENSE" for more
@@ -223,7 +223,7 @@ serverAuthenticateClient(
223223
* 'serverAuthorizeUser()' - Authorize access for an authenticated user.
224224
*/
225225

226-
int /* O - 1 if authorized, 0 otherwise */
226+
bool /* O - `true` if authorized, `false` otherwise */
227227
serverAuthorizeUser(
228228
server_client_t *client, /* I - Client connection */
229229
const char *owner, /* I - Object owner or @code NULL@ if none/not applicable */
@@ -250,12 +250,12 @@ serverAuthorizeUser(
250250
if (!strcmp(scope, SERVER_SCOPE_ALL))
251251
{
252252
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" is authorized because scope is \"all\".", client->username);
253-
return (1);
253+
return (true);
254254
}
255255
else if (!strcmp(scope, SERVER_SCOPE_NONE))
256256
{
257257
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" not authorized because scope is \"none\".", client->username);
258-
return (0);
258+
return (false);
259259
}
260260

261261
/*
@@ -266,7 +266,7 @@ serverAuthorizeUser(
266266
if (!client->username[0])
267267
{
268268
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "No authenticated user name, not authorized.");
269-
return (0);
269+
return (false);
270270
}
271271

272272
/*
@@ -276,7 +276,7 @@ serverAuthorizeUser(
276276
if (owner && !strcmp(client->username, owner) && strcmp(scope, SERVER_SCOPE_ADMIN))
277277
{
278278
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" is authorized because they are the owner.", client->username);
279-
return (1);
279+
return (true);
280280
}
281281

282282
#ifdef _WIN32
@@ -286,7 +286,7 @@ serverAuthorizeUser(
286286

287287
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" is authorized because groups are currently not validated on Windows.", client->username);
288288

289-
return (1);
289+
return (true);
290290

291291
#else
292292
/*
@@ -296,7 +296,7 @@ serverAuthorizeUser(
296296
if ((pw = getpwnam(client->username)) == NULL)
297297
{
298298
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" does not have a local account.", client->username);
299-
return (0);
299+
return (false);
300300
}
301301

302302
/*
@@ -312,7 +312,7 @@ serverAuthorizeUser(
312312
# endif /* __APPLE__ */
313313
{
314314
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" not authorized because the group list could not be retrieved: %s", client->username, strerror(errno));
315-
return (0);
315+
return (false);
316316
}
317317

318318
if (group != SERVER_GROUP_NONE)
@@ -324,7 +324,7 @@ serverAuthorizeUser(
324324
if (i < ngroups)
325325
{
326326
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" is authorized because they are a group member.", client->username);
327-
return (1);
327+
return (true);
328328
}
329329
}
330330

@@ -356,12 +356,12 @@ serverAuthorizeUser(
356356
else
357357
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" is authorized because they are an operator.", client->username);
358358

359-
return (1);
359+
return (true);
360360
}
361361
else
362362
{
363363
serverLogClient(SERVER_LOGLEVEL_DEBUG, client, "User \"%s\" not authorized because they failed the group test.", client->username);
364-
return (0);
364+
return (false);
365365
}
366366
#endif /* _WIN32 */
367367
}

‎server/ipp.c‎

Lines changed: 58 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -2432,7 +2432,7 @@ ipp_create_job(server_client_t *client) /* I - Client */
24322432
return;
24332433
}
24342434

2435-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
2435+
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
24362436
{
24372437
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
24382438
return;
@@ -2974,20 +2974,23 @@ ipp_create_xxx_subscriptions(
29742974
ok_subs = 0; /* Number of good subscriptions */
29752975

29762976

2977-
if (Authentication && !client->username[0])
2977+
if (Authentication)
29782978
{
2979-
/*
2980-
* Require authenticated username...
2981-
*/
2979+
if (!client->username[0])
2980+
{
2981+
/*
2982+
* Require authenticated username...
2983+
*/
29822984

2983-
serverRespondHTTP(client, HTTP_STATUS_UNAUTHORIZED, NULL, NULL, 0);
2984-
return;
2985-
}
2985+
serverRespondHTTP(client, HTTP_STATUS_UNAUTHORIZED, NULL, NULL, 0);
2986+
return;
2987+
}
29862988

2987-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
2988-
{
2989-
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
2990-
return;
2989+
if (client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
2990+
{
2991+
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
2992+
return;
2993+
}
29912994
}
29922995

29932996
/*
@@ -4711,7 +4714,7 @@ ipp_get_printers(
47114714

47124715
cupsRWLockRead(&printer->rwlock);
47134716

4714-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
4717+
if (Authentication && printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
47154718
{
47164719
cupsRWUnlock(&printer->rwlock);
47174720
continue;
@@ -5025,25 +5028,28 @@ ipp_get_subscription_attributes(
50255028
*pa = NULL; /* Privacy attributes */
50265029

50275030

5028-
if (Authentication && !client->username[0])
5031+
if (Authentication)
50295032
{
5030-
/*
5031-
* Require authenticated username...
5032-
*/
5033+
if (!client->username[0])
5034+
{
5035+
/*
5036+
* Require authenticated username...
5037+
*/
50335038

5034-
serverRespondHTTP(client, HTTP_STATUS_UNAUTHORIZED, NULL, NULL, 0);
5035-
return;
5036-
}
5039+
serverRespondHTTP(client, HTTP_STATUS_UNAUTHORIZED, NULL, NULL, 0);
5040+
return;
5041+
}
50375042

5038-
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
5039-
{
5040-
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
5041-
return;
5042-
}
5043-
else if (Authentication && !client->printer && !serverAuthorizeUser(client, NULL, SERVER_GROUP_NONE, SERVER_SCOPE_DEFAULT))
5044-
{
5045-
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this system.");
5046-
return;
5043+
if (client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
5044+
{
5045+
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
5046+
return;
5047+
}
5048+
else if (!client->printer && !serverAuthorizeUser(client, NULL, SERVER_GROUP_NONE, SERVER_SCOPE_DEFAULT))
5049+
{
5050+
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this system.");
5051+
return;
5052+
}
50475053
}
50485054

50495055
ra = ippCreateRequestedArray(client->request);
@@ -5087,25 +5093,28 @@ ipp_get_subscriptions(
50875093
const char *username; /* Most authenticated user name */
50885094

50895095

5090-
if (Authentication && !client->username[0])
5096+
if (Authentication)
50915097
{
5092-
/*
5093-
* Require authenticated username...
5094-
*/
5098+
if (!client->username[0])
5099+
{
5100+
/*
5101+
* Require authenticated username...
5102+
*/
50955103

5096-
serverRespondHTTP(client, HTTP_STATUS_UNAUTHORIZED, NULL, NULL, 0);
5097-
return;
5098-
}
5104+
serverRespondHTTP(client, HTTP_STATUS_UNAUTHORIZED, NULL, NULL, 0);
5105+
return;
5106+
}
50995107

5100-
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
5101-
{
5102-
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
5103-
return;
5104-
}
5105-
else if (Authentication && !client->printer && !serverAuthorizeUser(client, NULL, SERVER_GROUP_NONE, SERVER_SCOPE_DEFAULT))
5106-
{
5107-
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this system.");
5108-
return;
5108+
if (client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
5109+
{
5110+
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
5111+
return;
5112+
}
5113+
else if (!client->printer && !serverAuthorizeUser(client, NULL, SERVER_GROUP_NONE, SERVER_SCOPE_DEFAULT))
5114+
{
5115+
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this system.");
5116+
return;
5117+
}
51095118
}
51105119

51115120
job_id = ippGetInteger(ippFindAttribute(client->request, "notify-job-id", IPP_TAG_INTEGER), 0);
@@ -5861,7 +5870,7 @@ ipp_print_job(server_client_t *client) /* I - Client */
58615870
return;
58625871
}
58635872

5864-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
5873+
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
58655874
{
58665875
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
58675876
return;
@@ -6043,7 +6052,7 @@ ipp_print_uri(server_client_t *client) /* I - Client */
60436052
return;
60446053
}
60456054

6046-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
6055+
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
60476056
{
60486057
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
60496058
return;
@@ -8659,7 +8668,7 @@ ipp_validate_document(
86598668
return;
86608669
}
86618670

8662-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
8671+
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
86638672
{
86648673
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
86658674
return;
@@ -8687,7 +8696,7 @@ ipp_validate_job(server_client_t *client) /* I - Client */
86878696
return;
86888697
}
86898698

8690-
if (Authentication && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
8699+
if (Authentication && client->printer && client->printer->pinfo.print_group != SERVER_GROUP_NONE && !serverAuthorizeUser(client, NULL, client->printer->pinfo.print_group, SERVER_SCOPE_DEFAULT))
86918700
{
86928701
serverRespondIPP(client, IPP_STATUS_ERROR_NOT_AUTHORIZED, "Not authorized to access this printer.");
86938702
return;

‎server/ippserver.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,7 @@ extern void serverAddResourceFile(server_resource_t *res, const char *filename,
669669
extern void serverAddStringsFileNoLock(server_printer_t *printer, const char *language, server_resource_t *resource);
670670
extern void serverAllocatePrinterResource(server_printer_t *printer, server_resource_t *resource);
671671
extern http_status_t serverAuthenticateClient(server_client_t *client);
672-
extern int serverAuthorizeUser(server_client_t *client, const char *owner, gid_t group, const char *scope);
672+
extern bool serverAuthorizeUser(server_client_t *client, const char *owner, gid_t group, const char *scope);
673673

674674
extern int serverCancelJob(server_job_t *job);
675675
extern void serverCheckJobs(server_printer_t *printer);

0 commit comments

Comments
 (0)