attachment-0001
Hi,<br><br>I generally agree with Mike's comments below.<br><br>But I really dislike a boolean that defaults to 'true' - this<br>needs work.<br><br>Cheers,<br>- Ira<br><br clear="all">Ira McDonald (Musician / Software Architect)<br>
Chair - Linux Foundation Open Printing WG<br>Blue Roof Music/High North Inc<br>email: <a href="mailto:blueroofmusic@gmail.com">blueroofmusic@gmail.com</a><br>winter:<br> 579 Park Place Saline, MI 48176<br> 734-944-0094<br>
summer:<br> PO Box 221 Grand Marais, MI 49839<br> 906-494-2434<br>
<br><br><div class="gmail_quote">On Fri, Oct 2, 2009 at 11:53 AM, Michael Sweet <span dir="ltr"><<a href="mailto:msweet@apple.com">msweet@apple.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div style="word-wrap: break-word;"><div><div>Comments inline...</div><div><br></div><div>On Sep 30, 2009, at 7:10 PM, Tom Hastings wrote:</div><blockquote type="cite">
<div link="blue" vlink="purple" lang="EN-US">
<div><p><font face="Courier New" size="2"><span style="font-size: 10pt;">I'm struggling mightily to write up the Cancel-Job and Purge-Job
operations as suggested by Michael and have come up with a bunch of
issues. Since HTML may not come through the email reflector with the 5
MS-WORD ISSUE comments intact and the table shown, I’ve also downloaded
the .doc of just these attributes with my suggested descriptions and the ISSUES
as MS-WORD comments to: <a href="ftp://ftp.pwg.org/pub/pwg/ipp/wd/Attributes_to_add_to_Cancel-Job_and_Purge-Jobs_operations.doc" target="_blank">ftp://ftp.pwg.org/pub/pwg/ipp/wd/Attributes_to_add_to_Cancel-Job_and_Purge-Jobs_operations.doc</a>.
</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">The 5 ISSUES are as follows:</span></font></p><p>
<font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="background: red none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE 1</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: Allowing
an unprivileged user to purge his job using Cancel-Job, could circumvent
accounting in those systems that use Retained Jobs and Job History for
accounting.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Xerox Office" size="2"><span style="background: red none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE 2</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: </span></font><font face="Courier New"><span style="background: yellow none repeat scroll 0% 0%; font-family: "Courier New"; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">Allowing an unprivileged user to purge his
jobs using Purge-Jobs, could circumvent accounting in those systems that use
Retained Jobs and Job History for accounting.</span></font></p><p><font face="Courier New" size="2"><span style="background: yellow none repeat scroll 0% 0%; font-size: 10pt; font-family: "Courier New"; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">One solution would be to
only allow Purge-Jobs for operator or administrator as in [RFC 2911].</span></font></p><p><font face="Courier New" size="2"><span style="background: red none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE 3</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: Instead
of adding “my-jobs” and “purge-job” to Purge-Jobs, a
simpler way to allow an unprivileged user to cancel all his jobs, instead of
just a specified job, would be to add “all-my-jobs” (boolean)
Operation attribute to the Cancel-Job operation. When the client supplies
this attribute with a ‘true’ value, the client MUST NOT supply a
“job-id” or “job-url” Operation attribute.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="background: red none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE 4</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: Or
should the spec say the Printer MUST reject the Purge-Jobs operation if the
unprivileged client supplies the “my-jobs” = ‘false’
and return: client-error-forbidden, client-error-not-authenticated, and
client-error-not-authorized as appropriate, as for Purge-Jobs in RFC 2911
section 3.2.9</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="background: red none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE 5</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: The
“purge-job” (boolean) Operation attribute has the
‘true’ value here as its default. Usually, it’s the
‘false’ value that is the default. More confusingly, the
“purge-job” (boolean) Operation attribute (correctly) has the
‘false’ value in the Cancel-Job operation above.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">I’ve included the text in the draft which I will post tomorrow
for this Monday’s IPP WG telecon, October 5, at 1:00 PM PDT = 4:00 PM EDT,
but I wanted to start people thinking about these issues. Hopefully, we
can resolve these issues at the meeting so that I can update the draft for the
face to face meeting in Cupertino,
the following week, October 12-14.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Here is what I've come up with. Comments and suggestions are
welcome:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<h2 style="margin-left: 0in; text-indent: 0in;"><b><font face="Arial" size="3"><span style="font-size: 12pt;">4.3 Cancel-Job operation</span></font></b></h2><p><font face="Arial" size="2"><span style="font-size: 10pt;">This
section specified an additional operation attribute for use with the
Cancel-Jobs operation (see [RFC2911] Section 3.3.3).</span></font></p>
<h3 style="margin-left: 0in; text-indent: 0in;"><b><font face="Arial" size="3"><span style="font-size: 12pt;">4.3.1 <a>purge-job</a></span></font></b><span><font face="Xerox Office"><span style="font-family: "Xerox Office"; font-weight: normal;"><a language="JavaScript" name="12415f4bfc6b9251__msoanchor_1">[th1]</a> </span></font></span><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office"; font-weight: normal;"> </span></font></span>
(boolean)</h3><p><font face="Arial" size="2"><span style="font-size: 10pt;">The
“purge-job” Operation attribute controls whether the specified job
is canceled or purged as follows:</span></font></p><p style="margin-left: 1in;"><font face="Arial" size="2"><span style="font-size: 10pt;">‘false’: Default
value. The Printer cancels the specified job as specified in [RFC2911]
Section 3.3.3 which MAY leave a Retained Job with document data on the Printer
for possible re-processing (e.g., using the Reprocess-Job or Resubmit-Job
operations) and/or Job History. Note: If the client omits this attribute
or supplies the ‘false’ value, the behavior of the Cancel-Job
operation is as specified in [RFC2911].</span></font></p><p style="margin-left: 1in;"><font face="Arial" size="2"><span style="font-size: 10pt;">‘true’: If
the authenticated user is the job owner of the job specified by the
“job-id” or “job-uri” operation attribute or is a
privileged operator or administrator of the Printer, the Printer MUST purge the
specified job according to the semantics of the Purge-Jobs operation
independent of the job’s state, but only for the specified job, i.e.,
remove all record of the specified job, including attributes, history and
document data. </span></font></p><p><font face="Arial" size="2"><span style="font-size: 10pt;">The
client MAY supply this Operation attribute and the Printer MAY support this
Operation attribute in the Cancel-Job operation.</span></font></p></div></div></blockquote><div><br></div><div>I'd just make the authenticated user case more generic, and also document that Cancel-Jobs with purge-jobs=true will fail if the user is not authorized, e.g.:</div>
</div><div><br></div><blockquote style="border: medium none ; margin: 0pt 0pt 0pt 40px; padding: 0px;">‘true’: If the authenticated user is allowed to purge a job by the Printer's security policy (typically if the owner of the job specified by the “job-id” or “job-uri” operation attribute matches) or is a privileged operator or administrator of the Printer, the Printer MUST purge the specified job according to the semantics of the Purge-Jobs operation independent of the job’s state, but only for the specified job, i.e., remove all record of the specified job, including attributes, history and document data. Otherwise, the IPP object MUST reject the operation and return: client-error-forbidden, client-error-not-authenticated, and client-error-not-authorized as appropriate.</blockquote>
<div><br></div>The wording of the last sentence matches RFC 2911's Purge-Jobs description.<br><div><blockquote type="cite"><div link="blue" vlink="purple" lang="EN-US"><div><p><font face="Arial" size="2"><span style="font-size: 10pt;"></span></font></p>
<h2 style="margin-left: 0.25in;"><b><font face="Arial" size="3"><span style="font-size: 12pt;"><span>4.4<font face="Times New Roman" size="1"><span style="font-family: "Times New Roman"; font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-size-adjust: none; font-stretch: normal;"> </span></font></span></span></font></b>Purge-Jobs
operation</h2><p><font face="Arial" size="2"><span style="font-size: 10pt;">This
section specified additional operation attributes for use with the Cancel-Jobs
operation (see [RFC2911] Section 3.3.7).</span></font></p>
<h3><a></a><a><span><b><font face="Arial" size="3"><span style="font-size: 12pt;"><span>4.4.1<font face="Times New Roman" size="1"><span style="font-family: "Times New Roman"; font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-size-adjust: none; font-stretch: normal;"> </span></font></span></span></font></b>my-jobs</span></a><span><span><font face="Xerox Office" size="2"><span style="font-size: 10pt; font-family: "Xerox Office"; font-weight: normal;"><a language="JavaScript" name="12415f4bfc6b9251__msoanchor_2">[th2]</a> </span></font></span></span><span><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office"; font-weight: normal;"> </span></font></span></span><span><font face="Xerox Office" size="2"><span style="font-size: 10pt; font-family: "Xerox Office"; font-weight: normal;"><a language="JavaScript" name="12415f4bfc6b9251__msoanchor_3">[th3]</a> </span></font></span><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office"; font-weight: normal;"> </span></font></span>
(boolean)</h3><p><font face="Arial" size="2"><span style="font-size: 10pt;">The
“my-jobs” Operation attribute allows the client to request the
target jobs to be (1) <i><span style="font-style: italic;">all</span></i> jobs or
(2) only jobs owned by the requesting user. However, the Printer MUST
further restrict the target jobs as follows: </span></font></p><p style="margin-left: 1in;"><font face="Arial" size="2"><span style="font-size: 10pt;">‘false’: Default
value. The target jobs are <i><span style="font-style: italic;">all</span></i>
jobs, unless the Authenticated user supplying the request is NOT an operator or
administrator of the Printer, <a>in which case the Printer MUST restrict the target jobs to those
belonging to the requesting user.</a></span></font><span><font face="Xerox Office"><span style="font-family: "Xerox Office";"><a language="JavaScript" name="12415f4bfc6b9251__msoanchor_4">[th4]</a> </span></font></span><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office";"> </span></font></span></p>
<p style="margin-left: 1in;"><font face="Arial" size="2"><span style="font-size: 10pt;">‘true’: The
target jobs are <i><span style="font-style: italic;">limited to</span></i> those
owned by the Authenticated user submitting the request. </span></font></p><p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">The client MAY supply this Operation attribute and the Printer MAY
support this Operation attribute in the Purge-Jobs operation.</span></font></p></div></div></blockquote><div><br></div><div>I'd add the following to the 4.4 introduction to address th2-th5:</div><div><br></div></div>
<blockquote style="border: medium none ; margin: 0pt 0pt 0pt 40px; padding: 0px;">Access Rights: The following attributes may allow the authenticated user (see RFC 2911 section 8.3) performing this operation to be an ordinary user depending on the Printer's security policy. When ordinary users are not allowed to use the Purge-Jobs operation, the IPP object MUST continue to reject the operation and return: client-error-forbidden, client-error-not-authenticated, and client-error-not-authorized as appropriate.</blockquote>
<div><br></div>Then move the table into 4.4, before the description of the attributes.<div><br><div><blockquote type="cite"><div link="blue" vlink="purple" lang="EN-US"><div><p><font><font color="#000000" face="Monaco"><span style="font-size: medium;"></span></font></font></p>
<h3 style="text-indent: 0px;"><b><font face="Arial" size="3"><span style="font-size: 12pt;"><span>4.4.2<font face="Times New Roman" size="1"><span style="font-family: "Times New Roman"; font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-size-adjust: none; font-stretch: normal;">
</span></font></span></span></font></b>purge-job (boolean) </h3><p><font face="Arial" size="2"><span style="font-size: 10pt;">The
“purge-job” Operation attribute controls whether the target jobs
are canceled or purged as follows: </span></font></p><p style="margin-left: 1in;"><font face="Arial" size="2"><span style="font-size: 10pt;">‘false’: The
Printer cancels the target jobs as specified in [RFC2911] Section 3.3.3
Cancel-Job which MAY leave a Retained Job with document data on the Printer for
possible re-processing (e.g., using the Reprocess-Job or Resubmit-Job
operations) and/or Job History. </span></font></p><p style="margin-left: 1in;"><a><font face="Arial" size="2"><span style="font-size: 10pt;">‘true’:
Default value</span></font></a><span><font face="Xerox Office"><span style="font-family: "Xerox Office";"><a language="JavaScript" name="12415f4bfc6b9251__msoanchor_5">[th5]</a> </span></font></span><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office";"> </span></font></span>.
The Printer purges the target jobs as specified in [RFC2911] Section 3.2.9
Purge-Jobs. Note: If the client omits this attribute or supplies the
‘true’ value, the behavior of the Purge-Jobs operation is as
specified in [RFC2911] for the target jobs.</p><p><font face="Arial" size="2"><span style="font-size: 10pt;">The
client MAY supply this Operation attribute and the Printer MAY support this
Operation attribute in the Purge-Jobs operation.</span></font></p><p><font face="Arial" size="2"><span style="font-size: 10pt;">The
behavior for the Purge-Jobs operation for these two Operation attributes for
unprivileged users vs. operators and administrator of the Printer is shown in
Table 2.</span></font></p><p><a name="12415f4bfc6b9251__Ref242099050"><b><font face="Arial" size="2"><span style="font-size: 10pt;">Table </span></font></b></a>2:
Interaction of "my-jobs" and "purge-jobs" attributes in the
Purge-Jobs operation</p>
<table style="width: 459.9pt; margin-left: 0.5in; border-collapse: collapse;" border="0" cellpadding="0" cellspacing="0" width="613">
<tbody><tr>
<td style="border: 1pt solid windowtext; padding: 0in 5.4pt; width: 2.2in;" valign="top" width="211"><p><font face="Arial" size="2"><span style="font-size: 10pt;">Operation attributes</span></font></p>
</td>
<td style="border-style: solid solid solid none; border-color: windowtext windowtext windowtext -moz-use-text-color; border-width: 1pt 1pt 1pt medium; padding: 0in 5.4pt; width: 153pt;" valign="top" width="204"><p><font face="Arial" size="2"><span style="font-size: 10pt;">Unprivileged user</span></font></p>
</td>
<td style="border-style: solid solid solid none; border-color: windowtext windowtext windowtext -moz-use-text-color; border-width: 1pt 1pt 1pt medium; padding: 0in 5.4pt; width: 148.5pt;" valign="top" width="198"><p><font face="Arial" size="2"><span style="font-size: 10pt;">Operator or Administrator of the Printer</span></font></p>
</td>
</tr>
<tr>
<td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 2.2in;" valign="top" width="211"><p><font face="Arial" size="2"><span style="font-size: 10pt;">“my-jobs” = ‘false’ or
omitted<br>
“purge-jobs” = ‘false’</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 153pt;" valign="top" width="204">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Cancel only my jobs (Printer overrides
“my-jobs” = ‘false’)</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 148.5pt;" valign="top" width="198">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Cancel <i><span style="font-style: italic;">all</span></i>
jobs</span></font></p>
</td>
</tr>
<tr>
<td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 2.2in;" valign="top" width="211"><p><font face="Arial" size="2"><span style="font-size: 10pt;">“my-jobs” = ‘true’<br>
“purge-jobs” = ‘false’</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 153pt;" valign="top" width="204">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Cancel only my jobs</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 148.5pt;" valign="top" width="198">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Cancel only my jobs</span></font></p>
</td>
</tr>
<tr>
<td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 2.2in;" valign="top" width="211"><p><font face="Arial" size="2"><span style="font-size: 10pt;">“my-jobs” = ‘false’ or
omitted<br>
“purge-jobs” = ‘true’ or omitted</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 153pt;" valign="top" width="204">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Purge only my jobs (Printer overrides
“my-jobs” = ‘false’)</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 148.5pt;" valign="top" width="198">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Purge <i><span style="font-style: italic;">all</span></i>
jobs</span></font></p>
</td>
</tr>
<tr>
<td style="border-style: none solid solid; border-color: -moz-use-text-color windowtext windowtext; border-width: medium 1pt 1pt; padding: 0in 5.4pt; width: 2.2in;" valign="top" width="211"><p><font face="Arial" size="2"><span style="font-size: 10pt;">“my-jobs”
= ‘true’<br>
“purge-jobs” = ‘true’ or omitted</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 153pt;" valign="top" width="204">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Purge
only my jobs</span></font></p>
</td>
<td style="border-style: none solid solid none; border-color: -moz-use-text-color windowtext windowtext -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0in 5.4pt; width: 148.5pt;" valign="top" width="198">
<p><font face="Arial" size="2"><span style="font-size: 10pt;">Purge
only my jobs</span></font></p>
</td>
</tr>
</tbody></table><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">-----Original Message-----<br>
From: <a href="mailto:ipp-bounces@pwg.org" target="_blank">ipp-bounces@pwg.org</a> [mailto:<a href="mailto:ipp-bounces@pwg.org" target="_blank">ipp-bounces@pwg.org</a>] On Behalf Of Michael
Sweet<br>
Sent: Monday, September 14, 2009 14:41<br>
To: <a href="mailto:ipp@pwg.org" target="_blank">ipp@pwg.org</a><br>
Subject: [IPP] Descriptions of CUPS additions to the Cancel-Job and Purge-Jobs
operations</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">All,</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Here are the descriptions for the CUPS additions to the Cancel-Job
and </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Purge-Jobs operations. These came up in today's conference call...</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">------------------------------------------------------</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Cancel Job Operation</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">The Cancel-Job operation (0x0008) cancels the specified job. CUPS
1.4 </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">adds a new purge-job (boolean) attribute that allows you to purge
both </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">active and completed jobs, removing all history and document files
for </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">the job as well.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Cancel-Job Request</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">The following groups of attributes are supplied as part of the Cancel- </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Job request:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Group 1: Operation Attributes</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Natural Language and Character Set:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The "attributes-charset" and
"attributes-natural-language" </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">attributes as described in section 3.1.4.1 of the IPP Model and </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Semantics document.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">"printer-uri" (uri) and "job-id" (integer)</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">OR</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">"job-uri":</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The client MUST supply a URI for the specified
printer and a job </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">ID number, or the job URI.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">"purge-job" (boolean):</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The client OPTIONALLY supplies this attribute.
When true, all job </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">files (history and document) are purged. The default is false,
leading </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">to the standard IPP behavior.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Cancel-Job Response</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">The following groups of attributes are send as part of the
Cancel-Job </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Response:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Group 1: Operation Attributes</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Status Message:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The standard response status message.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Natural Language and Character Set:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The "attributes-charset" and
"attributes-natural-language" </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">attributes as described in section 3.1.4.2 of the IPP Model and </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Semantics document.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Purge-Jobs Operation</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">The Purge-Jobs operation (0x0012) cancels all of the jobs on a
given </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">destination and optionally removes all history and document files
for </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">the jobs as well.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Purge-Jobs Request</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">The following groups of attributes are supplied as part of the Purge- </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Jobs request:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Group 1: Operation Attributes</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Natural Language and Character Set:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The "attributes-charset" and
"attributes-natural-language" </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">attributes as described in section 3.1.4.1 of the IPP Model and </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Semantics document.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">"printer-uri" (uri):</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The client MUST supply a URI for the specified
printer or "<a>ipp://.../printers</a> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">" for all printers and classes.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">"requesting-user-name" (name(MAX)):</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The client OPTIONALLY supplies this attribute
to specify whose </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">jobs jobs are purged or canceled.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">"my-jobs" (boolean):</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The client OPTIONALLY supplies this attribute to
specify that </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">only the jobs owned by the requesting user are purged or canceled.
The </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">default is false.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">"purge-jobs" (boolean):</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The client OPTIONALLY supplies this attribute
to specify whether </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">the jobs are purged (true) or just canceled (false). The default
is </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">true.</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Purge-Jobs Response</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">The following groups of attributes are send as part of the
Purge-Jobs </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Response:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Group 1: Operation Attributes</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Status Message:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The standard response status message.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Natural Language and Character Set:</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> The "attributes-charset" and
"attributes-natural-language" </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">attributes as described in section 3.1.4.2 of the IPP Model and </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">Semantics document.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">___________________________________________________</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">Michael Sweet, Senior Printing System Engineer</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p>
<font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;">-- </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">This message has been scanned for viruses and</span></font></p><p>
<font face="Courier New" size="2"><span style="font-size: 10pt;">dangerous content by MailScanner, and is</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">believed to be clean.</span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"> </span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;">_______________________________________________</span></font></p><p>
<font face="Courier New" size="2"><span style="font-size: 10pt;">ipp mailing list</span></font></p><p><font face="Courier New" size="2"><span style="font-size: 10pt;"><a href="mailto:ipp@pwg.org" target="_blank">ipp@pwg.org</a></span></font></p>
<p><font face="Courier New" size="2"><span style="font-size: 10pt;"><a href="https://www.pwg.org/mailman/listinfo/ipp" target="_blank">https://www.pwg.org/mailman/listinfo/ipp</a></span></font></p>
</div>
<div>
<hr align="left" size="1" width="33%">
<div>
<div language="JavaScript"><span><a name="12415f4bfc6b9251__msocom_1"></a></span><p><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office";"> </span></font></span><span style="background: red none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">:
Allowing an unprivileged user to purge his job using Cancel-Job, could
circumvent accounting in those systems that use Retained Jobs and Job History
for accounting.</span></p>
</div>
</div>
<div>
<div language="JavaScript"><span><a name="12415f4bfc6b9251__msocom_2"></a></span><p><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office";"> </span></font></span><span style="background: red none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: Allowing
an unprivileged user to purge his jobs using Purge-Jobs, could circumvent
accounting in those systems that use Retained Jobs and Job History for
accounting.</span></p><p><font face="Xerox Office" size="2"><span style="background: yellow none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;"> </span></font></p>
<p><font face="Xerox Office" size="2"><span style="background: yellow none repeat scroll 0% 0%; font-size: 10pt; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">One solution would be to only allow
Purge-Jobs for operator or administrator as in [RFC 2911].</span></font></p>
</div>
</div>
<div>
<div language="JavaScript"><span><a name="12415f4bfc6b9251__msocom_3"></a></span><p><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office";"> </span></font></span><span style="background: red none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: Instead of
adding “my-jobs” and “purge-job” to Purge-Jobs, a
simpler way to allow an unprivileged user to cancel all his jobs, instead
of just a specified job, would be to add “all-my-jobs” (boolean)
Operation attribute to the Cancel-Job operation. When the client supplies
this attribute with a ‘true’ value, the client MUST NOT supply a “job-id”
or “job-url” Operation attribute.</span></p>
</div>
</div>
<div>
<div language="JavaScript"><span><a name="12415f4bfc6b9251__msocom_4"></a></span><p><span><font face="Courier New" size="1"><span style="font-size: 8pt; font-family: "Courier New";"> </span></font></span><font face="Times New Roman"><span style="background: red none repeat scroll 0% 0%; font-family: "Times New Roman"; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE</span></font><font face="Times New Roman"><span style="background: yellow none repeat scroll 0% 0%; font-family: "Times New Roman"; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: Or should the spec say the Printer MUST
reject the operation and return: client-error-forbidden, client-error-not-authenticated,
and client-error-not-authorized as appropriate, as for Purge-Jobs in RFC 2911
section 3.2.9</span></font><font face="Times New Roman"><span style="font-family: "Times New Roman";"></span></font></p>
</div>
</div>
<div>
<div language="JavaScript"><span><a name="12415f4bfc6b9251__msocom_5"></a></span><p><span><font face="Xerox Office" size="1"><span style="font-size: 8pt; font-family: "Xerox Office";"> </span></font></span><span style="background: red none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">ISSUE</span><span style="background: yellow none repeat scroll 0% 0%; -moz-background-clip: border; -moz-background-origin: padding; -moz-background-inline-policy: continuous;">: The “purge-job”
(boolean) Operation attribute has the ‘true’ value here as its
default. Usually, it’s the ‘false’ value that is the default.
More confusingly, the “purge-job” (boolean) Operation attribute
(correctly) has the ‘false’ value in the Cancel-Job operation
above.</span></p>
</div>
</div>
</div>
</div>
</blockquote></div><br><div>
<div>___________________________________________________</div><div>Michael Sweet, Senior Printing System Engineer</div><div><br></div><br>
</div>
<br></div><br>--
<br>This message has been scanned for viruses and
<br>dangerous content by
<a href="http://www.mailscanner.info/" target="_blank"><b>MailScanner</b></a>, and is
<br>believed to be clean.
</div>
<br>_______________________________________________<br>
ipp mailing list<br>
<a href="mailto:ipp@pwg.org">ipp@pwg.org</a><br>
<a href="https://www.pwg.org/mailman/listinfo/ipp" target="_blank">https://www.pwg.org/mailman/listinfo/ipp</a><br>
<br></blockquote></div><br>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.