From 35c8306a877d47bfd4df3618f7fe1c108ab70e90 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Tue, 7 Nov 2023 22:31:57 -0500
Subject: [PATCH 01/12] Disable file writing by default Per #1210, #730

---
 js/qz-tray.js                         |  8 -------
 sample.html                           | 34 ---------------------------
 src/qz/auth/CRL.java                  |  2 +-
 src/qz/printer/action/PrintImage.java |  2 +-
 src/qz/printer/action/PrintPDF.java   |  2 +-
 src/qz/printer/action/PrintRaw.java   | 27 ++++++++++++++++-----
 src/qz/utils/ArgValue.java            |  6 +++++
 src/qz/utils/ConnectionUtilities.java | 30 +++++++++++++++++++++--
 src/qz/utils/FileUtilities.java       |  2 +-
 9 files changed, 59 insertions(+), 54 deletions(-)

diff --git a/js/qz-tray.js b/js/qz-tray.js
index 1514d8a09..106779c17 100644
--- a/js/qz-tray.js
+++ b/js/qz-tray.js
@@ -1074,14 +1074,6 @@ var qz = (function() {
             if (typeof newPrinter === 'string') {
                 newPrinter = { name: newPrinter };
             }
-
-            if(newPrinter && newPrinter.file) {
-                // TODO: Warn for UNC paths too https://github.com/qzind/tray/issues/730
-                if(newPrinter.file.indexOf("\\\\") != 0) {
-                    _qz.log.warn("Printing to file is deprecated.  See https://github.com/qzind/tray/issues/730");
-                }
-            }
-
             this.printer = newPrinter;
         };
 
diff --git a/sample.html b/sample.html
index e9cf3b50a..c46f128cc 100755
--- a/sample.html
+++ b/sample.html
@@ -121,7 +121,6 @@ <h3 class="panel-title">Printer</h3>
                     <div class="form-group">
                         <div class="btn-group" role="group">
                             <button type="button" class="btn btn-default btn-sm" onclick="setPrinter($('#printerSearch').val());">Set To Search</button>
-                            <button type="button" class="btn btn-default btn-sm" data-toggle="modal" data-target="#askFileModal">Set To File</button>
                             <button type="button" class="btn btn-default btn-sm" data-toggle="modal" data-target="#askHostModal">Set To Host</button>
                         </div>
                         <button type="button" class="btn btn-warning btn-sm" onclick="clearQueue($('#printerSearch').val());">Clear Queue</button>
@@ -1354,27 +1353,6 @@ <h4 class="panel-title">Options</h4>
         </div>
     </div>
 
-
-    <div class="modal fade" id="askFileModal" role="dialog">
-        <div class="modal-dialog modal-sm" role="document">
-            <div class="modal-content">
-                <div class="modal-body">
-                    <div class="form-group">
-                        <label for="askFile">File:</label>
-                        <input type="text" id="askFile" class="form-control" value="C:\tmp\example-file.txt" />
-                        <hr />
-                        <p><span class="text-danger" style="font-weight:bold;"><span class="fa fa-warning"></span> WARNING:</span> This feature has been deprecated.  Please configure a local raw <code>FILE:</code> printer, or use <code>File IO</code></a> instead.  For more
-                            information please see <a href="https://github.com/qzind/tray/issues/730">issue&nbsp;<code>#730</code>.</a></p>
-                    </div>
-                </div>
-                <div class="modal-footer">
-                    <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
-                    <button type="button" class="btn btn-primary" onclick="setPrintFile();">Set</button>
-                </div>
-            </div>
-        </div>
-    </div>
-
     <div class="modal fade" id="askHostModal" role="dialog">
         <div class="modal-dialog modal-sm" role="document">
             <div class="modal-content">
@@ -2982,13 +2960,6 @@ <h4 class="panel-title">Options</h4>
         }).catch(displayError);
     }
 
-    $("#askFileModal").on("shown.bs.modal", function() {
-        $("#askFile").focus().select();
-    });
-    $("#askHostModal").on("shown.bs.modal", function() {
-        $("#askHost").focus().select();
-    });
-
     //make dirty when changed
     $("input").add("select").on('change', function() {
         $(this).addClass("dirty");
@@ -3375,11 +3346,6 @@ <h4 class="panel-title">Options</h4>
         return options;
     }
 
-    function setPrintFile() {
-        setPrinter({ file: $("#askFile").val() });
-        $("#askFileModal").modal('hide');
-    }
-
     function setPrintHost() {
         setPrinter({ host: $("#askHost").val(), port: $("#askPort").val() });
         $("#askHostModal").modal('hide');
diff --git a/src/qz/auth/CRL.java b/src/qz/auth/CRL.java
index 11c945123..861235ed7 100644
--- a/src/qz/auth/CRL.java
+++ b/src/qz/auth/CRL.java
@@ -38,7 +38,7 @@ public static CRL getInstance() {
                 public void run() {
                     log.info("Loading CRL from {}", CRL_URL);
 
-                    try(BufferedReader br = new BufferedReader(new InputStreamReader(ConnectionUtilities.getInputStream(CRL_URL)))) {
+                    try(BufferedReader br = new BufferedReader(new InputStreamReader(ConnectionUtilities.getInputStream(CRL_URL, false)))) {
                         String line;
                         while((line = br.readLine()) != null) {
                             //Ignore empty and commented lines
diff --git a/src/qz/printer/action/PrintImage.java b/src/qz/printer/action/PrintImage.java
index aec9b489a..fe8bc1bf1 100644
--- a/src/qz/printer/action/PrintImage.java
+++ b/src/qz/printer/action/PrintImage.java
@@ -82,7 +82,7 @@ public void parseData(JSONArray printData, PrintOptions options) throws JSONExce
                     case PLAIN:
                         // There's really no such thing as a 'PLAIN' image, assume it's a URL
                     case FILE:
-                        bi = ImageIO.read(ConnectionUtilities.getInputStream(data.getString("data")));
+                        bi = ImageIO.read(ConnectionUtilities.getInputStream(data.getString("data"), true));
                         break;
                     default:
                         bi = ImageIO.read(new ByteArrayInputStream(flavor.read(data.getString("data"))));
diff --git a/src/qz/printer/action/PrintPDF.java b/src/qz/printer/action/PrintPDF.java
index a4772c45d..8e3e68cf2 100644
--- a/src/qz/printer/action/PrintPDF.java
+++ b/src/qz/printer/action/PrintPDF.java
@@ -118,7 +118,7 @@ public void parseData(JSONArray printData, PrintOptions options) throws JSONExce
                     case PLAIN:
                         // There's really no such thing as a 'PLAIN' PDF, assume it's a URL
                     case FILE:
-                        doc = PDDocument.load(ConnectionUtilities.getInputStream(data.getString("data")));
+                        doc = PDDocument.load(ConnectionUtilities.getInputStream(data.getString("data"), true));
                         break;
                     default:
                         doc = PDDocument.load(new ByteArrayInputStream(flavor.read(data.getString("data"))));
diff --git a/src/qz/printer/action/PrintRaw.java b/src/qz/printer/action/PrintRaw.java
index 89093d477..b6c7a43d2 100644
--- a/src/qz/printer/action/PrintRaw.java
+++ b/src/qz/printer/action/PrintRaw.java
@@ -11,7 +11,6 @@
 
 import com.ibm.icu.text.ArabicShapingException;
 import org.apache.commons.lang3.StringUtils;
-import org.apache.commons.ssl.Base64;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.rendering.PDFRenderer;
@@ -175,7 +174,7 @@ private ImageWrapper getImageWrapper(String data, JSONObject opt, PrintingUtilit
             case PLAIN:
                 // There's really no such thing as a 'PLAIN' image, assume it's a URL
             case FILE:
-                bi = ImageIO.read(ConnectionUtilities.getInputStream(data));
+                bi = ImageIO.read(ConnectionUtilities.getInputStream(data, true));
                 break;
             default:
                 bi = ImageIO.read(new ByteArrayInputStream(seekConversion(flavor.read(data), rawOpts)));
@@ -191,7 +190,7 @@ private ImageWrapper getPdfWrapper(String data, JSONObject opt, PrintingUtilitie
             case PLAIN:
                 // There's really no such thing as a 'PLAIN' PDF, assume it's a URL
             case FILE:
-                doc = PDDocument.load(ConnectionUtilities.getInputStream(data));
+                doc = PDDocument.load(ConnectionUtilities.getInputStream(data, true));
                 break;
             default:
                 doc = PDDocument.load(new ByteArrayInputStream(seekConversion(flavor.read(data), rawOpts)));
@@ -329,7 +328,7 @@ public void print(PrintOutput output, PrintOptions options) throws PrintExceptio
                     if (output.isSetHost()) {
                         printToHost(output.getHost(), output.getPort(), bab.getByteArray());
                     } else if (output.isSetFile()) {
-                        printToFile(output.getFile(), bab.getByteArray());
+                        printToFile(output.getFile(), bab.getByteArray(), true);
                     } else {
                         if (rawOpts.isForceRaw()) {
                             if(tempFiles == null) {
@@ -339,7 +338,7 @@ public void print(PrintOutput output, PrintOptions options) throws PrintExceptio
                             if(tempFiles.size() <= j) {
                                 tempFile = File.createTempFile("qz_raw_", null);
                                 tempFiles.add(j, tempFile);
-                                printToFile(tempFile, bab.getByteArray());
+                                printToFile(tempFile, bab.getByteArray(), false);
                             } else {
                                 tempFile = tempFiles.get(j);
                             }
@@ -401,7 +400,15 @@ private void printToHost(String host, int port, byte[] cmds) throws IOException
      *
      * @param file File to be written
      */
-    private void printToFile(File file, byte[] cmds) throws IOException {
+    private void printToFile(File file, byte[] cmds, boolean locationRestricted) throws IOException {
+        if(file == null) throw new IOException("No file specified");
+
+        if(!isAllowed(file)) {
+            log.error("Printing to file '{}' is not permitted.  Configure property '{}' or '{}' to modify this behavior.",
+                      file, ArgValue.SECURITY_PRINT_UNC.getMatch(), ArgValue.SECURITY_PRINT_FILE.getMatch());
+            throw new IOException(String.format("Printing to file '%s' is not permitted", file));
+        }
+
         log.debug("Printing to file: {}", file.getName());
 
         //throws any exception and auto-closes stream
@@ -410,6 +417,14 @@ private void printToFile(File file, byte[] cmds) throws IOException {
         }
     }
 
+    private boolean isAllowed(File file) {
+        return file.getPath().startsWith("\\\\") ?
+                // UNC Path
+                PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_UNC) :
+                // Regular file
+                PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_FILE);
+    }
+
     /**
      * Constructs a {@code SimpleDoc} with the {@code commands} byte array.
      */
diff --git a/src/qz/utils/ArgValue.java b/src/qz/utils/ArgValue.java
index d16f5025c..cc11985ec 100644
--- a/src/qz/utils/ArgValue.java
+++ b/src/qz/utils/ArgValue.java
@@ -69,6 +69,12 @@ public enum ArgValue {
         "security.file.enabled"),
     SECURITY_FILE_STRICT(PREFERENCES, "Enable/disable signing requirements for File Communications features", null, true,
         "security.file.strict"),
+    SECURITY_FILE_PROTOCOLS(PREFERENCES, "URL protocols allowed for print, serial, hid, etc", null, "http,https",
+        "security.file.protocols"),
+    SECURITY_PRINT_UNC(PREFERENCES, "Enable/disable printing directly to UNC paths", null, false,
+        "security.print.unc"),
+    SECURITY_PRINT_FILE(PREFERENCES, "Enable/disable printing directly to file paths", null, false,
+        "security.print.file"),
     LOG_DISABLE(PREFERENCES, "Disable/enable logging features", null, false,
         "log.disable"),
     LOG_ROTATE(PREFERENCES, "Number of log files to retain when the size fills up", null, 5,
diff --git a/src/qz/utils/ConnectionUtilities.java b/src/qz/utils/ConnectionUtilities.java
index f87cc893d..7c5235eb7 100644
--- a/src/qz/utils/ConnectionUtilities.java
+++ b/src/qz/utils/ConnectionUtilities.java
@@ -39,9 +39,17 @@ public final class ConnectionUtilities {
      *
      * @param urlString an absolute URL giving location of resource to read.
      */
-    public static InputStream getInputStream(String urlString) throws IOException {
+    public static InputStream getInputStream(String urlString, boolean protocolRestricted) throws IOException {
         try {
-            URLConnection urlConn = new URL(urlString).openConnection();
+            URL url = new URL(urlString);
+            if(protocolRestricted) {
+                String allowed = PrefsSearch.getString(ArgValue.SECURITY_FILE_PROTOCOLS);
+                if(!isAllowed(allowed, url)) {
+                    log.error("URL '{}' is not a valid http or https location.  Configure property '{}' to modify this behavior.", url, ArgValue.SECURITY_FILE_PROTOCOLS.getMatch());
+                    throw new IOException(String.format("URL '%s' is not a valid [%s] location", url, allowed));
+                }
+            }
+            URLConnection urlConn = url.openConnection();
             for( String key : getRequestProperties().keySet()) {
                 urlConn.setRequestProperty(key, requestProps.get(key));
             }
@@ -54,6 +62,24 @@ public static InputStream getInputStream(String urlString) throws IOException {
         }
     }
 
+    private static boolean isAllowed(String allowed, URL url) {
+        if(url == null) return false;
+        String urlProtocol = url.getProtocol();
+        if(urlProtocol == null || urlProtocol.trim().isEmpty()) return false;
+        allowed = ArgValue.SECURITY_FILE_PROTOCOLS.getDefaultVal() +
+                (allowed == null || allowed.trim().isEmpty() ? "" : "," + allowed);
+        String[] protocols = allowed.split(",");
+        // Loop over http, https, etc
+        for(String protocol : protocols) {
+            if (url != null) {
+                if(urlProtocol.trim().equalsIgnoreCase(protocol.trim())) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
     /**
      * A blind SSL trust manager, for debugging SSL issues
      */
diff --git a/src/qz/utils/FileUtilities.java b/src/qz/utils/FileUtilities.java
index 788fca336..51c54e7ad 100644
--- a/src/qz/utils/FileUtilities.java
+++ b/src/qz/utils/FileUtilities.java
@@ -592,7 +592,7 @@ public static String readLocalFile(Path path) throws IOException {
     }
 
     public static byte[] readRawFile(String url) throws IOException {
-        return readFile(new DataInputStream(ConnectionUtilities.getInputStream(url)));
+        return readFile(new DataInputStream(ConnectionUtilities.getInputStream(url, true)));
     }
 
     private static byte[] readFile(DataInputStream in) throws IOException {

From e004349f0b28e2de678c0ce8b8f18c4204767a10 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Tue, 7 Nov 2023 23:07:13 -0500
Subject: [PATCH 02/12] Consolidate file writing

---
 src/qz/printer/action/PrintRaw.java | 14 +++-----------
 src/qz/utils/ArgValue.java          |  2 --
 2 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/src/qz/printer/action/PrintRaw.java b/src/qz/printer/action/PrintRaw.java
index b6c7a43d2..823e54998 100644
--- a/src/qz/printer/action/PrintRaw.java
+++ b/src/qz/printer/action/PrintRaw.java
@@ -403,9 +403,9 @@ private void printToHost(String host, int port, byte[] cmds) throws IOException
     private void printToFile(File file, byte[] cmds, boolean locationRestricted) throws IOException {
         if(file == null) throw new IOException("No file specified");
 
-        if(!isAllowed(file)) {
-            log.error("Printing to file '{}' is not permitted.  Configure property '{}' or '{}' to modify this behavior.",
-                      file, ArgValue.SECURITY_PRINT_UNC.getMatch(), ArgValue.SECURITY_PRINT_FILE.getMatch());
+        if(locationRestricted && !PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_FILE)) {
+            log.error("Printing to file '{}' is not permitted.  Configure property '{}' to modify this behavior.",
+                      file, ArgValue.SECURITY_PRINT_FILE.getMatch());
             throw new IOException(String.format("Printing to file '%s' is not permitted", file));
         }
 
@@ -417,14 +417,6 @@ private void printToFile(File file, byte[] cmds, boolean locationRestricted) thr
         }
     }
 
-    private boolean isAllowed(File file) {
-        return file.getPath().startsWith("\\\\") ?
-                // UNC Path
-                PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_UNC) :
-                // Regular file
-                PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_FILE);
-    }
-
     /**
      * Constructs a {@code SimpleDoc} with the {@code commands} byte array.
      */
diff --git a/src/qz/utils/ArgValue.java b/src/qz/utils/ArgValue.java
index cc11985ec..1ad844433 100644
--- a/src/qz/utils/ArgValue.java
+++ b/src/qz/utils/ArgValue.java
@@ -71,8 +71,6 @@ public enum ArgValue {
         "security.file.strict"),
     SECURITY_FILE_PROTOCOLS(PREFERENCES, "URL protocols allowed for print, serial, hid, etc", null, "http,https",
         "security.file.protocols"),
-    SECURITY_PRINT_UNC(PREFERENCES, "Enable/disable printing directly to UNC paths", null, false,
-        "security.print.unc"),
     SECURITY_PRINT_FILE(PREFERENCES, "Enable/disable printing directly to file paths", null, false,
         "security.print.file"),
     LOG_DISABLE(PREFERENCES, "Disable/enable logging features", null, false,

From 496be73224c572e3a7aeb3449104c42c7fdc7315 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Tue, 7 Nov 2023 23:21:18 -0500
Subject: [PATCH 03/12] Rename property "security.print.tofile"

---
 src/qz/utils/ArgValue.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/qz/utils/ArgValue.java b/src/qz/utils/ArgValue.java
index 1ad844433..cea4956d0 100644
--- a/src/qz/utils/ArgValue.java
+++ b/src/qz/utils/ArgValue.java
@@ -72,7 +72,7 @@ public enum ArgValue {
     SECURITY_FILE_PROTOCOLS(PREFERENCES, "URL protocols allowed for print, serial, hid, etc", null, "http,https",
         "security.file.protocols"),
     SECURITY_PRINT_FILE(PREFERENCES, "Enable/disable printing directly to file paths", null, false,
-        "security.print.file"),
+        "security.print.tofile"),
     LOG_DISABLE(PREFERENCES, "Disable/enable logging features", null, false,
         "log.disable"),
     LOG_ROTATE(PREFERENCES, "Number of log files to retain when the size fills up", null, 5,

From f0c3df533c3cec814371ed0d1e8d8e1e436afb61 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Tue, 7 Nov 2023 23:25:39 -0500
Subject: [PATCH 04/12] Rename property "security.data.protocols"

---
 src/qz/printer/action/PrintRaw.java   | 4 ++--
 src/qz/utils/ArgValue.java            | 6 +++---
 src/qz/utils/ConnectionUtilities.java | 7 +++----
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/qz/printer/action/PrintRaw.java b/src/qz/printer/action/PrintRaw.java
index 823e54998..d5e728768 100644
--- a/src/qz/printer/action/PrintRaw.java
+++ b/src/qz/printer/action/PrintRaw.java
@@ -403,9 +403,9 @@ private void printToHost(String host, int port, byte[] cmds) throws IOException
     private void printToFile(File file, byte[] cmds, boolean locationRestricted) throws IOException {
         if(file == null) throw new IOException("No file specified");
 
-        if(locationRestricted && !PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_FILE)) {
+        if(locationRestricted && !PrefsSearch.getBoolean(ArgValue.SECURITY_PRINT_TOFILE)) {
             log.error("Printing to file '{}' is not permitted.  Configure property '{}' to modify this behavior.",
-                      file, ArgValue.SECURITY_PRINT_FILE.getMatch());
+                      file, ArgValue.SECURITY_PRINT_TOFILE.getMatch());
             throw new IOException(String.format("Printing to file '%s' is not permitted", file));
         }
 
diff --git a/src/qz/utils/ArgValue.java b/src/qz/utils/ArgValue.java
index cea4956d0..c6e1a01fb 100644
--- a/src/qz/utils/ArgValue.java
+++ b/src/qz/utils/ArgValue.java
@@ -69,9 +69,9 @@ public enum ArgValue {
         "security.file.enabled"),
     SECURITY_FILE_STRICT(PREFERENCES, "Enable/disable signing requirements for File Communications features", null, true,
         "security.file.strict"),
-    SECURITY_FILE_PROTOCOLS(PREFERENCES, "URL protocols allowed for print, serial, hid, etc", null, "http,https",
-        "security.file.protocols"),
-    SECURITY_PRINT_FILE(PREFERENCES, "Enable/disable printing directly to file paths", null, false,
+    SECURITY_DATA_PROTOCOLS(PREFERENCES, "URL protocols allowed for print, serial, hid, etc", null, "http,https",
+        "security.data.protocols"),
+    SECURITY_PRINT_TOFILE(PREFERENCES, "Enable/disable printing directly to file paths", null, false,
         "security.print.tofile"),
     LOG_DISABLE(PREFERENCES, "Disable/enable logging features", null, false,
         "log.disable"),
diff --git a/src/qz/utils/ConnectionUtilities.java b/src/qz/utils/ConnectionUtilities.java
index 7c5235eb7..233c4c07a 100644
--- a/src/qz/utils/ConnectionUtilities.java
+++ b/src/qz/utils/ConnectionUtilities.java
@@ -17,7 +17,6 @@
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.HashMap;
-import java.util.Locale;
 import java.util.Map;
 
 import org.apache.commons.lang3.StringUtils;
@@ -43,9 +42,9 @@ public static InputStream getInputStream(String urlString, boolean protocolRestr
         try {
             URL url = new URL(urlString);
             if(protocolRestricted) {
-                String allowed = PrefsSearch.getString(ArgValue.SECURITY_FILE_PROTOCOLS);
+                String allowed = PrefsSearch.getString(ArgValue.SECURITY_DATA_PROTOCOLS);
                 if(!isAllowed(allowed, url)) {
-                    log.error("URL '{}' is not a valid http or https location.  Configure property '{}' to modify this behavior.", url, ArgValue.SECURITY_FILE_PROTOCOLS.getMatch());
+                    log.error("URL '{}' is not a valid http or https location.  Configure property '{}' to modify this behavior.", url, ArgValue.SECURITY_DATA_PROTOCOLS.getMatch());
                     throw new IOException(String.format("URL '%s' is not a valid [%s] location", url, allowed));
                 }
             }
@@ -66,7 +65,7 @@ private static boolean isAllowed(String allowed, URL url) {
         if(url == null) return false;
         String urlProtocol = url.getProtocol();
         if(urlProtocol == null || urlProtocol.trim().isEmpty()) return false;
-        allowed = ArgValue.SECURITY_FILE_PROTOCOLS.getDefaultVal() +
+        allowed = ArgValue.SECURITY_DATA_PROTOCOLS.getDefaultVal() +
                 (allowed == null || allowed.trim().isEmpty() ? "" : "," + allowed);
         String[] protocols = allowed.split(",");
         // Loop over http, https, etc

From 2462eebb2e8148c4e091dcfbf4b78669c55a6c45 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Wed, 8 Nov 2023 00:18:51 -0500
Subject: [PATCH 05/12] Allow prints from demo/assets

---
 src/qz/utils/ConnectionUtilities.java | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/qz/utils/ConnectionUtilities.java b/src/qz/utils/ConnectionUtilities.java
index 233c4c07a..b76d9c1d5 100644
--- a/src/qz/utils/ConnectionUtilities.java
+++ b/src/qz/utils/ConnectionUtilities.java
@@ -12,11 +12,15 @@
 import java.awt.*;
 import java.io.IOException;
 import java.io.InputStream;
+import java.net.MalformedURLException;
+import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLConnection;
+import java.nio.file.Paths;
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.HashMap;
+import java.util.Locale;
 import java.util.Map;
 
 import org.apache.commons.lang3.StringUtils;
@@ -76,6 +80,18 @@ private static boolean isAllowed(String allowed, URL url) {
                 }
             }
         }
+        // Allow exception for file: demo/assets
+        if(urlProtocol.trim().toLowerCase(Locale.ENGLISH).equals("file")) {
+            try {
+                // Sanitize manipulative URLs
+                url = Paths.get(url.toURI()).normalize().toUri().toURL();
+                if (url.getPath().matches(".*/demo/assets/.*|.*/tray/assets/.*")) {
+                    log.warn("Allowing printing from restricted protocol '{}:' for demo asset '{}'", urlProtocol, url);
+                    return true;
+                }
+            }
+            catch(URISyntaxException | MalformedURLException ignore) {}
+        }
         return false;
     }
 

From 424857544de5854c5ad4e6126b3fce0f637a7154 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Tue, 14 Nov 2023 23:40:43 -0500
Subject: [PATCH 06/12] Remove unused listener

---
 sample.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sample.html b/sample.html
index c46f128cc..7e857e193 100755
--- a/sample.html
+++ b/sample.html
@@ -1151,7 +1151,7 @@ <h3>Printer Status</h3>
                                         <div class="col-md-6 pull-right">
                                             <div class="form-group form-inline">
                                                 <label class="tip" for="maxJobData" data-toggle="tooltip" title="Maximum size in bytes of spool file content to return (Windows only)">
-                                                Raw Job Data Size
+                                                    Raw Job Data Size
                                                 </label>
                                                 <input type="number" id="maxJobData" class="pull-right"/>
                                             </div>

From d617d35cf475cbef20da8426015854860b11c1ac Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Thu, 23 Nov 2023 13:02:05 -0500
Subject: [PATCH 07/12] Add additional security flags

---
 .../certificate/CertificateManager.java       |  6 ++----
 src/qz/utils/ArgValue.java                    |  6 ++++++
 src/qz/ws/PrintSocketServer.java              | 21 +++++++++++++------
 3 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/src/qz/installer/certificate/CertificateManager.java b/src/qz/installer/certificate/CertificateManager.java
index 8b6972f25..c67674c91 100644
--- a/src/qz/installer/certificate/CertificateManager.java
+++ b/src/qz/installer/certificate/CertificateManager.java
@@ -29,6 +29,7 @@
 import org.apache.logging.log4j.Logger;
 import qz.common.Constants;
 import qz.installer.Installer;
+import qz.utils.ArgValue;
 import qz.utils.FileUtilities;
 import qz.utils.MacUtilities;
 import qz.utils.SystemUtilities;
@@ -60,10 +61,7 @@ public class CertificateManager {
 
     public static String DEFAULT_KEYSTORE_FORMAT = "PKCS12";
     public static String DEFAULT_KEYSTORE_EXTENSION = ".p12";
-
     public static String DEFAULT_CERTIFICATE_EXTENSION = ".crt";
-
-    private static String DEFAULT_HOST_SCOPE = "0.0.0.0";
     private static int DEFAULT_PASSWORD_BITS = 100;
 
     private boolean needsInstall;
@@ -331,7 +329,7 @@ public Properties writeKeystore(Properties props, KeyPairWrapper.Type type) thro
         props.putIfAbsent(String.format("%s.alias", keyPair.propsPrefix()), keyPair.getAlias());
 
         if (keyPair.getType() == SSL) {
-            props.putIfAbsent(String.format("%s.host", keyPair.propsPrefix()), DEFAULT_HOST_SCOPE);
+            props.putIfAbsent(String.format("%s.host", keyPair.propsPrefix()), ArgValue.SECURITY_WSS_HOST.getDefaultVal());
         }
 
 
diff --git a/src/qz/utils/ArgValue.java b/src/qz/utils/ArgValue.java
index c6e1a01fb..f73b7eb3f 100644
--- a/src/qz/utils/ArgValue.java
+++ b/src/qz/utils/ArgValue.java
@@ -73,6 +73,12 @@ public enum ArgValue {
         "security.data.protocols"),
     SECURITY_PRINT_TOFILE(PREFERENCES, "Enable/disable printing directly to file paths", null, false,
         "security.print.tofile"),
+    SECURITY_WSS_SNISTRICT(PREFERENCES, "Enables strict http/websocket SNI checks", null, false,
+                           "security.wss.snistrict"),
+    SECURITY_WSS_HTTPSONLY(PREFERENCES, "Disables insecure http/websocket ports (e.g. '8182')", null, false,
+                           "security.wss.httpsonly"),
+    SECURITY_WSS_HOST(PREFERENCES, "Influences which physical adapter to bind to by setting the host parameter for http/websocket listening", null, "0.0.0.0",
+                           "security.wss.host"),
     LOG_DISABLE(PREFERENCES, "Disable/enable logging features", null, false,
         "log.disable"),
     LOG_ROTATE(PREFERENCES, "Number of log files to retain when the size fills up", null, 5,
diff --git a/src/qz/ws/PrintSocketServer.java b/src/qz/ws/PrintSocketServer.java
index c76190d23..4ed7fbcac 100644
--- a/src/qz/ws/PrintSocketServer.java
+++ b/src/qz/ws/PrintSocketServer.java
@@ -23,16 +23,15 @@
 import qz.common.Constants;
 import qz.common.TrayManager;
 import qz.installer.certificate.CertificateManager;
+import qz.utils.ArgValue;
+import qz.utils.PrefsSearch;
 
 import javax.servlet.DispatcherType;
 import javax.swing.*;
 import java.io.IOException;
 import java.lang.reflect.InvocationTargetException;
 import java.time.Duration;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.EnumSet;
-import java.util.List;
+import java.util.*;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -54,13 +53,20 @@ public class PrintSocketServer {
 
     private static TrayManager trayManager;
     private static Server server;
+    private static boolean httpsOnly;
+    private static boolean sniStrict;
+    private static String wssHost;
 
     public static void runServer(CertificateManager certManager, boolean headless) throws InterruptedException, InvocationTargetException {
         SwingUtilities.invokeAndWait(() -> {
             PrintSocketServer.setTrayManager(new TrayManager(headless));
         });
 
+        wssHost = PrefsSearch.getString(ArgValue.SECURITY_WSS_HOST, certManager.getProperties());
+        httpsOnly = PrefsSearch.getBoolean(ArgValue.SECURITY_WSS_HTTPSONLY, certManager.getProperties());
+        sniStrict = PrefsSearch.getBoolean(ArgValue.SECURITY_WSS_SNISTRICT, certManager.getProperties());
         server = findAvailableSecurePort(certManager);
+
         Connector secureConnector = null;
         if (server.getConnectors().length > 0 && !server.getConnectors()[0].isFailed()) {
             secureConnector = server.getConnectors()[0];
@@ -70,6 +76,9 @@ public static void runServer(CertificateManager certManager, boolean headless) t
             try {
                 ServerConnector connector = new ServerConnector(server);
                 connector.setPort(getInsecurePortInUse());
+                if(httpsOnly) {
+                    // TODO: Help!  @akberenz, how do we use secure only?
+                }
                 if (secureConnector != null) {
                     //setup insecure connector before secure
                     server.setConnectors(new Connector[] {connector, secureConnector});
@@ -148,13 +157,13 @@ private static Server findAvailableSecurePort(CertificateManager certManager) {
                     // Disable SNI checks for easier print-server testing (replicates Jetty 9.x behavior)
                     HttpConfiguration httpsConfig = new HttpConfiguration();
                     SecureRequestCustomizer customizer = new SecureRequestCustomizer();
-                    customizer.setSniHostCheck(false);
+                    customizer.setSniHostCheck(sniStrict);
                     httpsConfig.addCustomizer(customizer);
 
                     HttpConnectionFactory httpConnection = new HttpConnectionFactory(httpsConfig);
 
                     ServerConnector secureConnector = new ServerConnector(server, sslConnection, httpConnection);
-                    secureConnector.setHost(certManager.getProperties().getProperty("wss.host"));
+                    secureConnector.setHost(wssHost);
                     secureConnector.setPort(getSecurePortInUse());
                     server.setConnectors(new Connector[] {secureConnector});
 

From 682d4c24c759fa4470373231bc5d43b8b9b86f1e Mon Sep 17 00:00:00 2001
From: Berenz <5912715+akberenz@users.noreply.github.com>
Date: Thu, 23 Nov 2023 14:33:03 -0500
Subject: [PATCH 08/12] apply http-only connectors

---
 src/qz/ws/PrintSocketServer.java | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/qz/ws/PrintSocketServer.java b/src/qz/ws/PrintSocketServer.java
index 4ed7fbcac..af189a0fe 100644
--- a/src/qz/ws/PrintSocketServer.java
+++ b/src/qz/ws/PrintSocketServer.java
@@ -72,14 +72,18 @@ public static void runServer(CertificateManager certManager, boolean headless) t
             secureConnector = server.getConnectors()[0];
         }
 
+        if (httpsOnly && secureConnector == null) {
+            log.error("Failed to start in https-only mode");
+            return;
+        }
+
         while(!running.get() && insecurePortIndex.get() < INSECURE_PORTS.size()) {
             try {
                 ServerConnector connector = new ServerConnector(server);
                 connector.setPort(getInsecurePortInUse());
                 if(httpsOnly) {
-                    // TODO: Help!  @akberenz, how do we use secure only?
-                }
-                if (secureConnector != null) {
+                    server.setConnectors(new Connector[] {secureConnector});
+                } else if (secureConnector != null) {
                     //setup insecure connector before secure
                     server.setConnectors(new Connector[] {connector, secureConnector});
                 } else {

From 287fac50066ea3903b1893fe66605f501937c41b Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Thu, 23 Nov 2023 15:13:30 -0500
Subject: [PATCH 09/12] Fix delivery of shutdown request

---
 src/qz/common/TrayManager.java   | 2 +-
 src/qz/ws/PrintSocketServer.java | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/qz/common/TrayManager.java b/src/qz/common/TrayManager.java
index c2c5917a6..7f16e74f4 100644
--- a/src/qz/common/TrayManager.java
+++ b/src/qz/common/TrayManager.java
@@ -634,7 +634,7 @@ private void displayMessage(final String caption, final String text, final TrayI
 
     public void singleInstanceCheck(java.util.List<Integer> insecurePorts, Integer insecurePortIndex) {
         for(int port : insecurePorts) {
-            if (port != insecurePorts.get(insecurePortIndex)) {
+            if (insecurePortIndex == -1 || port != insecurePorts.get(insecurePortIndex)) {
                 new SingleInstanceChecker(this, port);
             }
         }
diff --git a/src/qz/ws/PrintSocketServer.java b/src/qz/ws/PrintSocketServer.java
index af189a0fe..1c5511d0a 100644
--- a/src/qz/ws/PrintSocketServer.java
+++ b/src/qz/ws/PrintSocketServer.java
@@ -128,7 +128,7 @@ public static void runServer(CertificateManager certManager, boolean headless) t
                 running.set(true);
 
                 log.info("Server started on port(s) " + getPorts(server));
-                trayManager.setServer(server, insecurePortIndex.get());
+                trayManager.setServer(server, httpsOnly ? -1 : insecurePortIndex.get());
                 server.join();
             }
             catch(IOException | MultiException e) {

From 42d6b7a72d170402829998f6fcb0e95c7fa8517d Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Thu, 23 Nov 2023 15:31:33 -0500
Subject: [PATCH 10/12] Attempt to shut down from secure port (broken)

---
 src/qz/common/TrayManager.java       | 14 ++++++++------
 src/qz/ws/PrintSocketServer.java     |  4 +++-
 src/qz/ws/SingleInstanceChecker.java |  4 ++--
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/qz/common/TrayManager.java b/src/qz/common/TrayManager.java
index 7f16e74f4..53a7257eb 100644
--- a/src/qz/common/TrayManager.java
+++ b/src/qz/common/TrayManager.java
@@ -534,9 +534,11 @@ private void blackList(Certificate cert) {
         }
     }
 
-    public void setServer(Server server, int insecurePortIndex) {
+    public void setServer(Server server, int insecurePortInUse, int securePortInUse) {
         if (server != null && server.getConnectors().length > 0) {
-            singleInstanceCheck(PrintSocketServer.INSECURE_PORTS, insecurePortIndex);
+            singleInstanceCheck(PrintSocketServer.INSECURE_PORTS, insecurePortInUse, false);
+            // FIXME: This isn't working
+            //singleInstanceCheck(PrintSocketServer.SECURE_PORTS, securePortInUse, true);
 
             displayInfoMessage("Server started on port(s) " + PrintSocketServer.getPorts(server));
 
@@ -632,10 +634,10 @@ private void displayMessage(final String caption, final String text, final TrayI
         }
     }
 
-    public void singleInstanceCheck(java.util.List<Integer> insecurePorts, Integer insecurePortIndex) {
-        for(int port : insecurePorts) {
-            if (insecurePortIndex == -1 || port != insecurePorts.get(insecurePortIndex)) {
-                new SingleInstanceChecker(this, port);
+    public void singleInstanceCheck(java.util.List<Integer> ports, Integer portInUse, boolean usingSecure) {
+        for(int port : ports) {
+            if (portInUse == -1 || port != ports.get(portInUse)) {
+                new SingleInstanceChecker(this, port, usingSecure);
             }
         }
     }
diff --git a/src/qz/ws/PrintSocketServer.java b/src/qz/ws/PrintSocketServer.java
index 1c5511d0a..c45c76cd3 100644
--- a/src/qz/ws/PrintSocketServer.java
+++ b/src/qz/ws/PrintSocketServer.java
@@ -128,7 +128,9 @@ public static void runServer(CertificateManager certManager, boolean headless) t
                 running.set(true);
 
                 log.info("Server started on port(s) " + getPorts(server));
-                trayManager.setServer(server, httpsOnly ? -1 : insecurePortIndex.get());
+                int insecurePort = httpsOnly ? -1 : insecurePortIndex.get();
+                int securePort = secureConnector == null ? -1 : securePortIndex.get();
+                trayManager.setServer(server, insecurePort, securePort);
                 server.join();
             }
             catch(IOException | MultiException e) {
diff --git a/src/qz/ws/SingleInstanceChecker.java b/src/qz/ws/SingleInstanceChecker.java
index 24398fe30..e3907296c 100644
--- a/src/qz/ws/SingleInstanceChecker.java
+++ b/src/qz/ws/SingleInstanceChecker.java
@@ -53,11 +53,11 @@ public class SingleInstanceChecker {
     private WebSocketClient client;
 
 
-    public SingleInstanceChecker(TrayManager trayManager, int port) {
+    public SingleInstanceChecker(TrayManager trayManager, int port, boolean usingSecure) {
         this.trayManager = trayManager;
         log.debug("Checking for a running instance of {} on port {}", Constants.ABOUT_TITLE, port);
         autoCloseClient(AUTO_CLOSE);
-        connectTo("ws://localhost:" + port);
+        connectTo(String.format("%s//localhost:%d", (usingSecure ? "wss:" : "ws:"), port));
     }
 
     private void connectTo(String uri) {

From a8ea3e5607b1e2a9edebc32d5b8543ed7c565e6d Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Fri, 24 Nov 2023 02:25:46 -0500
Subject: [PATCH 11/12] Fix shutdown request on secure port

---
 src/qz/common/TrayManager.java       |  3 +--
 src/qz/ws/SingleInstanceChecker.java | 20 +++++++++++++++++---
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/qz/common/TrayManager.java b/src/qz/common/TrayManager.java
index 53a7257eb..12b773ac0 100644
--- a/src/qz/common/TrayManager.java
+++ b/src/qz/common/TrayManager.java
@@ -537,8 +537,7 @@ private void blackList(Certificate cert) {
     public void setServer(Server server, int insecurePortInUse, int securePortInUse) {
         if (server != null && server.getConnectors().length > 0) {
             singleInstanceCheck(PrintSocketServer.INSECURE_PORTS, insecurePortInUse, false);
-            // FIXME: This isn't working
-            //singleInstanceCheck(PrintSocketServer.SECURE_PORTS, securePortInUse, true);
+            singleInstanceCheck(PrintSocketServer.SECURE_PORTS, securePortInUse, true);
 
             displayInfoMessage("Server started on port(s) " + PrintSocketServer.getPorts(server));
 
diff --git a/src/qz/ws/SingleInstanceChecker.java b/src/qz/ws/SingleInstanceChecker.java
index e3907296c..254b53f92 100644
--- a/src/qz/ws/SingleInstanceChecker.java
+++ b/src/qz/ws/SingleInstanceChecker.java
@@ -14,6 +14,10 @@
 import org.apache.logging.log4j.Logger;
 import org.codehaus.jettison.json.JSONException;
 import org.codehaus.jettison.json.JSONObject;
+import org.eclipse.jetty.client.HttpClient;
+import org.eclipse.jetty.client.http.HttpClientTransportOverHTTP;
+import org.eclipse.jetty.io.ClientConnector;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.eclipse.jetty.websocket.api.CloseStatus;
 import org.eclipse.jetty.websocket.api.Session;
 import org.eclipse.jetty.websocket.api.annotations.*;
@@ -57,13 +61,23 @@ public SingleInstanceChecker(TrayManager trayManager, int port, boolean usingSec
         this.trayManager = trayManager;
         log.debug("Checking for a running instance of {} on port {}", Constants.ABOUT_TITLE, port);
         autoCloseClient(AUTO_CLOSE);
-        connectTo(String.format("%s//localhost:%d", (usingSecure ? "wss:" : "ws:"), port));
+        String uri = String.format("%s//localhost:%d", (usingSecure ? "wss:" : "ws:"), port);
+        connectTo(uri, usingSecure);
     }
 
-    private void connectTo(String uri) {
+    private void connectTo(String uri, boolean usingSecure) {
         try {
             if (client == null) {
-                client = new WebSocketClient();
+                if(usingSecure) {
+                    // Self-signed certs won't be trusted, create "trustAll" connector
+                    SslContextFactory.Client sslContextFactory = new SslContextFactory.Client(true);
+                    ClientConnector clientConnector = new ClientConnector();
+                    clientConnector.setSslContextFactory(sslContextFactory);
+                    HttpClient httpClient = new HttpClient(new HttpClientTransportOverHTTP(clientConnector));
+                    client = new WebSocketClient(httpClient);
+                } else {
+                    client = new WebSocketClient();
+                }
                 client.start();
                 client.setConnectTimeout(TIMEOUT);
                 client.setIdleTimeout(Duration.ofMillis(TIMEOUT));

From d113f41c90a3411be00ac5fe0be089aaacaaec18 Mon Sep 17 00:00:00 2001
From: Tres Finocchiaro <tres.finocchiaro@gmail.com>
Date: Sat, 25 Nov 2023 10:45:29 -0500
Subject: [PATCH 12/12] Remove redundant null check

---
 src/qz/utils/ConnectionUtilities.java | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/qz/utils/ConnectionUtilities.java b/src/qz/utils/ConnectionUtilities.java
index b76d9c1d5..21221ce0c 100644
--- a/src/qz/utils/ConnectionUtilities.java
+++ b/src/qz/utils/ConnectionUtilities.java
@@ -74,10 +74,8 @@ private static boolean isAllowed(String allowed, URL url) {
         String[] protocols = allowed.split(",");
         // Loop over http, https, etc
         for(String protocol : protocols) {
-            if (url != null) {
-                if(urlProtocol.trim().equalsIgnoreCase(protocol.trim())) {
-                    return true;
-                }
+            if(urlProtocol.trim().equalsIgnoreCase(protocol.trim())) {
+                return true;
             }
         }
         // Allow exception for file: demo/assets