--- cups/auth.c.patched 2026-04-08 09:16:35.357253570 +0200 +++ cups/auth.c 2026-04-08 10:14:34.712275722 +0200 @@ -97,7 +97,6 @@ static void cups_gss_printf(OM_uint32 ma # define cups_gss_printf(major, minor, message) # endif /* DEBUG */ #endif /* HAVE_GSSAPI */ -static int cups_is_local_connection(http_t *http); static int cups_local_auth(http_t *http); @@ -998,14 +997,6 @@ cups_gss_printf(OM_uint32 major_status, # endif /* DEBUG */ #endif /* HAVE_GSSAPI */ -static int /* O - 0 if not a local connection */ - /* 1 if local connection */ -cups_is_local_connection(http_t *http) /* I - HTTP connection to server */ -{ - if (!httpAddrLocalhost(http->hostaddr) && _cups_strcasecmp(http->hostname, "localhost") != 0) - return 0; - return 1; -} /* * 'cups_local_auth()' - Get the local authorization certificate if @@ -1017,13 +1008,7 @@ static int /* O - 0 if available */ /* -1 error */ cups_local_auth(http_t *http) /* I - HTTP connection to server */ { -#if defined(WIN32) || defined(__EMX__) - /* - * Currently WIN32 and OS-2 do not support the CUPS server... - */ - - return (1); -#else +#if !defined(WIN32) && !defined(__EMX__) && defined(AF_LOCAL) int pid; /* Current process ID */ FILE *fp; /* Certificate file */ char trc[16], /* Try Root Certificate parameter */ @@ -1048,7 +1033,7 @@ cups_local_auth(http_t *http) /* I - HT * See if we are accessing localhost... */ - if (!cups_is_local_connection(http)) + if (httpAddrFamily(httpGetAddress(http)) != AF_LOCAL) { DEBUG_puts("8cups_local_auth: Not a local connection!"); return (1); @@ -1128,15 +1113,14 @@ cups_local_auth(http_t *http) /* I - HT return (1); # endif /* HAVE_AUTHORIZATION_H */ -# if defined(SO_PEERCRED) && defined(AF_LOCAL) +# ifdef SO_PEERCRED /* * See if we can authenticate using the peer credentials provided over a * domain socket; if so, specify "PeerCred username" as the authentication * information... */ - if (http->hostaddr->addr.sa_family == AF_LOCAL && - !getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */ + if (!getenv("GATEWAY_INTERFACE") && /* Not via CGI programs... */ cups_auth_find(www_auth, "PeerCred")) { /* @@ -1158,7 +1142,7 @@ cups_local_auth(http_t *http) /* I - HT return (0); } } -# endif /* SO_PEERCRED && AF_LOCAL */ +# endif /* SO_PEERCRED */ if ((schemedata = cups_auth_find(www_auth, "Local")) == NULL) return (1); @@ -1217,7 +1201,7 @@ cups_local_auth(http_t *http) /* I - HT return (0); } } +#endif /* !defined(WIN32) && !defined(__EMX__) && defined(AF_LOCAL) */ return (1); -#endif /* WIN32 || __EMX__ */ } --- scheduler/auth.c.patched 2026-04-08 09:16:35.393253932 +0200 +++ scheduler/auth.c 2026-04-08 11:28:58.885375633 +0200 @@ -323,7 +323,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I } #ifdef HAVE_AUTHORIZATION_H else if (!strncmp(authorization, "AuthRef ", 8) && - httpAddrLocalhost(httpGetAddress(con->http))) + httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL) { OSStatus status; /* Status */ char authdata[HTTP_MAX_VALUE]; @@ -404,7 +404,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I #endif /* HAVE_AUTHORIZATION_H */ #if defined(SO_PEERCRED) && defined(AF_LOCAL) else if (PeerCred != CUPSD_PEERCRED_OFF && !strncmp(authorization, "PeerCred ", 9) && - con->http->hostaddr->addr.sa_family == AF_LOCAL && con->best) + httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL && con->best) { /* * Use peer credentials from domain socket connection... @@ -494,7 +494,7 @@ cupsdAuthorize(cupsd_client_t *con) /* I } #endif /* SO_PEERCRED && AF_LOCAL */ else if (!strncmp(authorization, "Local", 5) && - httpAddrLocalhost(httpGetAddress(con->http))) + httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL) { /* * Get Local certificate authentication data... --- scheduler/client.c.patched 2026-04-08 09:16:35.401254010 +0200 +++ scheduler/client.c 2026-04-08 16:18:43.072419390 +0200 @@ -2384,7 +2384,7 @@ cupsdSendHeader( strlcpy(auth_str, "Negotiate", sizeof(auth_str)); } - if (con->best && !_cups_strcasecmp(httpGetHostname(con->http, NULL, 0), "localhost")) + if (con->best && httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL) { /* * Add a "trc" (try root certification) parameter for local @@ -2404,7 +2404,7 @@ cupsdSendHeader( auth_size = sizeof(auth_str) - (size_t)(auth_key - auth_str); #if defined(SO_PEERCRED) && defined(AF_LOCAL) - if (PeerCred != CUPSD_PEERCRED_OFF && httpAddrFamily(httpGetAddress(con->http)) == AF_LOCAL) + if (PeerCred != CUPSD_PEERCRED_OFF) { strlcpy(auth_key, ", PeerCred", auth_size); auth_key += 10; --- scheduler/ipp.c.orig 2018-03-23 04:48:36.000000000 +0100 +++ scheduler/ipp.c 2026-04-08 16:53:42.626653186 +0200 @@ -5436,7 +5436,7 @@ create_local_printer( * Require local access to create a local printer... */ - if (!httpAddrLocalhost(httpGetAddress(con->http))) + if (httpAddrFamily(httpGetAddress(con->http)) != AF_LOCAL) { send_ipp_status(con, IPP_STATUS_ERROR_FORBIDDEN, _("Only local users can create a local printer.")); return; @@ -5494,6 +5494,19 @@ create_local_printer( return; } + /* + * Google AI tells about 'cups temporary queue device uri' (excerpts): + * CUPS temporary queues use ephemeral Device URIs, typically based on IPP/IPPS protocols, + * to connect directly to network printers without permanent installation. + * The URI often takes the form ipp://... or ipps://... + */ + ptr = ippGetString(device_uri, 0, NULL); + if (!ptr || !ptr[0] || (strncmp(ptr, "ipp://", 6) && strncmp(ptr, "ipps://", 7))) + { + send_ipp_status(con, IPP_STATUS_ERROR_NOT_POSSIBLE, _("Bad device-uri \"%s\"."), ptr); + return; + } + printer_geo_location = ippFindAttribute(con->request, "printer-geo-location", IPP_TAG_URI); printer_info = ippFindAttribute(con->request, "printer-info", IPP_TAG_TEXT); printer_location = ippFindAttribute(con->request, "printer-location", IPP_TAG_TEXT); --- scheduler/job.c.patched 2026-04-08 09:16:35.281252803 +0200 +++ scheduler/job.c 2026-04-09 12:35:09.473824210 +0200 @@ -1157,35 +1157,38 @@ cupsdContinueJob(cupsd_job_t *job) /* I } else { + char scheme[32], /* URI scheme */ + userpass[32], /* URI username:password */ + host[256], /* URI hostname */ + resource[1024]; /* URI resource path (filename) */ + int port; /* URI port number */ + httpSeparateURI(HTTP_URI_CODING_ALL, job->printer->device_uri, scheme, sizeof(scheme), userpass, sizeof(userpass), host, sizeof(host), &port, resource, sizeof(resource)); + job->print_pipes[0] = -1; - if (!strcmp(job->printer->device_uri, "file:/dev/null") || - !strcmp(job->printer->device_uri, "file:///dev/null")) - job->print_pipes[1] = -1; - else + job->print_pipes[1] = -1; + + if (strcmp(resource, "/dev/null")) { - if (!strncmp(job->printer->device_uri, "file:/dev/", 10)) - job->print_pipes[1] = open(job->printer->device_uri + 5, - O_WRONLY | O_EXCL); - else if (!strncmp(job->printer->device_uri, "file:///dev/", 12)) - job->print_pipes[1] = open(job->printer->device_uri + 7, - O_WRONLY | O_EXCL); - else if (!strncmp(job->printer->device_uri, "file:///", 8)) - job->print_pipes[1] = open(job->printer->device_uri + 7, - O_WRONLY | O_CREAT | O_TRUNC, 0600); - else - job->print_pipes[1] = open(job->printer->device_uri + 5, - O_WRONLY | O_CREAT | O_TRUNC, 0600); + if (!FileDevice) + { + abort_message = "Stopping job because file: output is disabled."; - if (job->print_pipes[1] < 0) + goto abort_job; + } + else if ((job->print_pipes[1] = open(resource, O_WRONLY | O_EXCL)) < 0) { - abort_message = "Stopping job because the scheduler could not " - "open the output file."; + abort_message = "Stopping job because the scheduler could not open the output file."; goto abort_job; } + else + { + /* + * Close this file on execute... + */ - fcntl(job->print_pipes[1], F_SETFD, - fcntl(job->print_pipes[1], F_GETFD) | FD_CLOEXEC); + fcntl(job->print_pipes[1], F_SETFD, fcntl(job->print_pipes[1], F_GETFD) | FD_CLOEXEC); + } } } } --- test/4.2-cups-printer-ops.test.orig 2018-03-23 04:48:36.000000000 +0100 +++ test/4.2-cups-printer-ops.test 2026-04-09 15:15:16.634716275 +0200 @@ -175,7 +175,7 @@ ATTR uri printer-uri $method://$hostname:$port/printers/Test2 GROUP printer - ATTR uri device-uri file:/tmp/Test2 + ATTR uri device-uri file:///dev/null ATTR enum printer-state 3 ATTR boolean printer-is-accepting-jobs true @@ -201,7 +201,7 @@ ATTR uri printer-uri $method://$hostname:$port/printers/Test1 GROUP printer - ATTR uri device-uri file:/tmp/Test1 + ATTR uri device-uri file:///dev/null ATTR enum printer-state 3 ATTR boolean printer-is-accepting-jobs true ATTR text printer-info "Test Printer 1" --- test/5.1-lpadmin.sh.orig 2018-03-23 04:48:36.000000000 +0100 +++ test/5.1-lpadmin.sh 2026-04-09 15:18:27.897095952 +0200 @@ -14,8 +14,8 @@ echo "Add Printer Test" echo "" -echo " lpadmin -p Test3 -v file:/dev/null -E -m drv:///sample.drv/deskjet.ppd" -$VALGRIND ../systemv/lpadmin -p Test3 -v file:/dev/null -E -m drv:///sample.drv/deskjet.ppd 2>&1 +echo " lpadmin -p Test3 -v file:///dev/null -E -m drv:///sample.drv/deskjet.ppd" +$VALGRIND ../systemv/lpadmin -p Test3 -v file:///dev/null -E -m drv:///sample.drv/deskjet.ppd 2>&1 if test $? != 0; then echo " FAILED" exit 1 @@ -31,8 +31,8 @@ echo "" echo "Modify Printer Test" echo "" -echo " lpadmin -p Test3 -v file:/tmp/Test3 -o PageSize=A4" -$VALGRIND ../systemv/lpadmin -p Test3 -v file:/tmp/Test3 -o PageSize=A4 2>&1 +echo " lpadmin -p Test3 -v file:///dev/null -o PageSize=A4" +$VALGRIND ../systemv/lpadmin -p Test3 -v file:///dev/null -o PageSize=A4 2>&1 if test $? != 0; then echo " FAILED" exit 1 --- test/run-stp-tests.sh.patched 2026-04-08 09:16:35.393253932 +0200 +++ test/run-stp-tests.sh 2026-04-09 15:23:12.412696340 +0200 @@ -550,7 +550,7 @@ while test $i -le $nprinters1; do cat >>$BASE/printers.conf < Accepting Yes -DeviceURI file:/dev/null +DeviceURI file:///dev/null Info Test PS printer $i JobSheets none none Location CUPS test suite @@ -568,7 +568,7 @@ while test $i -le $nprinters2; do cat >>$BASE/printers.conf < Accepting Yes -DeviceURI file:/dev/null +DeviceURI file:///dev/null Info Test raw printer $i JobSheets none none Location CUPS test suite