Subscription web interface incorrectly uses guest account

[michaelrsweet]

Version: 1.3-current
CUPS.org User: mike

Currently the "add" and "cancel" subscription functions on the web interface pass "guest" as the requesting-user-name when no user is logged on. We should not pass a username at all if we are not authenticated so that the policy can be configured.

[michaelrsweet]

CUPS.org User: mike

Fixed in Subversion repository.

[michaelrsweet]

"str2774.patch":

Index: cgi-bin/admin.c

--- cgi-bin/admin.c (revision 7434)
+++ cgi-bin/admin.c (working copy)
@@ -309,6 +309,16 @@
}

/*

• * Make sure we have a username...
• */

• if ((user = getenv("REMOTE_USER")) == NULL)
• {
• puts("Status: 401\n");
• exit(0);
• }

• /*
  • Validate the subscription name...
    */

@@ -352,9 +362,6 @@
ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri",
NULL, printer_uri);

• if ((user = getenv("REMOTE_USER")) == NULL)

- user = "guest";

ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
NULL, user);

@@ -1306,6 +1313,16 @@
}

/*

• * Require a username...
• */

• if ((user = getenv("REMOTE_USER")) == NULL)
• {
• puts("Status: 401\n");
• exit(0);
• }

• /*
  • Cancel the subscription...
    */

@@ -1316,9 +1333,6 @@
ippAddInteger(request, IPP_TAG_OPERATION, IPP_TAG_INTEGER,
"notify-subscription-id", id);

• if ((user = getenv("REMOTE_USER")) == NULL)

- user = "guest";

ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name",
NULL, user);