diff options
| -rw-r--r-- | CHANGES.md | 2 | ||||
| -rw-r--r-- | cgi-bin/admin.c | 7 | ||||
| -rw-r--r-- | systemv/lpadmin.c | 3 |
3 files changed, 5 insertions, 7 deletions
diff --git a/CHANGES.md b/CHANGES.md index 865d4976c..0dc43a055 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -5,6 +5,8 @@ CHANGES - 2.3b1 - 2017-11-01 Changes in CUPS v2.3b1 ---------------------- +- No longer support backslash, question mark, or quotes in printer names + (Issue #4966) - Dropped RSS subscription management from the web interface (Issue #5012) - The lpadmin command now provides a better error message when an unsupported System V interface script is used (Issue #5111) diff --git a/cgi-bin/admin.c b/cgi-bin/admin.c index cfdf3ff01..179a8d68e 100644 --- a/cgi-bin/admin.c +++ b/cgi-bin/admin.c @@ -695,16 +695,13 @@ do_am_printer(http_t *http, /* I - HTTP connection */ if ((name = cgiGetVariable("PRINTER_NAME")) != NULL) { for (ptr = name; *ptr; ptr ++) - if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '#') + if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '\\' || *ptr == '?' || *ptr == '\'' || *ptr == '\"' || *ptr == '#') break; if (*ptr || ptr == name || strlen(name) > 127) { cgiSetVariable("ERROR", - cgiText(_("The printer name may only contain up to " - "127 printable characters and may not " - "contain spaces, slashes (/), or the " - "pound sign (#)."))); + cgiText(_("The printer name may only contain up to 127 printable characters and may not contain spaces, slashes (/ \\), quotes (' \"), question mark (?), or the pound sign (#)."))); cgiStartHTML(title); cgiCopyTemplateLang("error.tmpl"); cgiEndHTML(); diff --git a/systemv/lpadmin.c b/systemv/lpadmin.c index b36ea48c4..48dcd76f6 100644 --- a/systemv/lpadmin.c +++ b/systemv/lpadmin.c @@ -1591,8 +1591,7 @@ validate_name(const char *name) /* I - Name to check */ for (ptr = name; *ptr; ptr ++) if (*ptr == '@') break; - else if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || - *ptr == '#') + else if ((*ptr >= 0 && *ptr <= ' ') || *ptr == 127 || *ptr == '/' || *ptr == '\\' || *ptr == '?' || *ptr == '\'' || *ptr == '\"' || *ptr == '#') return (0); /* |