Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

OAuth (bearer) quota check denies every user when the allowed-user list is empty

Open Beginner friendly
  • Is something wrong?
#1,795 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
66/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
authorization, backend

Research direction

Start in scheduler/ipp.c, in add_job(), around the early return and the bearer branch near lines 3876-3915, then compare it with the guarded non-bearer branch at 3916. The bug is that the bearer comparison runs when the allowed-user list is empty, so a quota-limited printer refuses every OAuth user. Done means that an empty allow-list permits OAuth users the same way the non-bearer path does, which you can check by setting a job quota on a printer with no user list and submitting a bearer-authenticated job.

Written by the indexing model from the issue text.

Description

Summary
Before checking the allowed-user list, add_job() returns early only when the list is empty and both quotas are zero. A printer that has a quota set therefore proceeds with an empty list. The non-bearer path then guards the comparison with cupsArrayCount(p->users), so an empty list means "no restriction". The bearer path does not guard it: the loop over the empty list leaves name as NULL, and the comparison at 3910 evaluates (name != NULL) == p->deny_users, which is true for the default allow-list, so every OAuth user is refused.

Affected code: scheduler/ipp.c:3876–3915, specifically the early-out at 3876–3877, the bearer branch at 3879, the unguarded comparison at 3910, and the guarded non-bearer branch at 3916. Unchanged in current master 3949d140567cf7b6cede1ea48e4ca6db92066c91.

Reachable rejection sequence

  1. A printer is configured with a quota, for example lpadmin -p printer1 -o job-k-limit=100, and its allowed-user list is left empty — the ordinary way to mean "anyone may print".
  2. The early-out at 3876 does not apply, because the quota is non-zero even though the list is empty.
  3. cupsdDefaultAuthType() is CUPSD_AUTH_BEARER, so execution enters the branch at 3879.
  4. The loop at 3885 does not execute, since p->users is empty; name keeps its NULL value.
  5. Line 3910 evaluates (0) == p->deny_users. With the list used as an allow-list, deny_users is false, so the comparison is true and line 3913 refuses the job.
  6. The same printer accepts the identical request over any non-bearer authentication path, because that branch is only entered when the list is non-empty (3916).

The result is that a quota-limited printer is unusable for OAuth users, and the log line reads "Denying user ... access to printer ...", which suggests an access-control decision rather than a missing empty-list case. Nothing is granted that should not be, so this is functional rather than a bypass.

Suggested fix
Guard the comparison the same way the non-bearer branch does.

-    if ((name != NULL) == p->deny_users)
+    if (cupsArrayCount(p->users) > 0 && (name != NULL) == p->deny_users)

Two neighbouring issues in the same function, not worth separate reports but visible in the same code: at 4009–4021 a failed mbr_user_name_to_uuid() is logged and the loop continues to uuid_compare() with usr2_uuid unset on the first pass, where a continue is expected; and at 3967–3994 a failed group-name conversion does not clear grp_uuid before mbr_check_membership(), unlike the @# branch above it. Both compile only in HAVE_MBR_UID_TO_UUID builds.

Dominant language
C
Stars
1.8k
Forks
353
Avg merge
19h 41m
Merged PRs (30d)
18

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenPrinting/cups

All issues in OpenPrinting/cups

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.