PLP version 3.4.13:		(6 Dec 1994)
-------------------

* Error mails: the "mail-from-address" address is now Cc'ed for
  error mails.

* lpr -s now sanitises the path for the symbolic link if the file
  resides on an automounted filesystem (ie. prefixed with "/tmp_mnt/")
  and exists on the same path without the /tmp_mnt. It also checks
  the inodes in order to avoid security violations using this method.
  This avoids a possible problem with filesystems becoming unmounted
  between spooling and printing.

* Rick Martin: bug in contrib/old-filters/lpf.c fixed; embedded
  formfeeds caused the printer to go nuts, printing one line per
  page, due to a flag not being reset.

* HUGE portability patch from Michael Joosten (he's a porting
  machine! ;)... wrote cast for all SIG_IGN, etc.; rewrote the
  plp_signal() prototype with a typedef (the Pyramid compiler was a bit
  overstrained); rewrote __STDC__ in stdarg cases to HAVE_STDARGS,
  since the cc 6.7 of Domain/OS claims to be ANSI, but has no stdargs.h
  (well, not always...); Domain/OS has also two universes, but a single
  library for both. So, the existence of a function alone does not
  indicate if it is actually usable, since the proper include files may
  be missing. Thus: HAVE_FCNTL_LOCK; some more functions/include files
  conditionalized; made an heroic attempt to make the setuid() web
  working for BSD-based systems; old BSDs need a errno declaration.
  (whew!!)

* Multiple-printer fixes: lpq output for multi-printer queues is
  now much neater; lpd doesn't block the other printer by retrying.

* Cross-domain printing should now work again, without needing PLP
  clients on all client domains. If an unqualified name is passed
  to Checkperms, and a domain name is used in the perms file, a
  hostname lookup is done using that domain name. If it works,
  the hostname portions are checked, otherwise access is refused.
  This also removes the need for "domain-name" (most of the time).

* Solaris 2 lp system (ugh!) clients can now print to a PLP printer.

* lp-pipes README file has moved to doc/README.lp-pipes.

* lp-pipes are now made from the compile directory, not from
  a subdirectory thereof; ie. they don't have their own makefile.
  (thanks to Dorab Patel for pointing out that this didn't work!)

* checkperm's hostname matching is now case-insensitive.

* recvfiles completely rewritten -- much more robust now.  It also
  supports Windows NT 3.5 (Daytona)'s TCP/IP printing option, and
  as such is _beyond_ RFC-compliant. ;)

* More ANSI stuff from Michael Haardt. Also, a ref'd-before-inited
  bug spotted by same.

* control-file hostname is now fq'd for the check in localprinter.c:
  BSD lprs don't fq it, and this causes *.domain.com perms matches
  to fail.

* added ip-address support for lp-pipes -- printers aren't always
  guaranteed to have a DNS record, and there's no need to require it.
  A bug in this was fixed by <dimakop@cti.gr>.

* problem with inetd mode: lpd's fd 2 pointed back to client socket,
  so debug messages screwed about with ack bytes, causing inexplicably
  stopped printers.

* fixed perm caching -- it still opened files when it didn't need to.

* changed configure script to avoid 'gcc -traditional' if possible:
  the fix in 3.4.12 still didn't completely fix the problem. I hate
  varargs!

* Re-ported to Ultrix 4.3.

* Fixed infinite loop in All_printers().

* the #ifdef's in setproctitle.c were incorrect; if you undef'd
  SETPROCTITLE in Makefile, lpd failed to compile. 

PLP version 3.4.12:	(15 Nov 1994)
-------------------

* Fixed varargs/stdargs code so it works with gcc -traditional on
  SunOS (probably others, too).

* Made printcap caching more efficient; also added permsfile caching.

* setup_close_on_exec () added, due to bug in IRIX 5.1.1 NIS code,
  which refuses to allow getpwuid() calls if the NIS socket is closed.

* bug in printcap: if a printcap entry with an lp-pipe and only one
  name exists, the name|alias|alias:pcap parsing code got it wrong.
  Ed Santiago <esm@lanl.gov>, extended by jmason.

* checkperm: XU pcap param wasn't working -- fixed.

* Updated setproctitle() code from sendmail 8.6.9.

* Michael Haardt: Linux portable.h entry, ANSIfication patches:
  "fixes some usual problems, such as undefined return values or
  elimination of unused variables and comparing "char_var==(void*)0"
  which is not portable".

* Chaged IP-address matching, copying funcs to use IP_ADDRESS_LEN
  from lp.h -- this can be changed if IP:ng changes it.

* Stefano: changed the "C_clean" function in control_ops.c: a server
  for the queue to be cleaned will be killed first; fixed type of
  Checkactive (in utils.c): was int, is now pid_t.

* displayq.c: fixed so it now only reports the remote end of "nw" spool
  queues, like it should do; also, active jobs appear first in queue
  (even if a later job has a higher priority) -- implemented by both
  Stefano and jmason (j got there first ;)

* bugfix: fixed lockfile.c to check fcntl ret status for EACCES as well
  as EAGAIN; EACCES is used by BSD machines; generally tweaked with the
  lockfile code: made "unguessable" lockfile name much harder to
  guess using getrusage(), times().

* documented setstatus(8), fixed doc bug in printcap(5): lp=port@host
  syntax is now obsolete.

* added Stefano's HINTS entry for Convex/OS and Linux (partly in the
  HINTS file and partly in portable.h), and some of his strerror()
  patch.

* added Tcl 7.1's strtoul() replacement.

* E. Hagberg: bsd-compat.c: strdup() was declared static.

PLP version 3.4.11:	(3 Nov 1994)
-------------------

* updated docs to reflect Stefano's requeue change.

* fixed "no RP specified for RM ((null))" glitch in startserver when
  the NW flag was set.

* Added the requeue function by Stefano Ianigro (w_stef@unibw-hamburg.de):
  When the printer gets garbled or malfunctions during the printing
  of a job, the operator can do a "requeue" of this job. The
  controlfile (which has to be unlocked first with "unlockcf") and the 
  data file will be copied with a new sequence number and prioritized 
  to A, the server will be killed and the queue goes to "no printing". 
  After the maintenance or whatever on the printer is done, the operator 
  starts that printer with the start command from lpc and the job will 
  be reprinted.

* Stefano again: Added the "M" flag for the printer_perms database.
  This means that a user can move his own job(s) (not others) to that
  printer. Changed the move function to secure this.

* Stefano: Fixed a file creating problem with the "copy_file" function in
  utils.c; changed the ouput format of "lprm" for better readability.

* Harlan Stenn: LOCK_EX (flock constant) replaced by HAVE_FLOCK
  in lock_device.c.

* David M Clarke: bug in lp.sh script fixed.

* Serious security hole fixed, involving unimplemented symbolic
  link security checking. Any file on the system could be printed
  using this hole.

* AF should not have been set by default.

* Eric C Hagberg: strdup() added for A/UX; order of includes
  changed in checkpc.c.
  
PLP version 3.4.10:	(12 Oct 1994)
-------------------

* memory leak, possible cause of coredumping fixed in
  hostcmp()/free_haddr_list().

* Lots more ANSIfying; Michael Haardt and myself. Also, lots of
  linting and other heinous code-hammering.

* Fixed 2-level varargs-function calling, which is illegal, causing
  garbage log messages and possible coredumps.

* Added SNI Targon/35 (!!) support, courtesy of Lothar Butsch;
  also added the "HINTS" file (his idea). Also, lint target in
  Makefile; int->pid_t in C_forms(); contents of src/xref for
  constructing an xref file over all the sources.

* Fixed move.c to copy the moved file and unlink the old one if
  rename() fails with a "different filesystems" error.

* George Harrach: fixed a coredump bug in library/getopt.c, where
  strncpy ran off the end of the input string (I think). 

* Stefano Ianigro: fixed a bug in lprm.c, any user can remove any jobs
  from the queue; changed autoconf stuff to check if the cc compiler
  supports the inline feature (GCC does, but Sun's unbundled does not)
  (jmason comment: configure was supposed to be able to handle that!)

* Julian Anderson: Old versions of PLP (2Apr90) refuse to print if the
  control file name and the H record do not match completely, eg both
  FQDN or both shortnames.  Enclosed is a patch to LPR/lpr_temp.c which
  makes the control-file and datafile names respect the SHORTHOSTNAME
  define. Also, a buglet in Exlockcf, which stats the supplied pathname
  to determine if it lives on an NFS mounted volume.  Of course, if the
  supplied path doesn't exist yet, then the stat fails and reports an
  error.

PLP version 3.4.9:	(15 Sep 1994)
------------------

* portions ANSIfied by <u31b3hs@POOL.Informatik.RWTH-Aachen.DE>
  (Michael Haardt); utils.c, setuid.c and lockfile.c ANSIfied by
  jmason. const and inline keywords may now be used.

* strcmp (x,y) == 0 changed to strsame(x,y) as a general case,
  just to keep it tidy.

* configure changes: assert() checked for, just in case it's not
  supported; unproto supported; shared-lib versions of libsocket,
  libnsl and libnet supported, -llib_s style.

* vfork now supported for secure_system() (even though we hardly
  use it!).

* Speed improvements in startprinter.c; hopefully, some better
  handling of removed jobs in remoteprinter.c and recvfiles.c.

* Greg Wohletz: PLP will lock any "lp" device; this isn't good
  if lp=/dev/null, so a special-case has been added for that
  file (and only that file).

* Stefano Ianigro: missing type in errormsg.c when not STDC; returning
  a void in LPD/lpd.c.; Z option is available even if you don't define
  the EUCS stuff (I guess some prefilter are dealing with the Z
  option); bug in the resolver lib. If you have an alias for a
  hostname, the gethostbyname () call will return a pointer to that
  name in form of a null-terminated string. If you don't have an alias
  you'll get a zero pointer!!; Convex OS port is ready and working (and
  tested!); small bug in test/Makefile corrected. 

* this must be _THE_ most portable (read as "takes-loads-of-bitty-oses-
  -into-account") package ever to use wait*() and WIF???(). ;)
  YAWP (yet another wait patch), this time from Michael Joosten.
  secure_system()'s return code was unportable.

* Eric Hagberg: A/UX support: sh doesn't have getopts, SETPROCTITLE
  doesn't work.

PLP version 3.4.8:	(Sep 9 1994)
------------------

* Michael Joosten: MAJOR BSD 4.2/4.3 PORTABILITY STUFF:
  BSD 4.2-compat EXTA/EXTB baud rate stuff into stty_sgtty.c. struct
  exec checked for in configure. removed TERMIOS stuff from termio
  check in configure. Fixes in bsd-compat.c: problem with static
  sigset_t oblock (yep, that was correct -- jmason).  v?printf stuff
  added for old BSD + plus check in configure (HAVE_VPRINTF). moved the
  BSD-compatibility stuff from NeXT and Ultrix together, guarded by
  #ifndefs. Check for limits.h.

* got POSIX default macros for WIFSTOPPED, etc., so we use
  them (it's the perl way!).

* waitpid() is now used when available.

* got rid of tiny memory leak from copy_haddr_list.

* overhauled pac, fixed loadsa bugs, added -m, -h options.
  pac -s still broken.

* fixed utils.c so NOFILE->getdtablesize() (more portable);
  we close all unused fds before exec()ing filters, pr, etc.

* Stefano Ianigro:
  Makefile: lp shell scripts not found; defaults.c: Maxportno
  was wrong; rename() in move and hold was not run as daemon;
  different output format for "stop", "down", "up" commands.
  Solaris unbundled cc was defining __SVR4 instead of SVR4.
  remote displayq() wasn't setting Host (for some reason).
  "lpc lpd" didn't work (killing a root process from non-root).

* but@unibw-hamburg.de (Lothar Butsch):
  AIX 3.2.5 support (compilation, anyway ;).

* Michael Joosten: statfs include files, -lsun for IRIX4,
  :bk: and short hostname, and the typical beginner's error.
  Note that on IRIX4, char is by default unsigned

* remote-printer IFs weren't getting most of the
  interesting printcap params (filename, class, etc.).

* BK wasn't using short hostnames after all.

* fixed coredump in pac when debugging was on.

* removed setuid'ing around printcap-reading code; it's
  very inefficient, and we _should_ be able to assume
  that the printcap file is readable by users.

PLP version 3.4.7:	(Sep 7 1994)
------------------

* removed plp.conf setuid directive: obsolete.

* moved troff source out of distribution to save space;
  dist just includes the postscript version of the manual
  now.

* portability notes for portable.h and configure, from
  Bjarne Steinsbo, Michael Joosten, Eric C Hagberg, and
  Greg Wohletz.

* Moved A/UX setcompat() call to setuid.c, as it's needed
  earliest by the setuid code.

* Bjarne Steinsbo: non-setuid mode was broken; also, added
  support for read/write LP-pipes and spotted a non-serious
  fd leak.

* Michael Joosten: pid_t != int, fixed.

* Eric Hagberg: security problem where hosts could bypass
  permissions checking by spoofing the control-file entries.

* Eric Hagberg: missing sys_errlist extern decl.

* Greg Wohletz: logerr_die missing first args in NIS code,
  typo in Makefile.in, configure.in not quoting properly.

PLP version 3.4.6:	(Sep 2 1994)
------------------

* autoconf -- almost all the OS-specific stuff is now
  handled by autoconf (yay!).

* Michael Joosten <joost@ori.cadlab.de>: termios fixes:
  the mc/ms debugging infos were reversed, and the
  operator precedence in the VMIN/VTIME 'if' was wrong
  (this one wins the PLP 3.4.6 "well spotted" award! ;)

* Michael Joosten: VMIN/VTIME for termio as well.

* Michael Joosten: bug with talking to old PLP (and
  possibly also old BSD) lpds: didn't realise
  host.dom.ain == host. Incorporated into the :bk: stuff.

* Michael Joosten: IRIX 4 support.

* Michael Joosten: bug with combo of prefilter + pr.

* accounting change -- new printcap param, "la". If la is
  set (which it is by default), PLP will do accounting
  on local printers (to "af"). If the user wants to do
  their own accounting, turn off "la".

* missing arg for gettimeofday -- spotted by Greg Wohletz.
  (Solaris manpage was wrong)

* portability: changed index/rindex to strchr/strrchr
  throughout, as IRIX 4 uses a structure element called
  "index". If only cpp was less stupid!

* Fixed lpc -- it wasn't setuid'ing. In the process, made
  things more secure -- setuid(user) now happens before
  anything else, even before reading the config file.

* LP-pipes first implemented, some sample LP-pipes written.

* limits, minfree changed to printcap parameters.

* Ultrix 4 support -- greg@cs.unlv.edu (Greg Wohletz).

* changed hold, move to use chdir_SD () instead of chdir(SD) --
  chdir_SD() attempts to fix bad permissions and ownerships.

* Stefano Ianigro <w_stef@unibw-hamburg.de>:
  bug in src/library/move.c that puts the old name of the data
  file in the controlfile after the job has been moved.

* removed the check for filename + from-host matching... the RFC
  is quite loose about it and it's too paranoid.

* Printcap caching -- see PLP Manual and plp.conf(5): use-printcap-cache.
  (note: not on by default!)

* lpd -L logfile would open the logfile as daemon (security hole).

* setuid.c: memory bugs (core-dumps on HP).
  Also, can't end command lines with spaces (fixed).

* Michael Joosten <joost@ori.cadlab.de>: trivial bug in checkperm.c:
  NIS permissions weren't being checked.

* fixed a bug in the include-file code; include right after another
  include didn't work.

* minor typo in library/printcap_hes.c - strcpy instead of strncpy.
  also two in setuid.c.  Thanks to Greg Wohletz <greg@duke.CS.UNLV.EDU>.

PLP version 3.4.5:	(Aug 23 1994)
------------------

* bjarne@hsr.no (Bjarne Steinsbo) wrote the "include" code for
  plp.conf, printcap _and_ printer_perms. Looked pretty tricky,
  too... nice one!

* timeouts don't give the confusing "Interrupted system call" error
  any more -- also, bumped up the timeout to 30 seconds.

* WSLPD is better supported. "be liberal in what you accept".
  (even if it's broken ;)

* note: don't add the -Cconfigfile argument -- it's a security hole.
  If any user can override the config-file location, he can do things
  like change the daemon-user, the printcap-path, etc. Heinous.

* added new functions to lpc: downq (sets the priority to Z for
  specified or all jobs in a queue) and chprio (changes the priority
  selectable from A to Z for jobs).
  (change by Stefano Ianigro <w_stef@unibw-hamburg.de>)

* fixed the hold function in lpc for remote printers. Releasing a held
  job in a remote queue works now.
  (another change from Stefano Ianigro <w_stef@unibw-hamburg.de>)

* fixed the move_job function. When a job is moved to another printer,
  the sequence number of the moved job will be set to the sequence
  number+1 of the queue in which the job is moved in.
  (another change from Stefano Ianigro <w_stef@unibw-hamburg.de>)

* added GNU readline capability for lpc, and changed the output
  of lpc a little (for better readability).
  (another change from Stefano Ianigro <w_stef@unibw-hamburg.de>)

* changed the Makefile in the test directory: add the target
  veryclean, which removes all the test stuff in /tmp.
  (another change from Stefano Ianigro <w_stef@unibw-hamburg.de>)

* non-setuid mode works again, with some help from
  Stefano Ianigro <w_stef@unibw-hamburg.de>.

* Bjarne Steinsbo: spotted a memory problem in lpq.c.

* BK: went over the RFC with a fine-toothed comb -- :bk: mode is now
  as RFC-compatible (as well as bad implementation-compatible) as
  possible.

* prefilters are now run with the spool dir as their cwd.

* bjarne@hsr.no (Bjarne Steinsbo): notified me of a printer_perms bug.

* The handling of printername/host in the printcap files. The problem
  was that printername/hostname was added to the all_printers list, and
  later routines which searched through this list got angry over the
  illegal character (/) in the printername. The solution is to strip the
  /hostname part when you insert it into the list.
  -- maf@math.chalmers.se (Martin Forssen)

* secure_system doesn't use sh anymore -- it interfered with
  the process-manipulation code (and was inelegant). Back to
  bits taken from Wietse Venema (wswietse@win.tue.nl)'s msh.c,
  with some local additions.

* termios: VMIN/VTIME should not be twiddled while ICANON is on.
  Thx to maf@math.chalmers.se (Martin Forssen) for spotting this.

* architecture expansion -- patch from bjarne@hsr.no. Also, typo
  in readconf.c (ShortHost vs. Host), and typo in lpd.c: pid is
  not inited before use.

* lpr now checks the cf-file's parameters for sneaky embedded newlines,
  so them darned crackers can't add new entries by printing files
  named like "test.c\nMpresident@whitehouse.gov". Kudos for this
  one go to u31b3hs@POOL.Informatik.RWTH-Aachen.DE (Michael Haardt).

* maf@math.chalmers.se (Martin Forssen): I have found out why the
  banner program didn't exit. First it expected its input to end with
  ^Y^A (it helps to have source to transcript :-) and a filedescriptor
  wasn't closed when you forked.

PLP version 3.4.4:
------------------

* fixed a misfeature when PLP talks to non-compliant LPDs, such as WSLPD,
  that sometimes don't ack; the queue used to get stopped. Now, it
  doesn't; the connection is closed and PLP sleeps, then retries.

* removed "attach" plp.conf param. Unnecessary.

* made Host and ShortHost less dependent on system and resolver,
  and more likely to work.

PLP version 3.4.3:
------------------

* Lots of smelly documentation. ugh ugh ugh.

* Printcap lookups now look for a printer called "printername/hostname"
  before looking for "printername". Use one printcap for your whole
  network! Neato-keen!

* added high-resolution timing code (useful for framegrabbing and other
  exciting non-printer-related applications).

* removed SL printcap parameter; BK does it well enough.

* Fixed the prefilter code (again!); well, it definitely works now. ;)
  It still runs as daemon, but it's been completely overhauled; it
  works with stdin, multiple command-line files, even "pr".

* Michael Joosten about MIN and TIME on termio/termios machines:
  if the RW flag is set, MIN should be set to 1 and TIME to 0 so
  small amounts of input will be read, but reading will still
  block.

* incorporated three fixes from Paul Haldane (Computing Services,
  University of Edinburgh; Paul.Haldane@edinburgh.ac.uk)... one for
  starting multiple servers ("I don't understand why this didn't cause
  us big problems until a few months ago"), and two for compatibility
  with BSD-derived LPD systems (order of records in control files can
  be important; protocol violations when talking to remote printers
  running Sun's lpd).

* Made Parms array and the config-file parameters
  dynamically-allocated. There's no limits! (well there're still
  some, but I'm getting through most of 'em).
 
* incorporated A/UX port by Eric C Hagberg <hagberg@mail.med.cornell.edu>.

PLP version 3.4.2:
------------------

* some good group-checking code from Bjarne Steinsbo.

* device locking code from joost@cadlab.de (Michael Joosten).

* Converted all getuid() calls to use the output from the first
  getuid() call (ie. the UserUID variable), where the uid is
  guaranteed to be the real user's uid, whatever the system.

* changed USE_SETREUID code to use ruid=root,euid=whatever.
  Works all the time, without having to swap the two values
  constantly (which I don't approve of, for some reason).

* access() was using the uid instead of the euid.
  Wasn't really a problem (the open and so on still happened
  as the user), but it's now no longer used anyway.

* changed the log format to be a bit less space-intensive.

* re-fixed the obo strlen errors - this one definitely works
  (there were problems with the 3.4.1 patch, apparently).

PLP version 3.4.1:
------------------

* loads of off-by-one string length errors. oops. Thanks to
  Bjarne Steinsbo <bjarne@hsr.no> and Todd C. Miller
  <Todd.Miller@cs.colorado.edu>.

PLP version 3.4.0:	(beta release)
------------------

* incorporated the Edinburgh stuff. Too many changes. sdiffed for days on end,
  never again! ;)

* prefilter bug fix from joost@cadlab.de (Michael Joosten).

* configuration file code.

* secure_system() fixed -- wasn't doing the right thing with 'args like this'.

PLP version 3.3.1:
------------------

* fixed a check_perms bug -- it wasn't working when a line had
  a "!" and a "*" entry.

* fixed an old (pre v.3.3) bug reported by Stuart Kemp <stuart@cs.jcu.edu.au>:
  >if a user on machine X submitted a job, and the printcap for this printer
  >had a 'rp' entry for machine Y, but the perms file on machine Y denied
  >usage for this user at X, then the job on X would stay in the queue (on X),
  >and nothing else would happen; other jobs on X (destined for Y) would also
  >never get processed.

* fixed problem with sendmail -- forgot the "-t" option! (duh)

* setproctitle nicked from sendmail -- lpd sets its process title
  (visible from ps).

PLP version 3.3.0:	(beta release by jmason@iona.ie)
------------------

* inetd mode; PLP can now run completely from inetd, which adds
  reliability and saves virtual memory at the expense of fast
  request turnaround.

* Multi-hop remote-printer sequences ("rm", "rp" printcap entries).

* TCP/IP sockets can be used as line printer devices ("lp" entries).

* input-filters ("if") can be used in a remote-printer
  printcap entry.

* Integrated Linux port code, with UN*X domain socket support (?!)
  and termios support (whew! ;) Port performed by Corey Minyard,
  minyard@wf-rch.cirr.com. Also integrated some of the porting
  (and bug-fixing) code from Edinburgh release.

* Ported to Solaris 2 and HP/UX 9.0.x, with _lots_ of pretty
  reliable porting code. HPUX doesn't support #elif so
  that was removed from all the code (I hate HPs).

* separated system-specific and site-specific configuration from
  each other and source files into config.h, lp.h and systems/*.h.

* Tried to make configuration significantly easier.

* Added USE_MX, ALLOW_TEXT_ONLY, APPEND_HOSTNAME_TO_CONFIGS,
  SECURE_PATH_ENV, SECURE_LD_PATH_ENV #define configurability.

* memory leaks and bugs fixed with purify (although there
  were very few of them!).

* a more portable, more secure setuid system, which is SVR4,
  POSIX and BSD 4.3+ and 4.4 compliant. Unfortunately, this
  may break on older systems. Effective UID is now only set
  to root when it's needed, when a privileged port is being
  bound to, and only set to daemon when 
  being opened, or a privileged port is being bound to.

* more security -- environment variables are extensively
  sanitized before filters and pre-filters are exec'd.

* even _more_ security -- a secure_system() function added,
  and exec()'d command lines are checked for shell
  metacharacters before they are run.

* libplp.a -- encourages memory sharing on some systems
  and faster to build.

* automatic mkdir, perms, ownership fixing of spool-dirs if
  needed, at the expense of one stat() call; allows sysadmins
  a bit of leeway. ;)

* the 'port@machine' lp= spec, for printers that can listen
  for print jobs over the net.

* Lots of small changes and bug fixes.

PLP version 3.0:
----------------

[...antediluvian...]
