Repository navigation
cups: fix @ACL and @OWNER access checks in cupsdGetPrivateAttrs - #1814
Open
user-Param wants to merge 2 commits into
Open
user-Param wants to merge 2 commits into
user-Param wants to merge 2 commits into
Conversation
added 2 commits
November 12, 2026 11:27
Fix two access control bugs in cupsdGetPrivateAttrs(): 1. @acl: When the requester matches an ACL entry, the inner loop broke but control fell through to the end of the function, returning the private-attribute list (denying access) instead of NULL (granting access). Now returns NULL on match and continues to the next entry on non-match, preventing fall-through to the generic '@' case. 2. @owner: A non-owner who belongs to an OS group named OWNER could bypass the owner check because @owner reached the generic '@' group lookup branch. Now @acl, @owner, and @System are excluded from the generic '@' branch. Signed-off-by: user-Param <user-Param@users.noreply.github.com> Signed-off-by: melon tusk <paramjeetsingh.dev.mail@gmail.com>
When a printer has a quota but an empty allowed-user list, the bearer auth path at add_job() reached the comparison (name != NULL) == p->deny_users with name==NULL and deny_users==false, denying every OAuth user. Guard the comparison with cupsArrayCount(p->users) > 0, matching the non-bearer branch at line 3916. Fixes OpenPrinting#1795 Signed-off-by: melon tusk <paramjeetsingh.dev.mail@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1796
Fix two access control bugs in cupsdGetPrivateAttrs():
@acl: When the requester matches an ACL entry, the inner loop broke
but control fell through to the end of the function, returning the
private-attribute list (denying access) instead of NULL (granting
access). Now returns NULL on match and continues to the next entry
on non-match, preventing fall-through to the generic '@' case.
@owner: A non-owner who belongs to an OS group named OWNER could
bypass the owner check because @owner reached the generic '@' group
lookup branch. Now @acl, @owner, and @System are excluded from the
generic '@' branch.
Signed-off-by: user-Param user-Param@users.noreply.github.com