Merge in the change to do per-handle access checks on setdata/setform etc.
authorJeremy Allison <jra@samba.org>
Thu, 7 Mar 2002 01:02:48 +0000 (01:02 +0000)
committerJeremy Allison <jra@samba.org>
Thu, 7 Mar 2002 01:02:48 +0000 (01:02 +0000)
Should allow the buggy spoolss code on NT to work against us.
Jeremy.
(This used to be commit 2b3609a7dd55d96f5aafe137fff1ac2da0434867)

source3/rpc_server/srv_spoolss_nt.c

index c7b4df9d82da77047748be68f56afbd07de1a440..eb10de3253adfcdadef3d155738afdc8f299a728 100644 (file)
@@ -59,7 +59,7 @@ typedef struct _Printer{
                fstring printerservername;
        } dev;
        uint32 type;
-       uint32 access;
+       uint32 access_granted;
        struct {
                uint32 flags;
                uint32 options;
@@ -327,8 +327,9 @@ static WERROR delete_printer_handle(pipes_struct *p, POLICY_HND *hnd)
 }
 
 /****************************************************************************
-  return the snum of a printer corresponding to an handle
+ Return the snum of a printer corresponding to an handle.
 ****************************************************************************/
+
 static BOOL get_printer_snum(pipes_struct *p, POLICY_HND *hnd, int *number)
 {
        Printer_entry *Printer = find_printer_index_by_hnd(p, hnd);
@@ -350,23 +351,6 @@ static BOOL get_printer_snum(pipes_struct *p, POLICY_HND *hnd, int *number)
        }
 }
 
-/****************************************************************************
-  set printer handle type.
-****************************************************************************/
-static BOOL set_printer_hnd_accesstype(pipes_struct *p, POLICY_HND *hnd, uint32 access_required)
-{
-       Printer_entry *Printer = find_printer_index_by_hnd(p, hnd);
-
-       if (!Printer) {
-               DEBUG(2,("set_printer_hnd_accesstype: Invalid handle (%s:%u:%u)", OUR_HANDLE(hnd)));
-               return False;
-       }
-
-       DEBUG(4,("Setting printer access=%x\n", access_required));
-       Printer->access = access_required;
-       return True;            
-}
-
 /****************************************************************************
  Set printer handle type.
  Check if it's \\server or \\server\printer
@@ -468,10 +452,10 @@ static BOOL set_printer_hnd_name(Printer_entry *Printer, char *handlename)
 }
 
 /****************************************************************************
 find first available printer slot. creates a printer handle for you.
Find first available printer slot. creates a printer handle for you.
  ****************************************************************************/
 
-static BOOL open_printer_hnd(pipes_struct *p, POLICY_HND *hnd, char *name)
+static BOOL open_printer_hnd(pipes_struct *p, POLICY_HND *hnd, char *name, uint32 access_granted)
 {
        Printer_entry *new_printer;
 
@@ -502,31 +486,17 @@ static BOOL open_printer_hnd(pipes_struct *p, POLICY_HND *hnd, char *name)
                return False;
        }
 
-       DEBUG(5, ("%d printer handles active\n", (int)p->pipe_handles->count ));
+       new_printer->access_granted = access_granted;
 
-       return True;
-}
-
-/********************************************************************
- Return True if the handle is a print server.
- ********************************************************************/
-
-static BOOL handle_is_printserver(pipes_struct *p, POLICY_HND *handle)
-{
-       Printer_entry *Printer=find_printer_index_by_hnd(p,handle);
+       DEBUG(5, ("%d printer handles active\n", (int)p->pipe_handles->count ));
 
-       if (!Printer)
-               return False;
-               
-       if (Printer->printer_type != PRINTER_HANDLE_IS_PRINTSERVER)
-               return False;
-       
        return True;
 }
 
 /****************************************************************************
allocate more memory for a BUFFER.
Allocate more memory for a BUFFER.
 ****************************************************************************/
+
 static BOOL alloc_buffer_size(NEW_BUFFER *buffer, uint32 buffer_size)
 {
        prs_struct *ps;
@@ -646,6 +616,7 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
        fstring name;
        int snum;
        struct current_user user;
+       Printer_entry *Printer=NULL;
 
        if (q_u->printername_ptr != 0)
                printername = &q_u->printername;
@@ -659,9 +630,17 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
 
        DEBUGADD(3,("checking name: %s\n",name));
 
-       if (!open_printer_hnd(p, handle, name))
+       if (!open_printer_hnd(p, handle, name, 0))
                return WERR_INVALID_PRINTER_NAME;
        
+       Printer=find_printer_index_by_hnd(p, handle);
+       if (!Printer) {
+               DEBUG(0,(" _spoolss_open_printer_ex: logic error. \
+Can't find printer handle we created for priunter %s\n", name ));
+               close_printer_handle(p,handle);
+               return WERR_INVALID_PRINTER_NAME;
+       }
+
 /*
        if (printer_default->datatype_ptr != NULL)
        {
@@ -672,11 +651,6 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
                set_printer_hnd_datatype(handle, "");
 */
        
-       if (!set_printer_hnd_accesstype(p, handle, printer_default->access_required)) {
-               close_printer_handle(p, handle);
-               return WERR_ACCESS_DENIED;
-       }
-               
        /*
           First case: the user is opening the print server:
 
@@ -702,7 +676,7 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
 
        get_current_user(&user, p);
 
-       if (handle_is_printserver(p, handle)) {
+       if (Printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER) {
                if (printer_default->access_required == 0) {
                        return WERR_OK;
                }
@@ -755,6 +729,21 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
                        return WERR_ACCESS_DENIED;
                }
 
+               /*
+                * An admin user always has access.
+                */
+
+               if (user.uid == 0 || user_in_list(uidtoname(user.uid), lp_printer_admin(snum)))
+                       printer_default->access_required = PRINTER_ACCESS_ADMINISTER;
+
+               if (printer_default->access_required & PRINTER_ACCESS_ADMINISTER)
+                       printer_default->access_required = PRINTER_ACCESS_ADMINISTER;
+               else
+                       printer_default->access_required = PRINTER_ACCESS_USE;
+
+               DEBUG(4,("Setting printer access=%x\n", printer_default->access_required));
+               Printer->access_granted = printer_default->access_required;
+
                /*
                 * If we have a default device pointer in the
                 * printer_default struct, then we need to get
@@ -836,6 +825,7 @@ WERROR _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u,
 
 /****************************************************************************
 ****************************************************************************/
+
 static BOOL convert_printer_info(const SPOOL_PRINTER_INFO_LEVEL *uni,
                                NT_PRINTER_INFO_LEVEL *printer, uint32 level)
 {
@@ -1022,6 +1012,7 @@ WERROR _spoolss_deleteprinter(pipes_struct *p, SPOOL_Q_DELETEPRINTER *q_u, SPOOL
  * static function to lookup the version id corresponding to an
  * long architecture string
  ******************************************************************/
+
 static int get_version_id (char * arch)
 {
        int i;
@@ -1090,10 +1081,10 @@ WERROR _spoolss_deleteprinterdriver(pipes_struct *p, SPOOL_Q_DELETEPRINTERDRIVER
        return delete_printer_driver(info.info_3);       
 }
 
-
 /********************************************************************
  GetPrinterData on a printer server Handle.
 ********************************************************************/
+
 static BOOL getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint32 *type, uint8 **data, uint32 *needed, uint32 in_size)
 {              
        int i;
@@ -1183,6 +1174,7 @@ static BOOL getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint32
 /********************************************************************
  GetPrinterData on a printer Handle.
 ********************************************************************/
+
 static BOOL getprinterdata_printer(pipes_struct *p, TALLOC_CTX *ctx, POLICY_HND *handle,
                                fstring value, uint32 *type,
                                uint8 **data, uint32 *needed, uint32 in_size )
@@ -1303,8 +1295,9 @@ WERROR _spoolss_getprinterdata(pipes_struct *p, SPOOL_Q_GETPRINTERDATA *q_u, SPO
 }
 
 /***************************************************************************
- connect to the client
+ Connect to the client.
 ****************************************************************************/
+
 static BOOL srv_spoolss_replyopenprinter(char *printer, uint32 localprinter, uint32 type, POLICY_HND *handle)
 {
        WERROR status;
@@ -1413,6 +1406,7 @@ static void spoolss_notify_server_name(int snum,
 /*******************************************************************
  * fill a notify_info_data with the printername (not including the servername).
  ********************************************************************/
+
 static void spoolss_notify_printer_name(int snum, 
                                        SPOOL_NOTIFY_INFO_DATA *data, 
                                        print_queue_struct *queue,
@@ -1447,6 +1441,7 @@ static void spoolss_notify_printer_name(int snum,
 /*******************************************************************
  * fill a notify_info_data with the servicename
  ********************************************************************/
+
 static void spoolss_notify_share_name(int snum, 
                                      SPOOL_NOTIFY_INFO_DATA *data, 
                                      print_queue_struct *queue,
@@ -1472,6 +1467,7 @@ static void spoolss_notify_share_name(int snum,
 /*******************************************************************
  * fill a notify_info_data with the port name
  ********************************************************************/
+
 static void spoolss_notify_port_name(int snum, 
                                     SPOOL_NOTIFY_INFO_DATA *data, 
                                     print_queue_struct *queue,
@@ -1501,6 +1497,7 @@ static void spoolss_notify_port_name(int snum,
  * jfmxxxx: it's incorrect, should be lp_printerdrivername()
  * but it doesn't exist, have to see what to do
  ********************************************************************/
+
 static void spoolss_notify_driver_name(int snum, 
                                       SPOOL_NOTIFY_INFO_DATA *data,
                                       print_queue_struct *queue,
@@ -1525,6 +1522,7 @@ static void spoolss_notify_driver_name(int snum,
 /*******************************************************************
  * fill a notify_info_data with the comment
  ********************************************************************/
+
 static void spoolss_notify_comment(int snum, 
                                   SPOOL_NOTIFY_INFO_DATA *data,
                                   print_queue_struct *queue,
@@ -1555,6 +1553,7 @@ static void spoolss_notify_comment(int snum,
  * jfm:xxxx incorrect, have to create a new smb.conf option
  * location = "Room 1, floor 2, building 3"
  ********************************************************************/
+
 static void spoolss_notify_location(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -1581,6 +1580,7 @@ static void spoolss_notify_location(int snum,
  * fill a notify_info_data with the device mode
  * jfm:xxxx don't to it for know but that's a real problem !!!
  ********************************************************************/
+
 static void spoolss_notify_devmode(int snum, 
                                   SPOOL_NOTIFY_INFO_DATA *data,
                                   print_queue_struct *queue,
@@ -1594,6 +1594,7 @@ static void spoolss_notify_devmode(int snum,
  * jfm:xxxx just return no file could add an option to smb.conf
  * separator file = "separator.txt"
  ********************************************************************/
+
 static void spoolss_notify_sepfile(int snum, 
                                   SPOOL_NOTIFY_INFO_DATA *data, 
                                   print_queue_struct *queue,
@@ -1620,6 +1621,7 @@ static void spoolss_notify_sepfile(int snum,
  * fill a notify_info_data with the print processor
  * jfm:xxxx return always winprint to indicate we don't do anything to it
  ********************************************************************/
+
 static void spoolss_notify_print_processor(int snum, 
                                           SPOOL_NOTIFY_INFO_DATA *data,
                                           print_queue_struct *queue,
@@ -1646,6 +1648,7 @@ static void spoolss_notify_print_processor(int snum,
  * fill a notify_info_data with the print processor options
  * jfm:xxxx send an empty string
  ********************************************************************/
+
 static void spoolss_notify_parameters(int snum, 
                                      SPOOL_NOTIFY_INFO_DATA *data,
                                      print_queue_struct *queue,
@@ -1672,6 +1675,7 @@ static void spoolss_notify_parameters(int snum,
  * fill a notify_info_data with the data type
  * jfm:xxxx always send RAW as data type
  ********************************************************************/
+
 static void spoolss_notify_datatype(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -1699,6 +1703,7 @@ static void spoolss_notify_datatype(int snum,
  * jfm:xxxx send an null pointer to say no security desc
  * have to implement security before !
  ********************************************************************/
+
 static void spoolss_notify_security_desc(int snum, 
                                         SPOOL_NOTIFY_INFO_DATA *data,
                                         print_queue_struct *queue,
@@ -1713,6 +1718,7 @@ static void spoolss_notify_security_desc(int snum,
  * fill a notify_info_data with the attributes
  * jfm:xxxx a samba printer is always shared
  ********************************************************************/
+
 static void spoolss_notify_attributes(int snum, 
                                      SPOOL_NOTIFY_INFO_DATA *data,
                                      print_queue_struct *queue,
@@ -1726,6 +1732,7 @@ static void spoolss_notify_attributes(int snum,
 /*******************************************************************
  * fill a notify_info_data with the priority
  ********************************************************************/
+
 static void spoolss_notify_priority(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -1739,6 +1746,7 @@ static void spoolss_notify_priority(int snum,
 /*******************************************************************
  * fill a notify_info_data with the default priority
  ********************************************************************/
+
 static void spoolss_notify_default_priority(int snum, 
                                            SPOOL_NOTIFY_INFO_DATA *data,
                                            print_queue_struct *queue,
@@ -1752,6 +1760,7 @@ static void spoolss_notify_default_priority(int snum,
 /*******************************************************************
  * fill a notify_info_data with the start time
  ********************************************************************/
+
 static void spoolss_notify_start_time(int snum, 
                                      SPOOL_NOTIFY_INFO_DATA *data,
                                      print_queue_struct *queue,
@@ -1765,6 +1774,7 @@ static void spoolss_notify_start_time(int snum,
 /*******************************************************************
  * fill a notify_info_data with the until time
  ********************************************************************/
+
 static void spoolss_notify_until_time(int snum, 
                                      SPOOL_NOTIFY_INFO_DATA *data,
                                      print_queue_struct *queue,
@@ -1778,6 +1788,7 @@ static void spoolss_notify_until_time(int snum,
 /*******************************************************************
  * fill a notify_info_data with the status
  ********************************************************************/
+
 static void spoolss_notify_status(int snum, 
                                  SPOOL_NOTIFY_INFO_DATA *data,
                                  print_queue_struct *queue,
@@ -1794,6 +1805,7 @@ static void spoolss_notify_status(int snum,
 /*******************************************************************
  * fill a notify_info_data with the number of jobs queued
  ********************************************************************/
+
 static void spoolss_notify_cjobs(int snum, 
                                 SPOOL_NOTIFY_INFO_DATA *data,
                                 print_queue_struct *queue,
@@ -1807,6 +1819,7 @@ static void spoolss_notify_cjobs(int snum,
 /*******************************************************************
  * fill a notify_info_data with the average ppm
  ********************************************************************/
+
 static void spoolss_notify_average_ppm(int snum, 
                                       SPOOL_NOTIFY_INFO_DATA *data,
                                       print_queue_struct *queue,
@@ -1822,6 +1835,7 @@ static void spoolss_notify_average_ppm(int snum,
 /*******************************************************************
  * fill a notify_info_data with username
  ********************************************************************/
+
 static void spoolss_notify_username(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -1847,6 +1861,7 @@ static void spoolss_notify_username(int snum,
 /*******************************************************************
  * fill a notify_info_data with job status
  ********************************************************************/
+
 static void spoolss_notify_job_status(int snum, 
                                      SPOOL_NOTIFY_INFO_DATA *data,
                                      print_queue_struct *queue,
@@ -1860,6 +1875,7 @@ static void spoolss_notify_job_status(int snum,
 /*******************************************************************
  * fill a notify_info_data with job name
  ********************************************************************/
+
 static void spoolss_notify_job_name(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -1885,6 +1901,7 @@ static void spoolss_notify_job_name(int snum,
 /*******************************************************************
  * fill a notify_info_data with job status
  ********************************************************************/
+
 static void spoolss_notify_job_status_string(int snum, 
                                             SPOOL_NOTIFY_INFO_DATA *data,
                                             print_queue_struct *queue,
@@ -1934,6 +1951,7 @@ static void spoolss_notify_job_status_string(int snum,
 /*******************************************************************
  * fill a notify_info_data with job time
  ********************************************************************/
+
 static void spoolss_notify_job_time(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -1947,6 +1965,7 @@ static void spoolss_notify_job_time(int snum,
 /*******************************************************************
  * fill a notify_info_data with job size
  ********************************************************************/
+
 static void spoolss_notify_job_size(int snum, 
                                    SPOOL_NOTIFY_INFO_DATA *data,
                                    print_queue_struct *queue,
@@ -2085,8 +2104,9 @@ struct s_notify_info_data_table notify_info_data_table[] =
 };
 
 /*******************************************************************
-return the size of info_data structure
+ Return the size of info_data structure.
 ********************************************************************/
+
 static uint32 size_of_notify_info_data(uint16 type, uint16 field)
 {
        int i=0;
@@ -2104,8 +2124,9 @@ static uint32 size_of_notify_info_data(uint16 type, uint16 field)
 }
 
 /*******************************************************************
-return the type of notify_info_data
+ Return the type of notify_info_data.
 ********************************************************************/
+
 static BOOL type_of_notify_info_data(uint16 type, uint16 field)
 {
        int i=0;
@@ -2131,6 +2152,7 @@ static BOOL type_of_notify_info_data(uint16 type, uint16 field)
 
 /****************************************************************************
 ****************************************************************************/
+
 static int search_notify(uint16 type, uint16 field, int *value)
 {      
        int j;
@@ -2152,6 +2174,7 @@ static int search_notify(uint16 type, uint16 field, int *value)
 
 /****************************************************************************
 ****************************************************************************/
+
 static void construct_info_data(SPOOL_NOTIFY_INFO_DATA *info_data, uint16 type, uint16 field, int id)
 {
        info_data->type     = type;
@@ -2168,6 +2191,7 @@ static void construct_info_data(SPOOL_NOTIFY_INFO_DATA *info_data, uint16 type,
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
+
 static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
                                          snum, SPOOL_NOTIFY_OPTION_TYPE
                                          *option_type, uint32 id,
@@ -2225,6 +2249,7 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
+
 static BOOL construct_notify_jobs_info(print_queue_struct *queue,
                                       SPOOL_NOTIFY_INFO *info,
                                       NT_PRINTER_INFO_LEVEL *printer,
@@ -2358,6 +2383,7 @@ static WERROR printserver_notify_info(pipes_struct *p, POLICY_HND *hnd,
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
+
 static WERROR printer_notify_info(pipes_struct *p, POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info,
                                  TALLOC_CTX *mem_ctx)
 {
@@ -2494,6 +2520,7 @@ WERROR _spoolss_rfnpcnex( pipes_struct *p, SPOOL_Q_RFNPCNEX *q_u, SPOOL_R_RFNPCN
  * construct_printer_info_0
  * fill a printer_info_0 struct
  ********************************************************************/
+
 static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum)
 {
        pstring chaine;
@@ -2598,6 +2625,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum)
  * construct_printer_info_1
  * fill a printer_info_1 struct
  ********************************************************************/
+
 static BOOL construct_printer_info_1(uint32 flags, PRINTER_INFO_1 *printer, int snum)
 {
        pstring chaine;
@@ -2795,6 +2823,7 @@ static BOOL construct_printer_info_2(PRINTER_INFO_2 *printer, int snum)
  * construct_printer_info_3
  * fill a printer_info_3 struct
  ********************************************************************/
+
 static BOOL construct_printer_info_3(PRINTER_INFO_3 **pp_printer, int snum)
 {
        NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
@@ -2887,10 +2916,10 @@ static BOOL construct_printer_info_5(PRINTER_INFO_5 *printer, int snum)
        return True;
 }
 
-
 /********************************************************************
  Spoolss_enumprinters.
 ********************************************************************/
+
 static WERROR enum_all_printers_info_1(uint32 flags, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        int snum;
@@ -2945,6 +2974,7 @@ static WERROR enum_all_printers_info_1(uint32 flags, NEW_BUFFER *buffer, uint32
 /********************************************************************
  enum_all_printers_info_1_local.
 *********************************************************************/
+
 static WERROR enum_all_printers_info_1_local(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        DEBUG(4,("enum_all_printers_info_1_local\n"));  
@@ -2955,6 +2985,7 @@ static WERROR enum_all_printers_info_1_local(NEW_BUFFER *buffer, uint32 offered,
 /********************************************************************
  enum_all_printers_info_1_name.
 *********************************************************************/
+
 static WERROR enum_all_printers_info_1_name(fstring name, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        char *s = name;
@@ -2974,6 +3005,7 @@ static WERROR enum_all_printers_info_1_name(fstring name, NEW_BUFFER *buffer, ui
 /********************************************************************
  enum_all_printers_info_1_remote.
 *********************************************************************/
+
 static WERROR enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        PRINTER_INFO_1 *printer;
@@ -3102,6 +3134,7 @@ static WERROR enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint3
 /********************************************************************
  * handle enumeration of printers at level 1
  ********************************************************************/
+
 static WERROR enumprinters_level1( uint32 flags, fstring name,
                                 NEW_BUFFER *buffer, uint32 offered,
                                 uint32 *needed, uint32 *returned)
@@ -3126,6 +3159,7 @@ static WERROR enumprinters_level1( uint32 flags, fstring name,
 /********************************************************************
  * handle enumeration of printers at level 2
  ********************************************************************/
+
 static WERROR enumprinters_level2( uint32 flags, fstring servername,
                                 NEW_BUFFER *buffer, uint32 offered,
                                 uint32 *needed, uint32 *returned)
@@ -3154,6 +3188,7 @@ static WERROR enumprinters_level2( uint32 flags, fstring servername,
 /********************************************************************
  * handle enumeration of printers at level 5
  ********************************************************************/
+
 static WERROR enumprinters_level5( uint32 flags, fstring servername,
                                 NEW_BUFFER *buffer, uint32 offered,
                                 uint32 *needed, uint32 *returned)
@@ -3221,6 +3256,7 @@ WERROR _spoolss_enumprinters( pipes_struct *p, SPOOL_Q_ENUMPRINTERS *q_u, SPOOL_
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinter_level_0(int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_0 *printer=NULL;
@@ -3253,6 +3289,7 @@ static WERROR getprinter_level_0(int snum, NEW_BUFFER *buffer, uint32 offered, u
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinter_level_1(int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_1 *printer=NULL;
@@ -3285,6 +3322,7 @@ static WERROR getprinter_level_1(int snum, NEW_BUFFER *buffer, uint32 offered, u
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinter_level_2(int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_2 *printer=NULL;
@@ -3320,6 +3358,7 @@ static WERROR getprinter_level_2(int snum, NEW_BUFFER *buffer, uint32 offered, u
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinter_level_3(int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_3 *printer=NULL;
@@ -3350,6 +3389,7 @@ static WERROR getprinter_level_3(int snum, NEW_BUFFER *buffer, uint32 offered, u
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinter_level_4(int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_4 *printer=NULL;
@@ -3383,6 +3423,7 @@ static WERROR getprinter_level_4(int snum, NEW_BUFFER *buffer, uint32 offered, u
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinter_level_5(int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_5 *printer=NULL;
@@ -3456,6 +3497,7 @@ WERROR _spoolss_getprinter(pipes_struct *p, SPOOL_Q_GETPRINTER *q_u, SPOOL_R_GET
 /********************************************************************
  * fill a DRIVER_INFO_1 struct
  ********************************************************************/
+
 static void fill_printer_driver_info_1(DRIVER_INFO_1 *info, NT_PRINTER_DRIVER_INFO_LEVEL driver, fstring servername, fstring architecture)
 {
        init_unistr( &info->name, driver.info_3->name);
@@ -3464,6 +3506,7 @@ static void fill_printer_driver_info_1(DRIVER_INFO_1 *info, NT_PRINTER_DRIVER_IN
 /********************************************************************
  * construct_printer_driver_info_1
  ********************************************************************/
+
 static WERROR construct_printer_driver_info_1(DRIVER_INFO_1 *info, int snum, fstring servername, fstring architecture, uint32 version)
 {      
        NT_PRINTER_INFO_LEVEL *printer = NULL;
@@ -3488,6 +3531,7 @@ static WERROR construct_printer_driver_info_1(DRIVER_INFO_1 *info, int snum, fst
  * construct_printer_driver_info_2
  * fill a printer_info_2 struct
  ********************************************************************/
+
 static void fill_printer_driver_info_2(DRIVER_INFO_2 *info, NT_PRINTER_DRIVER_INFO_LEVEL driver, fstring servername)
 {
        pstring temp;
@@ -3521,6 +3565,7 @@ static void fill_printer_driver_info_2(DRIVER_INFO_2 *info, NT_PRINTER_DRIVER_IN
  * construct_printer_driver_info_2
  * fill a printer_info_2 struct
  ********************************************************************/
+
 static WERROR construct_printer_driver_info_2(DRIVER_INFO_2 *info, int snum, fstring servername, fstring architecture, uint32 version)
 {
        NT_PRINTER_INFO_LEVEL *printer = NULL;
@@ -3547,6 +3592,7 @@ static WERROR construct_printer_driver_info_2(DRIVER_INFO_2 *info, int snum, fst
  *
  * convert an array of ascii string to a UNICODE string
  ********************************************************************/
+
 static void init_unistr_array(uint16 **uni_array, fstring *char_array, char *servername)
 {
        int i=0;
@@ -3588,6 +3634,7 @@ static void init_unistr_array(uint16 **uni_array, fstring *char_array, char *ser
  * construct_printer_info_3
  * fill a printer_info_3 struct
  ********************************************************************/
+
 static void fill_printer_driver_info_3(DRIVER_INFO_3 *info, NT_PRINTER_DRIVER_INFO_LEVEL driver, fstring servername)
 {
        pstring temp;
@@ -3634,6 +3681,7 @@ static void fill_printer_driver_info_3(DRIVER_INFO_3 *info, NT_PRINTER_DRIVER_IN
  * construct_printer_info_3
  * fill a printer_info_3 struct
  ********************************************************************/
+
 static WERROR construct_printer_driver_info_3(DRIVER_INFO_3 *info, int snum, fstring servername, fstring architecture, uint32 version)
 {      
        NT_PRINTER_INFO_LEVEL *printer = NULL;
@@ -3756,6 +3804,7 @@ static void fill_printer_driver_info_6(DRIVER_INFO_6 *info, NT_PRINTER_DRIVER_IN
  * construct_printer_info_6
  * fill a printer_info_6 struct
  ********************************************************************/
+
 static WERROR construct_printer_driver_info_6(DRIVER_INFO_6 *info, int snum, fstring servername, fstring architecture, uint32 version)
 {      
        NT_PRINTER_INFO_LEVEL *printer = NULL;
@@ -3816,6 +3865,7 @@ static void free_printer_driver_info_6(DRIVER_INFO_6 *info)
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinterdriver2_level1(fstring servername, fstring architecture, uint32 version, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        DRIVER_INFO_1 *info=NULL;
@@ -3852,6 +3902,7 @@ static WERROR getprinterdriver2_level1(fstring servername, fstring architecture,
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinterdriver2_level2(fstring servername, fstring architecture, uint32 version, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        DRIVER_INFO_2 *info=NULL;
@@ -3888,6 +3939,7 @@ static WERROR getprinterdriver2_level2(fstring servername, fstring architecture,
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinterdriver2_level3(fstring servername, fstring architecture, uint32 version, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        DRIVER_INFO_3 info;
@@ -3921,6 +3973,7 @@ static WERROR getprinterdriver2_level3(fstring servername, fstring architecture,
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinterdriver2_level6(fstring servername, fstring architecture, uint32 version, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        DRIVER_INFO_6 info;
@@ -4152,6 +4205,7 @@ WERROR _spoolss_writeprinter(pipes_struct *p, SPOOL_Q_WRITEPRINTER *q_u, SPOOL_R
  * called from the spoolss dispatcher
  *
  ********************************************************************/
+
 static WERROR control_printer(POLICY_HND *handle, uint32 command,
                              pipes_struct *p)
 {
@@ -4209,6 +4263,7 @@ WERROR _spoolss_abortprinter(pipes_struct *p, SPOOL_Q_ABORTPRINTER *q_u, SPOOL_R
  * called by spoolss_api_setprinter
  * when updating a printer description
  ********************************************************************/
+
 static WERROR update_printer_sec(POLICY_HND *handle, uint32 level,
                                 const SPOOL_PRINTER_INFO_LEVEL *info,
                                 pipes_struct *p, SEC_DESC_BUF *secdesc_ctr)
@@ -4322,6 +4377,7 @@ static BOOL check_printer_ok(NT_PRINTER_INFO_LEVEL_2 *info, int snum)
 
 /****************************************************************************
 ****************************************************************************/
+
 static BOOL add_printer_hook(NT_PRINTER_INFO_LEVEL *printer)
 {
        char *cmd = lp_addprinter_cmd();
@@ -4714,8 +4770,8 @@ static WERROR update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level,
 
        /* Check calling user has permission to update printer description */
 
-       if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("update_printer: printer property change denied by security descriptor\n"));
+       if (Printer->access_granted != PRINTER_ACCESS_ADMINISTER) {
+               DEBUG(3, ("update_printer: printer property change denied by handle\n"));
                result = WERR_ACCESS_DENIED;
                goto done;
        }
@@ -4845,6 +4901,7 @@ WERROR _spoolss_addjob(pipes_struct *p, SPOOL_Q_ADDJOB *q_u, SPOOL_R_ADDJOB *r_u
 
 /****************************************************************************
 ****************************************************************************/
+
 static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
                             int position, int snum)
 {
@@ -4873,6 +4930,7 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
 
 /****************************************************************************
 ****************************************************************************/
+
 static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
                             int position, int snum, 
                            NT_PRINTER_INFO_LEVEL *ntprinter, 
@@ -4922,6 +4980,7 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
 /****************************************************************************
  Enumjobs at level 1.
 ****************************************************************************/
+
 static WERROR enumjobs_level1(print_queue_struct *queue, int snum,
                              NEW_BUFFER *buffer, uint32 offered,
                              uint32 *needed, uint32 *returned)
@@ -4968,6 +5027,7 @@ static WERROR enumjobs_level1(print_queue_struct *queue, int snum,
 /****************************************************************************
  Enumjobs at level 2.
 ****************************************************************************/
+
 static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
                              NEW_BUFFER *buffer, uint32 offered,
                              uint32 *needed, uint32 *returned)
@@ -5146,6 +5206,7 @@ WERROR _spoolss_setjob(pipes_struct *p, SPOOL_Q_SETJOB *q_u, SPOOL_R_SETJOB *r_u
 /****************************************************************************
  Enumerates all printer drivers at level 1.
 ****************************************************************************/
+
 static WERROR enumprinterdrivers_level1(fstring servername, fstring architecture, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        int i;
@@ -5226,6 +5287,7 @@ static WERROR enumprinterdrivers_level1(fstring servername, fstring architecture
 /****************************************************************************
  Enumerates all printer drivers at level 2.
 ****************************************************************************/
+
 static WERROR enumprinterdrivers_level2(fstring servername, fstring architecture, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        int i;
@@ -5307,6 +5369,7 @@ static WERROR enumprinterdrivers_level2(fstring servername, fstring architecture
 /****************************************************************************
  Enumerates all printer drivers at level 3.
 ****************************************************************************/
+
 static WERROR enumprinterdrivers_level3(fstring servername, fstring architecture, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        int i;
@@ -5635,6 +5698,7 @@ WERROR _spoolss_getform(pipes_struct *p, SPOOL_Q_GETFORM *q_u, SPOOL_R_GETFORM *
 
 /****************************************************************************
 ****************************************************************************/
+
 static void fill_port_1(PORT_INFO_1 *port, char *name)
 {
        init_unistr(&port->port_name, name);
@@ -5642,6 +5706,7 @@ static void fill_port_1(PORT_INFO_1 *port, char *name)
 
 /****************************************************************************
 ****************************************************************************/
+
 static void fill_port_2(PORT_INFO_2 *port, char *name)
 {
        init_unistr(&port->port_name, name);
@@ -5655,6 +5720,7 @@ static void fill_port_2(PORT_INFO_2 *port, char *name)
 /****************************************************************************
  enumports level 1.
 ****************************************************************************/
+
 static WERROR enumports_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        PORT_INFO_1 *ports=NULL;
@@ -5873,6 +5939,7 @@ WERROR _spoolss_enumports( pipes_struct *p, SPOOL_Q_ENUMPORTS *q_u, SPOOL_R_ENUM
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR spoolss_addprinterex_level_2( pipes_struct *p, const UNISTR2 *uni_srv_name,
                                const SPOOL_PRINTER_INFO_LEVEL *info,
                                DEVICEMODE *devmode, SEC_DESC_BUF *sec_desc_buf,
@@ -5962,7 +6029,7 @@ static WERROR spoolss_addprinterex_level_2( pipes_struct *p, const UNISTR2 *uni_
                return err;
        }
 
-       if (!open_printer_hnd(p, handle, name)) {
+       if (!open_printer_hnd(p, handle, name, PRINTER_ACCESS_ADMINISTER)) {
                /* Handle open failed - remove addition. */
                del_a_printer(printer->info_2->sharename);
                free_a_printer(&printer,2);
@@ -6051,6 +6118,7 @@ WERROR _spoolss_addprinterdriver(pipes_struct *p, SPOOL_Q_ADDPRINTERDRIVER *q_u,
 
 /****************************************************************************
 ****************************************************************************/
+
 static void fill_driverdir_1(DRIVER_DIRECTORY_1 *info, char *name)
 {
        init_unistr(&info->name, name);
@@ -6058,6 +6126,7 @@ static void fill_driverdir_1(DRIVER_DIRECTORY_1 *info, char *name)
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getprinterdriverdir_level_1(UNISTR2 *name, UNISTR2 *uni_environment, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        pstring path;
@@ -6347,9 +6416,8 @@ WERROR _spoolss_setprinterdata( pipes_struct *p, SPOOL_Q_SETPRINTERDATA *q_u, SP
         * when connecting to a printer  --jerry
         */
 
-       if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("security descriptor change denied by existing "
-                         "security descriptor\n"));
+       if (Printer->access_granted != PRINTER_ACCESS_ADMINISTER) {
+               DEBUG(3, ("_spoolss_setprinterdata: change denied by handle access permissions\n"));
                status = WERR_ACCESS_DENIED;
                goto done;
        }
@@ -6439,9 +6507,8 @@ WERROR _spoolss_deleteprinterdata(pipes_struct *p, SPOOL_Q_DELETEPRINTERDATA *q_
        if (!get_printer_snum(p, handle, &snum))
                return WERR_BADFID;
 
-       if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("_spoolss_deleteprinterdata: printer properties "
-                         "change denied by existing security descriptor\n"));
+       if (Printer->access_granted != PRINTER_ACCESS_ADMINISTER) {
+               DEBUG(3, ("_spoolss_deleteprinterdata: printer properties change denied by handle\n"));
                return WERR_ACCESS_DENIED;
        }
 
@@ -6488,9 +6555,8 @@ WERROR _spoolss_addform( pipes_struct *p, SPOOL_Q_ADDFORM *q_u, SPOOL_R_ADDFORM
        if (!get_printer_snum(p,handle, &snum))
                 return WERR_BADFID;
 
-       if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("security descriptor change denied by existing "
-                         "security descriptor\n"));
+       if (Printer->access_granted != PRINTER_ACCESS_ADMINISTER) {
+               DEBUG(2,("_spoolss_addform: denied by handle permissions.\n"));
                status = WERR_ACCESS_DENIED;
                goto done;
        }
@@ -6550,9 +6616,8 @@ WERROR _spoolss_deleteform( pipes_struct *p, SPOOL_Q_DELETEFORM *q_u, SPOOL_R_DE
        if (!get_printer_snum(p, handle, &snum))
                return WERR_BADFID;
 
-       if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("security descriptor change denied by existing "
-                         "security descriptor\n"));
+       if (Printer->access_granted != PRINTER_ACCESS_ADMINISTER) {
+               DEBUG(2,("_spoolss_deleteform: denied by handle permissions\n"));
                return WERR_ACCESS_DENIED;
        }
 
@@ -6612,9 +6677,8 @@ WERROR _spoolss_setform(pipes_struct *p, SPOOL_Q_SETFORM *q_u, SPOOL_R_SETFORM *
        if (!get_printer_snum(p, handle, &snum))
                return WERR_BADFID;
 
-       if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("security descriptor change denied by existing "
-                         "security descriptor\n"));
+       if (Printer->access_granted != PRINTER_ACCESS_ADMINISTER) {
+               DEBUG(2,("_spoolss_setform: denied by handle permissions\n"));
                return WERR_ACCESS_DENIED;
        }
 
@@ -6649,6 +6713,7 @@ done:
 /****************************************************************************
  enumprintprocessors level 1.
 ****************************************************************************/
+
 static WERROR enumprintprocessors_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        PRINTPROCESSOR_1 *info_1=NULL;
@@ -6717,6 +6782,7 @@ WERROR _spoolss_enumprintprocessors(pipes_struct *p, SPOOL_Q_ENUMPRINTPROCESSORS
 /****************************************************************************
  enumprintprocdatatypes level 1.
 ****************************************************************************/
+
 static WERROR enumprintprocdatatypes_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        PRINTPROCDATATYPE_1 *info_1=NULL;
@@ -6810,6 +6876,7 @@ static WERROR enumprintmonitors_level_1(NEW_BUFFER *buffer, uint32 offered, uint
 /****************************************************************************
  enumprintmonitors level 2.
 ****************************************************************************/
+
 static WERROR enumprintmonitors_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        PRINTMONITOR_2 *info_2=NULL;
@@ -6880,6 +6947,7 @@ WERROR _spoolss_enumprintmonitors(pipes_struct *p, SPOOL_Q_ENUMPRINTMONITORS *q_
 
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getjob_level_1(print_queue_struct *queue, int count, int snum, uint32 jobid, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        int i=0;
@@ -6926,9 +6994,9 @@ static WERROR getjob_level_1(print_queue_struct *queue, int count, int snum, uin
        return WERR_OK;
 }
 
-
 /****************************************************************************
 ****************************************************************************/
+
 static WERROR getjob_level_2(print_queue_struct *queue, int count, int snum, uint32 jobid, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        int i=0;