| Summary: | Can't use password when (un)restricting DOC(X) forms | ||
|---|---|---|---|
| Product: | LibreOffice | Reporter: | Aron Budea <aron.budea> |
| Component: | Writer | Assignee: | Not Assigned <libreoffice-bugs> |
| Status: | NEW --- | ||
| Severity: | enhancement | CC: | cno, hendrik, jluth |
| Priority: | medium | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: |
https://bugs.documentfoundation.org/show_bug.cgi?id=123912 https://bugs.documentfoundation.org/show_bug.cgi?id=120854 |
||
| Whiteboard: | |||
| Crash report or crash signature: | Regression By: | ||
| Bug Depends on: | |||
| Bug Blocks: | 104523, 108914, 120763, 120853 | ||
| Attachments: |
Sample DOCX (restricted using pw 1234)
protectSection.odt: the LO way of protecting - half works in DOCX and doesn't in DOC |
||
|
Description
Aron Budea
2018-10-11 04:16:47 UTC
Interesting note. Word 2003 unrestricts without a password too, but it properly saves a password. DOCX: only round-trips these settings, but doesn't use them other than to turn on PROTECT_FORM. (look for XML_documentProtection in docxexport.cxx and GetDocumentProtectionSettings() in writerfilter). I like being able to bypass these passwords in LO, and the way to disable protection is buried pretty deep, so it hardly seems necessary. Created attachment 145686 [details]
protectSection.odt: the LO way of protecting - half works in DOCX and doesn't in DOC
Personally, if I do decide to work on this, I would start by making sure that this ODT file exports/imports well with doc/docx.
Currently, it exports OK to both doc and docx (except that it doesn't export the password). Word 2016 can edit the unprotected section, honours the protected area, but unprotects without a password.
LO currently imports the resulting .doc file very poorly - no protection at all. Importing the resulting .docx file protects everything, not just the section.
I expect that the password will need to use functions from include/comphelper/docpasswordhelper.hxx (In reply to Justin L from comment #3) > Currently, it exports OK to both doc and docx (except that it doesn't export > the password). So, from a theoretical perspective, it would probably be a very bad thing to take the password implementation of LibreOffice and export it into .doc's lKeyDocProt password because that is very weak encryption. That would allow someone to take a confidential .odt file, export to .doc and then easily be able to crack the password. However, that is NOT what OP was suggesting. They are only asking for the compatibility flag PROTECT_FORM to be connected to the .doc* password. This would not be a security concern. The passwords exist in the InteropGrabBag, and so could be checked, or re-written. In 7.1, the situation for import is very good. Both DOC and DOCX protect the first section, and both allow editing in the second section. In neither case is the section password protected. (I created a new password, in case LO caches an MS Format compatible password as well as an ODT password, but that wasn't the case. I know that IS used in some places, like document crash recovery.) *** Bug 130565 has been marked as a duplicate of this bug. *** |