cupsctl wrongly edits cupsd.conf for options from cups-files.conf

[OdyX]

Paul Menzel reported in https://bugs.debian.org/923115 that cupsctl edits /etc/cups/cupsd.conf instead of /etc/cups/cups-files.conf for the options that should live in the latter:

/etc$ /usr/sbin/cupsctl FileDevices=No
/etc$ sudo git diff
diff --git a/cups/cupsd.conf b/cups/cupsd.conf
index 02afed2..c347852 100644
--- a/cups/cupsd.conf
+++ b/cups/cupsd.conf
@@ -119,3 +119,4 @@ WebInterface Yes
     Order deny,allow
   </Limit>
 </Policy>
+FileDevice Yes

[michaelrsweet]

Well, cupsctl only edits settings in the cupsd.conf file, since cups-files.conf is not externally editable for security reasons.

I will look into blacklisting cups-files.conf directives, however cupsd will (helpfully?) throw an error if you do this already...

[michaelrsweet]

Moving to CUPS 2.2.x/2.3.x since this could cause a DoS if cupsd is configured to fail with unrecognized directives.

[michaelrsweet]

[master 20c9da8] Block cups-files.conf directives (Issue #5530)

[branch-2.2 a0096a2] Block cups-files.conf directives (Issue #5530)