The branch, v4-10-test has been updated
       via  0b6c23def7b s3: utils: smbtree. Ensure we don't call 
cli_RNetShareEnum() on an SMB1 connection.
       via  dd946f54f6f s3: libsmb: Ensure we don't call cli_RNetShareEnum() on 
an SMB1 connection.
       via  7fe9b58d665 s3:printing: Fix %J substition
       via  c7013a9f905 s3:printing: add a DEBUG statement
       via  136a1553f6c s3:lib: factor out talloc_sub_advanced() from 
talloc_sub_full()
       via  3a9fa54ca0e s3: rename talloc_sub_advanced() to talloc_sub_full()
       via  eb304625299 s3: remove unused function standard_sub_advanced()
       via  046fe483012 s3: replace standard_sub_advanced with 
talloc_sub_advanced in one place
       via  2f6ec2e6aa5 s3:printing: fix a long line
      from  33142a8fe9b lib/adouble: pass filesize to ad_unpack()

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-10-test


- Log -----------------------------------------------------------------
commit 0b6c23def7b2d902c6e6423e90d02f0c17e4cfe5
Author: Jeremy Allison <j...@samba.org>
Date:   Tue Oct 29 12:11:49 2019 -0700

    s3: utils: smbtree. Ensure we don't call cli_RNetShareEnum() on an SMB1 
connection.
    
    Last unprotected call of cli_RNetShareEnum(). Not a libsmbclient
    bug here but might as well fix the last caller as part of the
    fix for the bug.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14174
    
    Signed-off-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit f30b8b3aa1309e9daeb9a3601b537dead81e5dbb)
    
    Autobuild-User(v4-10-test): Karolin Seeger <ksee...@samba.org>
    Autobuild-Date(v4-10-test): Mon Nov 18 12:55:39 UTC 2019 on sn-devel-144

commit dd946f54f6f75a50ef50618171fb90cdb4eceb43
Author: Jeremy Allison <j...@samba.org>
Date:   Tue Oct 29 12:11:01 2019 -0700

    s3: libsmb: Ensure we don't call cli_RNetShareEnum() on an SMB1 connection.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=14174
    
    Signed-off-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Ralph Boehme <s...@samba.org>
    (cherry picked from commit 1cfcad6283da855d3e97237a7a6fd6f4d2436ee2)

commit 7fe9b58d665b097b907b3f2994577521b08e2dc1
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 12:46:38 2019 +0100

    s3:printing: Fix %J substition
    
    print_run_command() uses lp_print_command() which internally performs basic
    substition by calling talloc_sub_basic(). As a result. any of the variables 
in
    the "basic set", including "%J" are already substituted.
    
    To prevent the unwanted subtitution, we declare all affected configuration
    options as const, which disabled the basic substition.
    
    As a result print_run_command() can run manual substitution on all 
characters,
    including %J, in the variadic argument list *before* calling lp_string() to 
run
    basic substition which we had disabled before with the const.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    
    Autobuild-User(master): Andreas Schneider <a...@cryptomilk.org>
    Autobuild-Date(master): Thu Nov  7 16:01:21 UTC 2019 on sn-devel-184
    
    (cherry picked from commit 8846887a55b0c97a1639fc6ecb228941cf16b8f2)

commit c7013a9f905f24b6bc592ca60cf434a2c91891d9
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 12:03:31 2019 +0100

    s3:printing: add a DEBUG statement
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    (cherry picked from commit ede00779ab2d881e061adb9d861879e8c68e272b)

commit 136a1553f6c3e75a3b69055bf2eabea8106cc081
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 11:57:39 2019 +0100

    s3:lib: factor out talloc_sub_advanced() from talloc_sub_full()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    (cherry picked from commit 41ab92b62fbf029374b89f9d0ddf7578981f37cf)

commit 3a9fa54ca0eb8102c04689d5c3924610353711de
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 12:45:44 2019 +0100

    s3: rename talloc_sub_advanced() to talloc_sub_full()
    
    We currently have the following substitution functions:
    
      talloc_sub_basic()
      talloc_sub_advanced()
    
    talloc_sub_basic() currently substitutes a subset of talloc_sub_advanced().
    
    We'll need a function X that only substitutes what talloc_sub_advanced()
    substitutes *without* what talloc_sub_basic() does.
    
    To get there rename talloc_sub_advanced() to talloc_sub_full(). A subsequent
    commit will then bring back talloc_sub_advanced() as described above.
    
    Examples with fictional replacement letters A and B. Currently:
    
      talloc_sub_basic:    A
      talloc_sub_advanced: AB
    
    New:
    
      talloc_sub_basic:    A
      talloc_sub_advanced:  B
      talloc_sub_full:     AB
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    (backported from commit 4736623c24503b3ca09c76c9dbb134ef833b2f80)

commit eb30462529983cdd5cf30ec9385f2191e8ba2b3b
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 10:19:13 2019 +0100

    s3: remove unused function standard_sub_advanced()
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    (cherry picked from commit a591de28659919d2afd7ed55106cded6a0d9ab35)

commit 046fe48301216c384b9a6ad78579a726c35eaf22
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 12:44:45 2019 +0100

    s3: replace standard_sub_advanced with talloc_sub_advanced in one place
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    (cherry picked from commit 81ae199bb72886f2f1ed87b22b4c75b6b99c72f6)

commit 2f6ec2e6aa52e914fbc5b470d0c720ea1d086bdd
Author: Ralph Boehme <s...@samba.org>
Date:   Thu Oct 31 12:43:25 2019 +0100

    s3:printing: fix a long line
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13745
    
    Signed-off-by: Ralph Boehme <s...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    (cherry picked from commit dcb555c06a6341871b691dab3758e7de04110282)

-----------------------------------------------------------------------

Summary of changes:
 docs-xml/smbdotconf/printing/lppausecommand.xml    |  1 +
 docs-xml/smbdotconf/printing/lpqcommand.xml        |  1 +
 docs-xml/smbdotconf/printing/lpresumecommand.xml   |  1 +
 docs-xml/smbdotconf/printing/lprmcommand.xml       |  1 +
 docs-xml/smbdotconf/printing/printcommand.xml      |  1 +
 docs-xml/smbdotconf/printing/queuepausecommand.xml |  1 +
 .../smbdotconf/printing/queueresumecommand.xml     |  1 +
 source3/include/proto.h                            |  8 ++---
 source3/lib/substitute.c                           | 38 ++++++++++++----------
 source3/libsmb/libsmb_dir.c                        |  7 +++-
 source3/modules/vfs_expand_msdfs.c                 |  2 +-
 source3/modules/vfs_full_audit.c                   |  2 +-
 source3/modules/vfs_recycle.c                      |  2 +-
 source3/modules/vfs_virusfilter_utils.c            |  2 +-
 source3/printing/print_generic.c                   | 19 +++++++----
 source3/printing/printing.c                        | 29 ++++++++++-------
 source3/rpc_server/srvsvc/srv_srvsvc_nt.c          | 10 +++---
 source3/smbd/lanman.c                              |  4 +--
 source3/smbd/service.c                             | 10 +++---
 source3/utils/smbtree.c                            |  5 +++
 source3/utils/testparm.c                           |  2 +-
 21 files changed, 89 insertions(+), 58 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/printing/lppausecommand.xml 
b/docs-xml/smbdotconf/printing/lppausecommand.xml
index 3aa134c4377..f2518d3def0 100644
--- a/docs-xml/smbdotconf/printing/lppausecommand.xml
+++ b/docs-xml/smbdotconf/printing/lppausecommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="lppause command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
 <description>
     <para>This parameter specifies the command to be 
diff --git a/docs-xml/smbdotconf/printing/lpqcommand.xml 
b/docs-xml/smbdotconf/printing/lpqcommand.xml
index f3c17f286d1..f0161f3448d 100644
--- a/docs-xml/smbdotconf/printing/lpqcommand.xml
+++ b/docs-xml/smbdotconf/printing/lpqcommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="lpq command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
  <description>
     <para>This parameter specifies the command to be 
diff --git a/docs-xml/smbdotconf/printing/lpresumecommand.xml 
b/docs-xml/smbdotconf/printing/lpresumecommand.xml
index 153ba76a693..2cee574bd73 100644
--- a/docs-xml/smbdotconf/printing/lpresumecommand.xml
+++ b/docs-xml/smbdotconf/printing/lpresumecommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="lpresume command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
 <description>
     <para>This parameter specifies the command to be 
diff --git a/docs-xml/smbdotconf/printing/lprmcommand.xml 
b/docs-xml/smbdotconf/printing/lprmcommand.xml
index 4b7f3dd75c3..a595c1225c0 100644
--- a/docs-xml/smbdotconf/printing/lprmcommand.xml
+++ b/docs-xml/smbdotconf/printing/lprmcommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="lprm command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
 <description>
     <para>This parameter specifies the command to be 
diff --git a/docs-xml/smbdotconf/printing/printcommand.xml 
b/docs-xml/smbdotconf/printing/printcommand.xml
index c84e45f404d..42a7188cb9a 100644
--- a/docs-xml/smbdotconf/printing/printcommand.xml
+++ b/docs-xml/smbdotconf/printing/printcommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="print command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
 <description>
     <para>After a print job has finished spooling to 
diff --git a/docs-xml/smbdotconf/printing/queuepausecommand.xml 
b/docs-xml/smbdotconf/printing/queuepausecommand.xml
index 5dca45657cc..600a2baa621 100644
--- a/docs-xml/smbdotconf/printing/queuepausecommand.xml
+++ b/docs-xml/smbdotconf/printing/queuepausecommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="queuepause command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
 <description>
     <para>This parameter specifies the command to be 
diff --git a/docs-xml/smbdotconf/printing/queueresumecommand.xml 
b/docs-xml/smbdotconf/printing/queueresumecommand.xml
index 4a573330048..431295a804e 100644
--- a/docs-xml/smbdotconf/printing/queueresumecommand.xml
+++ b/docs-xml/smbdotconf/printing/queueresumecommand.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="queueresume command"
                  context="S"
                  type="string"
+                 constant="1"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
 <description>
     <para>This parameter specifies the command to be 
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 9d6192967ba..e6ac3ffce1f 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -181,14 +181,14 @@ char *talloc_sub_specified(TALLOC_CTX *mem_ctx,
                        uid_t uid,
                        gid_t gid);
 char *talloc_sub_advanced(TALLOC_CTX *mem_ctx,
+                         const char *servicename, const char *user,
+                         const char *connectpath, gid_t gid,
+                         const char *str);
+char *talloc_sub_full(TALLOC_CTX *mem_ctx,
                          const char *servicename, const char *user,
                          const char *connectpath, gid_t gid,
                          const char *smb_name, const char *domain_name,
                          const char *str);
-void standard_sub_advanced(const char *servicename, const char *user,
-                          const char *connectpath, gid_t gid,
-                          const char *smb_name, const char *domain_name,
-                          char *str, size_t len);
 
 /* The following definitions come from lib/sysquotas.c  */
 
diff --git a/source3/lib/substitute.c b/source3/lib/substitute.c
index ea227c5ab68..95369b838ea 100644
--- a/source3/lib/substitute.c
+++ b/source3/lib/substitute.c
@@ -795,16 +795,14 @@ char *talloc_sub_advanced(TALLOC_CTX *ctx,
                        const char *user,
                        const char *connectpath,
                        gid_t gid,
-                       const char *smb_name,
-                       const char *domain_name,
                        const char *str)
 {
-       char *a_string, *ret_string;
+       char *a_string;
        char *b, *p, *s;
 
        a_string = talloc_strdup(talloc_tos(), str);
        if (a_string == NULL) {
-               DEBUG(0, ("talloc_sub_advanced: Out of memory!\n"));
+               DEBUG(0, ("talloc_sub_advanced_only: Out of memory!\n"));
                return NULL;
        }
 
@@ -858,25 +856,29 @@ char *talloc_sub_advanced(TALLOC_CTX *ctx,
                }
        }
 
-       ret_string = talloc_sub_basic(ctx, smb_name, domain_name, a_string);
-       TALLOC_FREE(a_string);
-       return ret_string;
+       return a_string;
 }
 
-void standard_sub_advanced(const char *servicename, const char *user,
-                          const char *connectpath, gid_t gid,
-                          const char *smb_name, const char *domain_name,
-                          char *str, size_t len)
+char *talloc_sub_full(TALLOC_CTX *ctx,
+                       const char *servicename,
+                       const char *user,
+                       const char *connectpath,
+                       gid_t gid,
+                       const char *smb_name,
+                       const char *domain_name,
+                       const char *str)
 {
-       char *s = talloc_sub_advanced(talloc_tos(),
-                               servicename, user, connectpath,
-                               gid, smb_name, domain_name, str);
+       char *a_string, *ret_string;
 
-       if (!s) {
-               return;
+       a_string = talloc_sub_advanced(ctx, servicename, user, connectpath,
+                                      gid, str);
+       if (a_string == NULL) {
+               return NULL;
        }
-       strlcpy( str, s, len );
-       TALLOC_FREE( s );
+
+       ret_string = talloc_sub_basic(ctx, smb_name, domain_name, a_string);
+       TALLOC_FREE(a_string);
+       return ret_string;
 }
 
 /******************************************************************************
diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c
index df606c4adfe..ab20a127c49 100644
--- a/source3/libsmb/libsmb_dir.c
+++ b/source3/libsmb/libsmb_dir.c
@@ -856,7 +856,12 @@ SMBC_opendir_ctx(SMBCCTX *context,
                                                        list_fn,
                                                        (void *)dir);
                                if (rc != 0 &&
-                                   lp_client_min_protocol() <= PROTOCOL_NT1) {
+                                   smbXcli_conn_protocol(srv->cli->conn) <=
+                                               PROTOCOL_NT1) {
+                                       /*
+                                        * Only call cli_RNetShareEnum()
+                                        * on SMB1 connections, not SMB2+.
+                                        */
                                        rc = cli_RNetShareEnum(srv->cli,
                                                               list_fn,
                                                               (void *)dir);
diff --git a/source3/modules/vfs_expand_msdfs.c 
b/source3/modules/vfs_expand_msdfs.c
index 598da08c0c8..ccd124ac617 100644
--- a/source3/modules/vfs_expand_msdfs.c
+++ b/source3/modules/vfs_expand_msdfs.c
@@ -154,7 +154,7 @@ static char *expand_msdfs_target(TALLOC_CTX *ctx,
                return NULL;
        }
 
-       targethost = talloc_sub_advanced(ctx,
+       targethost = talloc_sub_full(ctx,
                                lp_servicename(talloc_tos(), SNUM(conn)),
                                conn->session_info->unix_info->unix_name,
                                conn->connectpath,
diff --git a/source3/modules/vfs_full_audit.c b/source3/modules/vfs_full_audit.c
index fcfb024d493..8b04e55444e 100644
--- a/source3/modules/vfs_full_audit.c
+++ b/source3/modules/vfs_full_audit.c
@@ -485,7 +485,7 @@ static char *audit_prefix(TALLOC_CTX *ctx, 
connection_struct *conn)
        if (!prefix) {
                return NULL;
        }
-       result = talloc_sub_advanced(ctx,
+       result = talloc_sub_full(ctx,
                        lp_servicename(talloc_tos(), SNUM(conn)),
                        conn->session_info->unix_info->unix_name,
                        conn->connectpath,
diff --git a/source3/modules/vfs_recycle.c b/source3/modules/vfs_recycle.c
index e84f0351c87..0b7b820f18b 100644
--- a/source3/modules/vfs_recycle.c
+++ b/source3/modules/vfs_recycle.c
@@ -460,7 +460,7 @@ static int recycle_unlink(vfs_handle_struct *handle,
        bool exist;
        int rc = -1;
 
-       repository = talloc_sub_advanced(NULL, lp_servicename(talloc_tos(), 
SNUM(conn)),
+       repository = talloc_sub_full(NULL, lp_servicename(talloc_tos(), 
SNUM(conn)),
                                        
conn->session_info->unix_info->unix_name,
                                        conn->connectpath,
                                        conn->session_info->unix_token->gid,
diff --git a/source3/modules/vfs_virusfilter_utils.c 
b/source3/modules/vfs_virusfilter_utils.c
index f56fc6ed5d8..8ec61a0c8f2 100644
--- a/source3/modules/vfs_virusfilter_utils.c
+++ b/source3/modules/vfs_virusfilter_utils.c
@@ -35,7 +35,7 @@ char *virusfilter_string_sub(
        connection_struct *conn,
        const char *str)
 {
-       return talloc_sub_advanced(mem_ctx,
+       return talloc_sub_full(mem_ctx,
                lp_servicename(mem_ctx, SNUM(conn)),
                conn->session_info->unix_info->unix_name,
                conn->connectpath,
diff --git a/source3/printing/print_generic.c b/source3/printing/print_generic.c
index b6b50062caf..574f357c76c 100644
--- a/source3/printing/print_generic.c
+++ b/source3/printing/print_generic.c
@@ -56,6 +56,8 @@ static int print_run_command(int snum, const char* 
printername, bool do_sub,
                return -1;
        }
 
+       DBG_DEBUG("Incoming command '%s'\n", syscmd);
+
        while ((arg = va_arg(ap, char *))) {
                char *value = va_arg(ap,char *);
                syscmd = talloc_string_sub(ctx, syscmd, arg, value);
@@ -71,14 +73,17 @@ static int print_run_command(int snum, const char* 
printername, bool do_sub,
                return -1;
        }
 
+       syscmd = lp_string(ctx, syscmd);
+       if (syscmd == NULL) {
+               return -1;
+       }
+
        if (do_sub && snum != -1) {
                syscmd = talloc_sub_advanced(ctx,
                                lp_servicename(talloc_tos(), snum),
                                current_user_info.unix_name,
                                "",
                                get_current_gid(NULL),
-                               get_current_username(),
-                               current_user_info.domain,
                                syscmd);
                if (!syscmd) {
                        return -1;
@@ -118,7 +123,7 @@ static int generic_job_pause(int snum, struct printjob 
*pjob)
        /* need to pause the spooled entry */
        slprintf(jobstr, sizeof(jobstr)-1, "%d", pjob->sysjob);
        return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
-                                lp_lppause_command(talloc_tos(), snum), NULL,
+                                lp_lppause_command(snum), NULL,
                                 "%j", jobstr,
                                 NULL);
 }
@@ -133,7 +138,7 @@ static int generic_job_resume(int snum, struct printjob 
*pjob)
        /* need to pause the spooled entry */
        slprintf(jobstr, sizeof(jobstr)-1, "%d", pjob->sysjob);
        return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
-                                lp_lpresume_command(talloc_tos(), snum), NULL,
+                                lp_lpresume_command(snum), NULL,
                                 "%j", jobstr,
                                 NULL);
 }
@@ -255,7 +260,7 @@ static int generic_job_submit(int snum, struct printjob 
*pjob,
 
        /* send it to the system spooler */
        ret = print_run_command(snum, lp_printername(talloc_tos(), snum), True,
-                       lp_print_command(talloc_tos(), snum), NULL,
+                       lp_print_command(snum), NULL,
                        "%s", p,
                        "%J", jobname,
                        "%f", p,
@@ -308,7 +313,7 @@ static int generic_job_submit(int snum, struct printjob 
*pjob,
 static int generic_queue_pause(int snum)
 {
        return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
-                                lp_queuepause_command(talloc_tos(), snum), 
NULL, NULL);
+                                lp_queuepause_command(snum), NULL, NULL);
 }
 
 /****************************************************************************
@@ -317,7 +322,7 @@ static int generic_queue_pause(int snum)
 static int generic_queue_resume(int snum)
 {
        return print_run_command(snum, lp_printername(talloc_tos(), snum), True,
-                                lp_queueresume_command(talloc_tos(), snum), 
NULL, NULL);
+                                lp_queueresume_command(snum), NULL, NULL);
 }
 
 /****************************************************************************
diff --git a/source3/printing/printing.c b/source3/printing/printing.c
index e6caaa1222f..0f4db52e011 100644
--- a/source3/printing/printing.c
+++ b/source3/printing/printing.c
@@ -1717,14 +1717,14 @@ static void print_queue_update(struct messaging_context 
*msg_ctx,
        /* don't strip out characters like '$' from the printername */
 
        lpqcommand = talloc_string_sub2(ctx,
-                       lp_lpq_command(talloc_tos(), snum),
+                       lp_lpq_command(snum),
                        "%p",
                        lp_printername(talloc_tos(), snum),
                        false, false, false);
        if (!lpqcommand) {
                return;
        }
-       lpqcommand = talloc_sub_advanced(ctx,
+       lpqcommand = talloc_sub_full(ctx,
                        lp_servicename(talloc_tos(), snum),
                        current_user_info.unix_name,
                        "",
@@ -1737,14 +1737,14 @@ static void print_queue_update(struct messaging_context 
*msg_ctx,
        }
 
        lprmcommand = talloc_string_sub2(ctx,
-                       lp_lprm_command(talloc_tos(), snum),
+                       lp_lprm_command(snum),
                        "%p",
                        lp_printername(talloc_tos(), snum),
                        false, false, false);
        if (!lprmcommand) {
                return;
        }
-       lprmcommand = talloc_sub_advanced(ctx,
+       lprmcommand = talloc_sub_full(ctx,
                        lp_servicename(talloc_tos(), snum),
                        current_user_info.unix_name,
                        "",
@@ -2199,7 +2199,7 @@ static bool print_job_delete1(struct tevent_context *ev,
        {
                result = (*(current_printif->job_delete))(
                        lp_printername(talloc_tos(), snum),
-                       lp_lprm_command(talloc_tos(), snum),
+                       lp_lprm_command(snum),
                        pjob);
 
                /* Delete the tdb entry if the delete succeeded or the job 
hasn't
@@ -2819,7 +2819,7 @@ WERROR print_job_start(const struct auth_session_info 
*server_info,
                       struct spoolss_DeviceMode *devmode, uint32_t *_jobid)
 {
        uint32_t jobid;
-       char *path;
+       char *path = NULL, *userstr = NULL;
        struct printjob pjob;
        const char *sharename = lp_const_servicename(snum);
        struct tdb_print_db *pdb = get_print_db_byname(sharename);
@@ -2866,12 +2866,19 @@ WERROR print_job_start(const struct auth_session_info 
*server_info,
 
        fstrcpy(pjob.clientmachine, clientmachine);
 
-       fstrcpy(pjob.user, lp_printjob_username(snum));
-       standard_sub_advanced(sharename, 
server_info->unix_info->sanitized_username,
+       userstr = talloc_sub_full(talloc_tos(),
+                             sharename,
+                             server_info->unix_info->sanitized_username,
                              path, server_info->unix_token->gid,
                              server_info->unix_info->sanitized_username,
                              server_info->info->domain_name,
-                             pjob.user, sizeof(pjob.user));
+                             lp_printjob_username(snum));
+       if (userstr == NULL) {
+               werr = WERR_NOT_ENOUGH_MEMORY;
+               goto fail;
+       }
+       strlcpy(pjob.user, userstr, sizeof(pjob.user));
+       TALLOC_FREE(userstr);
 
        fstrcpy(pjob.queuename, lp_const_servicename(snum));
 
@@ -3020,7 +3027,7 @@ NTSTATUS print_job_end(struct messaging_context *msg_ctx, 
int snum,
 
        /* don't strip out characters like '$' from the printername */
        lpq_cmd = talloc_string_sub2(tmp_ctx,
-                                    lp_lpq_command(talloc_tos(), snum),
+                                    lp_lpq_command(snum),
                                     "%p",
                                     lp_printername(talloc_tos(), snum),
                                     false, false, false);
@@ -3028,7 +3035,7 @@ NTSTATUS print_job_end(struct messaging_context *msg_ctx, 
int snum,
                status = NT_STATUS_PRINT_CANCELLED;
                goto fail;
        }
-       lpq_cmd = talloc_sub_advanced(tmp_ctx,
+       lpq_cmd = talloc_sub_full(tmp_ctx,
                                      lp_servicename(talloc_tos(), snum),
                                      current_user_info.unix_name,
                                      "",
diff --git a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c 
b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
index 2f318550dec..0976e158ab6 100644
--- a/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srvsvc/srv_srvsvc_nt.c
@@ -226,7 +226,7 @@ static void init_srv_share_info_1(struct pipes_struct *p,
        char *remark = lp_comment(p->mem_ctx, snum);
 
        if (remark) {
-               remark = talloc_sub_advanced(
+               remark = talloc_sub_full(
                        p->mem_ctx, lp_servicename(talloc_tos(), snum),
                        get_current_username(), lp_path(talloc_tos(), snum),
                        p->session_info->unix_token->uid, 
get_current_username(),
@@ -254,7 +254,7 @@ static void init_srv_share_info_2(struct pipes_struct *p,
 
        remark = lp_comment(p->mem_ctx, snum);
        if (remark) {
-               remark = talloc_sub_advanced(
+               remark = talloc_sub_full(
                        p->mem_ctx, lp_servicename(talloc_tos(), snum),
                        get_current_username(), lp_path(talloc_tos(), snum),
                        p->session_info->unix_token->uid, 
get_current_username(),
@@ -319,7 +319,7 @@ static void init_srv_share_info_501(struct pipes_struct *p,
        char *remark = lp_comment(p->mem_ctx, snum);
 
        if (remark) {
-               remark = talloc_sub_advanced(
+               remark = talloc_sub_full(
                        p->mem_ctx, lp_servicename(talloc_tos(), snum),
                        get_current_username(), lp_path(talloc_tos(), snum),
                        p->session_info->unix_token->uid, 
get_current_username(),
@@ -353,7 +353,7 @@ static void init_srv_share_info_502(struct pipes_struct *p,
        char *remark = lp_comment(ctx, snum);
 
        if (remark) {
-               remark = talloc_sub_advanced(
+               remark = talloc_sub_full(
                        p->mem_ctx, lp_servicename(talloc_tos(), snum),
                        get_current_username(), lp_path(talloc_tos(), snum),
                        p->session_info->unix_token->uid, 
get_current_username(),
@@ -394,7 +394,7 @@ static void init_srv_share_info_1004(struct pipes_struct *p,
        char *remark = lp_comment(p->mem_ctx, snum);
 
        if (remark) {
-               remark = talloc_sub_advanced(
+               remark = talloc_sub_full(
                        p->mem_ctx, lp_servicename(talloc_tos(), snum),
                        get_current_username(), lp_path(talloc_tos(), snum),
                        p->session_info->unix_token->uid, 
get_current_username(),
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 9637194f697..0d86ccc9153 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -115,7 +115,7 @@ static int CopyExpanded(connection_struct *conn,
                *p_space_remaining = 0;
                return 0;
        }
-       buf = talloc_sub_advanced(ctx,
+       buf = talloc_sub_full(ctx,
                                  lp_servicename(ctx, SNUM(conn)),
                                conn->session_info->unix_info->unix_name,
                                conn->connectpath,
@@ -166,7 +166,7 @@ static int StrlenExpanded(connection_struct *conn, int 
snum, char *s)
        if (!buf) {
                return 0;
        }
-       buf = talloc_sub_advanced(ctx,
+       buf = talloc_sub_full(ctx,
                                  lp_servicename(ctx, SNUM(conn)),
                                conn->session_info->unix_info->unix_name,
                                conn->connectpath,
diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index d7c85d8b6ca..fd23d1a2d60 100644
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -583,7 +583,7 @@ static NTSTATUS make_connection_snum(struct 
smbXsrv_connection *xconn,
        conn->vuid = vuser->vuid;
 
        {
-               char *s = talloc_sub_advanced(talloc_tos(),
+               char *s = talloc_sub_full(talloc_tos(),


-- 
Samba Shared Repository

Reply via email to