Download it now!
Bug 104250 - FILEOPEN XLSX: password is not required for unlocking protected sheet
Summary: FILEOPEN XLSX: password is not required for unlocking protected sheet
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: high enhancement
Assignee: Eike Rathke
URL:
Whiteboard: target:6.1.0
Keywords:
Depends on:
Blocks: Cell-Protection XLSX
  Show dependency treegraph
 
Reported: 2016-11-29 09:35 UTC by Gabor Kelemen
Modified: 2018-02-26 11:16 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:


Attachments
Password protected sheet from Excel 2013 (8.08 KB, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet)
2016-11-29 09:36 UTC, Gabor Kelemen
Details
Excel 2013 asks for password to unprotect the sheet (48.91 KB, image/png)
2016-11-29 10:01 UTC, Gabor Kelemen
Details
Excel 2010 asks for password to unprotect the sheet (89.86 KB, image/png)
2016-11-29 10:13 UTC, Gabor Kelemen
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Kelemen 2016-11-29 09:35:11 UTC
Description:
Attached xlsx sheet was created in MSO 2013, it has a password protected sheet. Unlocking the protection does not ask for the password.

Steps to Reproduce:
1. Open attached file
2. Right click on the sheet name, see that the Protect Sheet item is checked
3. Click Protect Sheet.

Actual Results:  
The sheet is unlocked without asking for the password.

Expected Results:
Password is asked before unlocking.


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Comment 1 Gabor Kelemen 2016-11-29 09:36:05 UTC
Created attachment 129104 [details]
Password protected sheet from Excel 2013
Comment 2 Xisco Faulí 2016-11-29 09:52:31 UTC Comment hidden (obsolete)
Comment 3 Gabor Kelemen 2016-11-29 10:01:27 UTC
Created attachment 129105 [details]
Excel 2013 asks for password to unprotect the sheet
Comment 4 Xisco Faulí 2016-11-29 10:09:40 UTC
ouch, I didn't follow the steps correctly, my bad.

Reproduced in

- Version: 5.3.0.0.beta1
Build ID: 690f553ecb3efd19143acbf01f3af4e289e94536
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk2; Layout Engine: new; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group

- Version: 5.0.0.0.alpha1+
Build ID: 0db96caf0fcce09b87621c11b584a6d81cc7df86
Locale: ca-ES (ca_ES.UTF-8)

- Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)
Comment 5 Gabor Kelemen 2016-11-29 10:13:27 UTC
Created attachment 129106 [details]
Excel 2010 asks for password to unprotect the sheet

Both Excel 2010 and 2013 ask for password to unprotect it.
Comment 6 m.a.riosv 2016-11-29 23:19:14 UTC
It's an inherited from OOo issue reproducible with AOo 4.1.3
Comment 7 m.a.riosv 2016-11-29 23:26:28 UTC Comment hidden (obsolete)
Comment 8 Gabor Kelemen 2016-11-30 08:26:58 UTC
(In reply to m.a.riosv from comment #7)
> If it is protected with a blank password shows the same behaviour saving and
> opening with LO, but not with a minimal password.
> 
> Are we sure it is protected with a not blank password?

Try to open it in Excel :). I can't unlock it there with an empty password, only with "pwd" as stated in cell B2.
Comment 9 m.a.riosv 2016-11-30 09:33:32 UTC
Sorry, I have not excel for test.
Comment 10 Xisco Faulí 2018-02-22 13:44:07 UTC
*** Bug 115933 has been marked as a duplicate of this bug. ***
Comment 11 Xisco Faulí 2018-02-22 14:00:39 UTC
@Markus, @Bartosz, I thought you might be interested in this issue...
Comment 12 Xisco Faulí 2018-02-22 14:48:07 UTC
*** Bug 115933 has been marked as a duplicate of this bug. ***
Comment 13 Eike Rathke 2018-02-22 15:58:14 UTC
Investigating.
Comment 14 Eike Rathke 2018-02-22 21:35:28 UTC
This will need to support the <sheetProtection> element with algorithmName, hashValue, saltValue and spinCount attributes and feed those with the password to be entered to the proper hashing/digest implementation.

Currently only the password attribute with XL+SHA1 hash is supported, which is not present here.
Comment 15 Commit Notification 2018-02-23 10:17:58 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=62767cf6062d4e90ba5de9b19927b1a96d0f7e62

Read algorithmName, hashValue, saltValue, spinCount, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2018-02-23 18:51:13 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6d67347311923dbe3975cfa197649f5856c00723

Move OOXML password definitions to struct ScOoxPasswordHash, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2018-02-24 10:29:37 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=556c2eaffcdb541317ed148d58c6c973fa6fd0e6

Implement OOXML password hashing algorithm, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2018-02-24 10:48:01 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f1fb9932492249ec3f1546e79be8b3be7fb195f3

Add ScOoxPasswordHash::clear(), tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2018-02-24 10:48:07 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4446ac904ebaa0b2ba0fed17f2f8fd39d3a3c7fb

Hold ScOoxPasswordHash at ScTableProtectionImpl, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Commit Notification 2018-02-24 10:48:14 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=89182507aaf336d16ba1e89305bc2ea3b1e6949f

Hash Base64, Sequence and cleansing, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 21 Commit Notification 2018-02-24 20:03:41 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5f4df7af832e886bd279db566dc6693db9bb6a89

Consider ScOoxPasswordHash in isProtectedWithPass(), tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 22 Commit Notification 2018-02-24 20:03:49 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d841f348b94f30cb8e94a0d34e9b20aa34d33aca

Add ScOoxPasswordHash::verifyPassword(), tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 23 Commit Notification 2018-02-24 20:03:57 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c6eb3bf58c9c236dc7fe47fb9c4df7dd2a98c2d0

Check also ScOoxPasswordHash::verifyPassword(), tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 24 Commit Notification 2018-02-24 20:04:04 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0423db153603368a69297e5309d3065d57c4d068

Add ScTableProtectionImpl::setPasswordHash() for OOXML, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 25 Commit Notification 2018-02-24 20:04:12 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e3dd12fa8a71c7d0d35fb2146436934d1f4ee004

Handle mbEmptyPass and empty hash with OOXML hash value, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 26 Commit Notification 2018-02-24 20:04:19 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1bf8006f6344d67dbfe0055da7d7dd5bdfa529d2

Write ScOoxPasswordHash to OOXML if set, tdf#104250 prep

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 27 Commit Notification 2018-02-24 20:04:26 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=95bee23dffe87e36eaa7a58ba8aca8434bf01007

Resolves: tdf#104250 import sheetProtection hash attributes

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 28 Commit Notification 2018-02-26 11:16:12 UTC
Eike Rathke committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=384954795c4f3c0641f4b0eb7cff6f27ebfbb5de

Move convenience abstractions to DocPasswordHelper, tdf#104250 follow-up

It will be available in 6.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.