rpms/cups-filters
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS cups-filters-1.28.7-26.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-03-30 10:22:01 -04:00
parent 77a7ce0522
commit 9ccc2d6b9c
6 changed files with 1710 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1377
SOURCES/0001-Introduce-foomatic-hash-and-reject-unauthorized-valu.patch Normal file
View File

File diff suppressed because it is too large Load Diff

24
SOURCES/0001-libcupsfilters-In-pdftopdf-fix-N-up-printing-with-lo.patch Normal file
View File

@ -0,0 +1,24 @@
diff --git a/filter/pdftopdf/pdftopdf_processor.cc b/filter/pdftopdf/pdftopdf_processor.cc
index 2864316..30158b0 100644
--- a/filter/pdftopdf/pdftopdf_processor.cc
+++ b/filter/pdftopdf/pdftopdf_processor.cc
@@ -149,12 +149,14 @@ bool processPDFTOPDF(PDFTOPDF_Processor &proc,ProcessingParameters &param) // {{
return false;
}
- if (param.autoRotate) {
- const bool dst_lscape =
- (param.paper_is_landscape ==
- ((param.orientation == ROT_0) || (param.orientation == ROT_180)));
+ const bool dst_lscape =
+ (param.paper_is_landscape ==
+ ((param.orientation == ROT_0) || (param.orientation == ROT_180)));
+ if (dst_lscape)
+ std::swap(param.nup.nupX, param.nup.nupY);
+
+ if (param.autoRotate)
proc.autoRotateAll(dst_lscape,param.normal_landscape);
- }
std::vector<std::shared_ptr<PDFTOPDF_PageHandle>> pages=proc.get_pages();
const int numOrigPages=pages.size();

39
SOURCES/0001-libcupsfilters-Make-pdftopdf-correctly-working-with-.patch Normal file
View File

@ -0,0 +1,39 @@
diff --git a/filter/pdftopdf/pdftopdf_processor.cc b/filter/pdftopdf/pdftopdf_processor.cc
index 30158b0..c6b2e72 100644
--- a/filter/pdftopdf/pdftopdf_processor.cc
+++ b/filter/pdftopdf/pdftopdf_processor.cc
@@ -152,7 +152,8 @@ bool processPDFTOPDF(PDFTOPDF_Processor &proc,ProcessingParameters &param) // {{
const bool dst_lscape =
(param.paper_is_landscape ==
((param.orientation == ROT_0) || (param.orientation == ROT_180)));
- if (dst_lscape)
+
+ if (param.paper_is_landscape)
std::swap(param.nup.nupX, param.nup.nupY);
if (param.autoRotate)
@@ -258,10 +259,11 @@ bool processPDFTOPDF(PDFTOPDF_Processor &proc,ProcessingParameters &param) // {{
for(int i=0;i<(int)pages.size();i++)
{
std::shared_ptr<PDFTOPDF_PageHandle> page = pages[i];
- Rotation orientation = param.orientation;
- if (param.noOrientation &&
- page->is_landscape(param.orientation))
+ Rotation orientation;
+ if (page->is_landscape(param.orientation))
orientation = param.normal_landscape;
+ else
+ orientation = ROT_0;
page->crop(param.page, orientation, param.xpos, param.ypos,
!param.cropfit);
}
@@ -365,7 +367,8 @@ bool processPDFTOPDF(PDFTOPDF_Processor &proc,ProcessingParameters &param) // {{
if ((param.nup.nupX == 1) && (param.nup.nupY == 1))
{
double xpos2, ypos2;
- if (param.orientation == ROT_270 || param.orientation == ROT_90)
+ if ((param.page.height - param.page.width) *
+ (page->getRect().height - page->getRect().width) < 0)
{
xpos2 = (param.page.width - (page->getRect().height)) / 2;
ypos2 = (param.page.height - (page->getRect().width)) / 2;

13
SOURCES/foomatic-ripdie-error.patch Normal file
View File

@ -0,0 +1,13 @@
diff --git a/filter/foomatic-rip/util.c b/filter/foomatic-rip/util.c
index 508bc09..ad79fbf 100644
--- a/filter/foomatic-rip/util.c
+++ b/filter/foomatic-rip/util.c
@@ -76,7 +76,7 @@ rip_die(int status,
{
va_list ap;
- _log("Process is dying with \"");
+ _log("ERROR: Process is dying with \"");
va_start(ap, msg);
_logv(msg, ap);
va_end(ap);

143
SOURCES/foomaticrip-reject-unknown-values.patch Normal file
View File

@ -0,0 +1,143 @@
diff --git a/filter/foomatic-rip/foomatic-rip.1.in b/filter/foomatic-rip/foomatic-rip.1.in
index 9685a95..3dff521 100644
--- a/filter/foomatic-rip/foomatic-rip.1.in
+++ b/filter/foomatic-rip/foomatic-rip.1.in
@@ -193,6 +193,15 @@ friends. Several PPD files use shell constructs that require a more
modern shell like \fBbash\fR, \fBzsh\fR, or \fBksh\fR.
+.SH PPD OPTION VALUE RESTRICTIONS AND EXCEPTIONS
+
+The values of PPD options \fBFoomaticRIPCommandLine\fR, \fBFoomaticRIPCommandLinePDF\fR and \fBFoomaticRIPOptionSetting\fR
+are rejected in the default configuration because of security implications. Users can use the tool \fBfoomatic-hash(1)\fR, which provides
+values of affected PPD options from found drivers and hashes of those values in hexadecimal format. User is expected to review the found values,
+and if there is nothing suspicious in the output, copy the file with hashes into into the directory \fB@sysconfdir@/foomatic/hashes.d\fR
+to allow the exceptions for found values.
+
+
.SH FILES
.PD 0
.TP 0
@@ -209,6 +218,13 @@ The PPD files of the currently defined printers
Configuration file for foomatic-rip
+.TP 0
+@sysconfdir@/foomatic/hashes.d
+.TP 0
+@datadir@/foomatic/hashes.d
+
+Directories with hashes of allowed values
+
.PD 0
.\".SH SEE ALSO
diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
index 3c6b63d..6c5b1a3 100644
--- a/filter/foomatic-rip/options.c
+++ b/filter/foomatic-rip/options.c
@@ -109,6 +109,43 @@ out:
return profile;
}
+
+//
+// 'is_allowed_value' - Check if the option value is allowed.
+//
+
+int // O - Boolean value - true 1 / false 0
+is_allowed_value(cups_array_t *ar, // I - Array of already known hashes from system
+ char *value, // I - Scanned value from PPD file
+ size_t value_len) // I - Value length
+{
+ char hash_string[65]; // Help array to store hexadecimal hashed string
+
+ //
+ // Empty string is allowed...
+ //
+
+ if (!value_len)
+ return (1);
+
+ //
+ // Hash the value and get hexadecimal string for it...
+ //
+
+ if (hash_data((unsigned char*)value, value_len, hash_string, sizeof(hash_string)))
+ return (0);
+
+ //
+ // Check if the found hexadecimal hashed string is in the array -> allowed on the system...
+ //
+
+ if (cupsArrayFind(ar, hash_string))
+ return (1);
+
+ return (0);
+}
+
+
/* a selector is a general tri-dotted specification.
* The 2nd and 3rd elements of the qualifier are optionally modified by
* cupsICCQualifier2 and cupsICCQualifier3:
@@ -1562,12 +1599,19 @@ void read_ppd_file(const char *filename)
option_t *opt, *current_opt = NULL;
param_t *param;
icc_mapping_entry_t *entry;
+ cups_array_t *known_hashes = NULL;
fh = fopen(filename, "r");
if (!fh)
rip_die(EXIT_PRNERR_NORETRY_BAD_SETTINGS, "Unable to open PPD file %s\n", filename);
_log("Parsing PPD file ...\n");
+ if (load_system_hashes(&known_hashes))
+ {
+ fclose(fh);
+ rip_die(EXIT_PRNERR_NORETRY, "Not enough memory for array allocation\n.");
+ }
+
dstrassure(value, 256);
qualifier_data = list_create();
@@ -1642,9 +1686,25 @@ void read_ppd_file(const char *filename)
unhtmlify(postpipe->data, postpipe->alloc, value->data);
}
else if (strcmp(key, "FoomaticRIPCommandLine") == 0) {
+ if (!is_allowed_value(known_hashes, value->data, strlen(value->data)))
+ {
+ cupsArrayDelete(known_hashes);
+ fclose(fh);
+
+ rip_die(EXIT_PRNERR_NOTALLOWED, "ERROR: The value of the key %s is not among the allowed values - see foomatic-rip man page for more instructions.\n", key);
+ }
+
unhtmlify(cmd, 4096, value->data);
}
else if (strcmp(key, "FoomaticRIPCommandLinePDF") == 0) {
+ if (!is_allowed_value(known_hashes, value->data, strlen(value->data)))
+ {
+ cupsArrayDelete(known_hashes);
+ fclose(fh);
+
+ rip_die(EXIT_PRNERR_NOTALLOWED, "ERROR: The value of the key %s is not among the allowed values - see foomatic-rip man page for more instructions.\n", key);
+ }
+
unhtmlify(cmd_pdf, 4096, value->data);
}
else if (!strcmp(key, "cupsFilter")) {
@@ -1765,6 +1825,14 @@ void read_ppd_file(const char *filename)
option_set_choice(current_opt, name, text, value->data);
}
else if (!strcmp(key, "FoomaticRIPOptionSetting")) {
+ if (!is_allowed_value(known_hashes, value->data, strlen(value->data)))
+ {
+ cupsArrayDelete(known_hashes);
+ fclose(fh);
+
+ rip_die(EXIT_PRNERR_NOTALLOWED, "ERROR: The value of the key %s is not among the allowed values - see foomatic-rip man page for more instructions.\n", key);
+ }
+
/* "*FoomaticRIPOptionSetting <option>[=<choice>]: <code>
For boolean options <choice> is not given */
option_set_choice(assure_option(name),

115
SPECS/cups-filters.spec
View File

@ -11,7 +11,7 @@
Summary: OpenPrinting CUPS filters and backends
Name: cups-filters
Version: 1.28.7
Release: 22%{?dist}
Release: 26%{?dist}
# For a breakdown of the licensing, see COPYING file
# GPLv2: filters: commandto*, imagetoraster, pdftops, rasterto*,
@ -68,6 +68,20 @@ Patch15: 0001-configure.ac-Make-CJK-fonts-name-configurable.patch
# it is debug assert in upstream now by default turned off, so to do not
# backport debug_assert changes, let's just remove the specific assert
Patch16: font-noassert.patch
# introducing foomatic-hash, but without rejecting values in foomatic-rip
# https://github.com/OpenPrinting/cups-filters/pull/648
Patch17: 0001-Introduce-foomatic-hash-and-reject-unauthorized-valu.patch
# make sure errors from foomatic-rip are propagated
# https://github.com/OpenPrinting/cups-filters/pull/649
Patch18: foomatic-ripdie-error.patch
# rejecting the unknown values in foomatic-rip
# https://github.com/OpenPrinting/cups-filters/pull/648
Patch19: foomaticrip-reject-unknown-values.patch
# RHEL-117507 cups-filter: output of landscape print have the top and left portions cut off
# Patches: 0001-libcupsfilters-In-pdftopdf-fix-N-up-printing-with-lo.patch
# 0001-libcupsfilters-Make-pdftopdf-correctly-working-with-.patch
Patch20: 0001-libcupsfilters-In-pdftopdf-fix-N-up-printing-with-lo.patch
Patch21: 0001-libcupsfilters-Make-pdftopdf-correctly-working-with-.patch
# autogen.sh
@ -261,6 +275,68 @@ The package provides filters and cups-brf backend needed for braille printing.
install -p -m 0755 %{SOURCE2} %{buildroot}%{_cups_serverbin}/filter/lftocrlf
install -p -m 0644 %{SOURCE1} %{buildroot}%{_datadir}/ppd/cupsfilters/lftocrlf.ppd
# for post upgrade script to allow already existing printers
mkdir -p %{buildroot}%{_libexecdir}/%{name}
# the script which does the deed - goes PPD file by PPD file if there are any
# problematic PPD options, scans the values into file in /var/tmp for review, while
# hashed values are saved in a file in directory where foomatic-rip reads it.
#
# hashes.new is for marking this script already run once, so it won't be run again.
# It is needed to prevent allowing newly installed printers after another upgrade.
# This is handled by systemd unit.
cat > %{buildroot}%{_libexecdir}/%{name}/posttrans.sh << EOF
#!/usr/bin/bash
if \$(grep -q -R 'FoomaticRIPCommandLine\|FoomaticRipOptionSetting' %{_sysconfdir}/cups/ppd)
then
tmpfile=\$(mktemp -p /var/tmp foomatic-scan.XXXXXXXX)
for ppd in %{_sysconfdir}/cups/ppd/*.ppd
do
foomatic-hash --ppd \$ppd \$tmpfile %{_sysconfdir}/foomatic/hashes.d/hashes.upgrade || :
done
if test -f %{_sysconfdir}/foomatic/hashes.d/hashes.upgrade
then
echo "Foomatic-rip values which can inject code found - review findings in \$tmpfile. Read release notes for instructions." || :
fi
else
touch %{_sysconfdir}/foomatic/hashes.d/hashes.new
fi
exit 0
EOF
mkdir -p %{buildroot}%{_unitdir}
# Upgrade service which will be run only when the specified directory is empty
# - the service will be run only once, on the first upgrade introducing the change.
cat > %{buildroot}%{_unitdir}/foomaticrip-upgrade.service << EOF
[Unit]
Description=Allowing already installed printers for foomatic-rip
ConditionPathIsDirectory=%{_sysconfdir}/foomatic/hashes.d
ConditionDirectoryNotEmpty=!%{_sysconfdir}/foomatic/hashes.d
[Service]
Type=oneshot
ExecStart=bash -c %{_libexecdir}/%{name}/posttrans.sh
[Install]
WantedBy=multi-user.target
EOF
mkdir -p %{buildroot}%{_unitdir}/cups.service.d
# We have to make sure the upgrade service is run before starting cupsd, so the allowed
# hashes are in place already and there is no printing disruption.
cat > %{buildroot}%{_unitdir}/cups.service.d/10-foomaticrip-upgrade.conf << EOF
[Unit]
After=foomaticrip-upgrade.service
Wants=foomaticrip-upgrade.service
EOF
# Don't ship libtool la files.
rm -f %{buildroot}%{_libdir}/lib*.la
@ -310,16 +386,30 @@ then
sed -i "s/^\s*BrowseRemoteProtocols.*/# added by post scriptlet\nBrowseRemoteProtocols none/" %{_sysconfdir}/cups/cups-browsed.conf
fi
%systemd_post foomaticrip-upgrade.service
%preun
%systemd_preun cups-browsed.service
%systemd_preun foomaticrip-upgrade.service
%postun
%systemd_postun_with_restart cups-browsed.service
%systemd_postun foomaticrip-upgrade.service
%ldconfig_scriptlets libs
%posttrans
if [ $1 -ge 1 ]
then
/usr/lib/systemd/systemd-update-helper mark-reload-system-units foomaticrip-upgrade.service || :
fi
if [ $1 -ge 1 ]
then
systemctl start foomaticrip-upgrade.service || :
fi
if ls -lah /var/cache/cups/cups-browsed* &> /dev/null
then
BROWSED_ACTIVE="0"
@ -357,6 +447,7 @@ fi
%{_pkgdocdir}/ABOUT-NLS
%{_pkgdocdir}/AUTHORS
%{_pkgdocdir}/NEWS
%{_bindir}/foomatic-hash
%{_bindir}/foomatic-rip
%{_bindir}/driverless
%{_bindir}/driverless-fax
@ -404,15 +495,25 @@ fi
%{_datadir}/cups/mime/cupsfilters.convs
%{_datadir}/cups/mime/cupsfilters-ghostscript.convs
%{_datadir}/cups/mime/cupsfilters-poppler.convs
%dir %{_datadir}/foomatic
%dir %{_datadir}/foomatic/hashes.d
%{_datadir}/ppd/cupsfilters
# this needs to be in the main package because of cupsfilters.drv
%{_datadir}/cups/ppdc/pcl.h
%dir %{_libexecdir}/%{name}
%attr(0744,root,root) %{_libexecdir}/%{name}/posttrans.sh
%{_mandir}/man1/foomatic-hash.1.gz
%{_mandir}/man1/foomatic-rip.1.gz
%{_mandir}/man1/driverless.1.gz
%{_mandir}/man5/cups-browsed.conf.5.gz
%{_mandir}/man8/cups-browsed.8.gz
%config(noreplace) %verify(not size filedigest mtime) %{_sysconfdir}/cups/cups-browsed.conf
%config(noreplace) %{_sysconfdir}/foomatic
%ghost %attr(0644,root,root) %{_sysconfdir}/foomatic/hashes.d/hashes.new
%{_unitdir}/cups-browsed.service
%dir %{_unitdir}/cups.service.d
%{_unitdir}/cups.service.d/10-foomaticrip-upgrade.conf
%{_unitdir}/foomaticrip-upgrade.service
%files libs
%dir %{_pkgdocdir}/
@ -475,6 +576,18 @@ fi
%endif
%changelog
* Tue Nov 11 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-26
- RHEL-117507 cups-filter: output of landscape print have the top and left portions cut off
* Mon Nov 10 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-25
- fix return value when libppd is not used
* Mon Oct 13 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-24
- fix posttrans script
* Thu Oct 09 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-23
- RHEL-93931 RFE: Add Allow list for FoomaticRIPCommandLine PPD values
* Fri Aug 01 2025 Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-22
- RHEL-65587 texttopdf omits Chinese characters when creating PDF documents