Remove variable expansion for BSD printers. Fixes CVE-2008-5718.

diff --git a/NEWS b/NEWS
index f3565dc6b452b2ff597c38f323dd41e2995f4e66..a43fbf753110043921cf73fbce4a0e7fab1c3710 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,8 @@
+Changes in 2.0.5
+================
+
+* FIX: papd: Remove variable expansion for BSD printers. Fixes CVE-2008-5718.
+
 Changes in 2.0.4
 ================
 

diff --git a/VERSION b/VERSION
index 2165f8f9b6a830a9d8dd3d2857d7fb86eba1d250..4e99eddec2623ff8832a613900136d936140e6f5 100644 (file)
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.0.4
+2.0.5dev

diff --git a/etc/papd/lp.c b/etc/papd/lp.c
index e36ba415ed8afb924b9461f27ac25f15169df184..daa920040bb8cffa737dbe645c47ac2c4c65fc91 100644 (file)
--- a/etc/papd/lp.c
+++ b/etc/papd/lp.c
@@ -1,5 +1,5 @@
 /*
- * $Id: lp.c,v 1.14.8.4.2.8 2009-02-04 22:33:11 didg Exp $
+ * $Id: lp.c,v 1.14.8.4.2.9 2009-07-20 09:03:54 franklahm Exp $
  *
  * Copyright (c) 1990,1994 Regents of The University of Michigan.
  * All Rights Reserved.  See COPYRIGHT.
@@ -586,9 +586,9 @@ int lp_open( out, sat )
        }
 
        lp_setup_comments(CH_UNIX);
-       pipe_cmd = pipexlate(printer->p_printer);
+       pipe_cmd = printer->p_printer;
        if (!pipe_cmd) {
-           LOG(log_error, logtype_papd, "lp_open: can't generate pipe cmd" );
+           LOG(log_error, logtype_papd, "lp_open: no pipe cmd" );
            spoolerror( out, NULL );
            return( -1 );
        }

diff --git a/man/man5/papd.conf.5.tmpl b/man/man5/papd.conf.5.tmpl
index d707eaa8a9e7c73c857b5bd43fbadd52762fb1f6..b282537559d3126da9f5f49e812d5363e976974b 100644 (file)
--- a/man/man5/papd.conf.5.tmpl
+++ b/man/man5/papd.conf.5.tmpl
@@ -43,7 +43,7 @@ printername may be just a name (\fBPrinter 1\fR), or it may be a full name in nb
 Systems using a BSD printing system should make use of a pipe to the printing command in question within the
 \fBpr\fR
 option (eg\&.
-\fBpr=|/usr/bin/lpr \-J%J \-u%U\fR)\&. Note: When printing using a pipe, papd recognizes several wildcards: %F will be replaced by the name present in the "%%For:" comment in the PostScript stream, same with %J for the "%%Title:" comment\&. %U will be substituted with the login name (the latter applies only when authenticated printing is in effect)\&.
+\fBpr=|/usr/bin/lpr)\&.
 .PP
 When CUPS support is compiled in, then
 \fBcupsautoadd \fR
@@ -148,39 +148,26 @@ HP Printer:\e
 .\}
 
 .PP
-An alternative to the technique outlined above is to direct papd\'s output via a pipe into another program\&. Using this mechanism almost all printing systems can be driven\&. Netatalk supplies three "wildcards" that get substituted with values of the already printed job:
-\fB%F\fR,
-\fB%U\fR
-and
-\fB%J\fR\&. Using these wildcards, one can pass those parameters directly to programs or implement small wrapper scripts to call the printing system in question\&.
+An alternative to the technique outlined above is to direct papd\'s output via a pipe into another program\&. Using this mechanism almost all printing systems can be driven\&.
 .PP
 \fBExample.\ \&papd.conf examples using pipes\fR
 .PP
 The first spooler is known as HP 8100\&. It pipes the print job to
 \fB/usr/bin/lpr\fR
-for printing using the value of the
-\fI%%Title: \fR
-comment as job name\&. PSSP authenticated printing is enabled, as is CAP\-style authenticated printing\&. Both methods support guest and cleartext authentication as specified by the \'\fBam\fR\' option\&. The PPD used is
-/etc/atalk/ppds/hp8100\&.ppd\&. The second spooler is called "Dump PostScript" and uses a pipe to
-\fBcat\fR
-to send the raw PostScript code into the user\'s home directory into a file called like the printjob\&.
+for printing.
+PSSP authenticated printing is enabled, as is CAP\-style authenticated printing\&. Both methods support guest and cleartext authentication as specified by the \'\fBam\fR\' option\&. The PPD used is
+/etc/atalk/ppds/hp8100\&.ppd\&.
 .sp
 .if n \{\
 .RS 4
 .\}
 .nf
 HP 8100:\e
-   :pr=|/usr/bin/lpr \-Plp \-J"%J":\e
+   :pr=|/usr/bin/lpr \-Plp:\e
    :sp:\e
    :ca=/tmp/print:\e
    :am=uams_guest\&.so,uams_pam\&.so:\e
    :pd=/etc/atalk/ppds/hp8100\&.ppd:
-
-Dump PostScript:LaserWriter@Server:\e
-   :pr=|cat >/home/%U/%J\-prn\&.out:\e
-   :pd=/usr/share/lib/ppd/mooralana\&.ppd:\e
-   :sp:au:op=lp:\e
-   :am=uams_clrtxt\&.so:
 .fi
 .if n \{\
 .RE