From b2ae6e08daee619936f2858eafb31b3a8d8ecfcb Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 17 Feb 2006 21:07:26 +0000 Subject: r13547: add earlier checks to deny deleting a printer driver. The previous code relied upon file permissions alone. Now we check that the user is a printer administrator and that the share has not been marked read only for that user. (This used to be commit 117d9fd9e16a7afbc6772506a4f8c33ff99d33f7) --- source3/rpc_server/srv_spoolss_nt.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'source3/rpc_server') diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index e6d45f76ec..c767daf88c 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -1973,9 +1973,21 @@ WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER struct current_user user; WERROR status; WERROR status_win2k = WERR_ACCESS_DENIED; + SE_PRIV se_printop = SE_PRINT_OPERATOR; get_current_user(&user, p); + /* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege, + and not a printer admin, then fail */ + + if ( (user.ut.uid != 0) + && !user_has_privileges(user.nt_user_token, &se_printop ) + && !token_contains_name_in_list( uidtoname(user.ut.uid), + NULL, user.nt_user_token, lp_printer_admin(-1)) ) + { + return WERR_ACCESS_DENIED; + } + unistr2_to_ascii(driver, &q_u->driver, sizeof(driver)-1 ); unistr2_to_ascii(arch, &q_u->arch, sizeof(arch)-1 ); @@ -2059,9 +2071,21 @@ WERROR _spoolss_deleteprinterdriverex(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIV struct current_user user; WERROR status; WERROR status_win2k = WERR_ACCESS_DENIED; + SE_PRIV se_printop = SE_PRINT_OPERATOR; get_current_user(&user, p); + /* if the user is not root, doesn't have SE_PRINT_OPERATOR privilege, + and not a printer admin, then fail */ + + if ( (user.ut.uid != 0) + && !user_has_privileges(user.nt_user_token, &se_printop ) + && !token_contains_name_in_list( uidtoname(user.ut.uid), + NULL, user.nt_user_token, lp_printer_admin(-1)) ) + { + return WERR_ACCESS_DENIED; + } + unistr2_to_ascii(driver, &q_u->driver, sizeof(driver)-1 ); unistr2_to_ascii(arch, &q_u->arch, sizeof(arch)-1 ); -- cgit