scrambles connection fields with certain chars in the password

Bug #18315 reported by George Williams
6
Affects Status Importance Assigned to Milestone
gnome-cups-manager (Ubuntu)
Confirmed
Medium
Martin Pitt

Bug Description

For smb printers, /etc/cups/printers.conf stores windows passwords as lpadmin
accessible cleartext.
Also, the gui gnome-panel -> System -> Administration -> Printing -> [printer]
-> Properties -> Connection panel shows the Windows password in cleartext in the
Printer field (in fact what text is shown in which fields appears to be all
screwed up).

Revision history for this message
Matt Zimmerman (mdz) wrote :

The password is only accessible to users who have lpadmin privileges (with which
they could likely intercept it anyway).

Revision history for this message
Martin Pitt (pitti) wrote :

 cupsys (1.1.23-10ubuntu2) breezy; urgency=low
 .
   * Added debian/patches/ubuntu-confpermissions.dpatch:
     - Add and document ConfigFilePerm to cupsd.conf and set it to 0600 to
       avoid exposing SMB passwords to lpadmin members. This makes it slightly
       harder to intercept the password. (Ubuntu #12036)

Revision history for this message
George Williams (george-p-williams) wrote :

The indicated resolution doesn't appear to resolve the GUI display problem.

Revision history for this message
Martin Pitt (pitti) wrote :

(In reply to comment #0)
> Also, the gui gnome-panel -> System -> Administration -> Printing -> [printer]
> -> Properties -> Connection panel shows the Windows password in cleartext in the
> Printer field (in fact what text is shown in which fields appears to be all
> screwed up).

(In reply to comment #3)
> The indicated resolution doesn't appear to resolve the GUI display problem.

That certainly works fine in Hoary and Breezy, the fields are not scrambled and
the password is displayed as stars. Are you on Warty?

Revision history for this message
George Williams (george-p-williams) wrote :

I am on Hoary (5.04). In the Connection panel, I have the following:
 Printer Type: Network Printer -- Windows Printer (SMB)
 Host: <my windows domain>\<my windows userid>
 Printer: <my windows password>@<print server>/<printer name>
 Username: <empty> Password: **********************
Note that the stars in the Password field fill the entire field, which is much
longer than my actual password.

Revision history for this message
Martin Pitt (pitti) wrote :

(In reply to comment #5)
> I am on Hoary (5.04). In the Connection panel, I have the following:
> Printer Type: Network Printer -- Windows Printer (SMB)
> Host: <my windows domain>\<my windows userid>
> Printer: <my windows password>@<print server>/<printer name>
> Username: <empty> Password: **********************

Wow, that doesn't happen here. Can you please attach your
/etc/cups/printers.conf with your user/password replaced by "user" and
"password"? Maybe I can reproduce it then.

Revision history for this message
George Williams (george-p-williams) wrote :

my /etc/cups/printers.conf:

# Printer configuration file for CUPS v1.1.23
# Written by cupsd on Mon 20 Jun 2005 02:12:10 PM CDT
<DefaultPrinter Color-LaserJet-4600>
Info Color-LaserJet-4600
DeviceURI smb://se\williamsgp:<email address hidden>/4847-1079
State Idle
Accepting Yes
JobSheets none none
QuotaPeriod 0
PageLimit 0
KLimit 0
</Printer>

Revision history for this message
Martin Pitt (pitti) wrote :

Hi George,

Thanks for your cupsd.conf. Indeed I now can replicate your problem. It seems
that the bug is in the URL parser of g-c-m, it seems to break with the '/'
contained in the password.

Since the other bug has been fixed, I devote this bug for the GUI problem now.
Thanks for your help!

Revision history for this message
Martin Pitt (pitti) wrote :

Seems to be an easy fix, raising priority.

Revision history for this message
era (era) wrote :

Just for the record, when hand-editing my cupsd/printers.conf, I found that simply %-escaping problematic characters in passwords would work just fine. I imagine %, /, :, and @ at least should be escaped (i.e. %25, %2F, %3A, and %40, respectively). Sorry if this is so trivial as to be useless ...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.