Bug 106843 - Protect changes setting can be turned off even if "Lock Tracking" is set in DOCX
Summary: Protect changes setting can be turned off even if "Lock Tracking" is set in DOCX
Status: CLOSED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: medium normal
Assignee: László Németh
URL:
Whiteboard: target:6.4.0 target:7.0.0 target:6.4.3
Keywords: filter:docx
Depends on:
Blocks: Track-Changes DOCX-Track-Changes DOCX-Doc-Protection
  Show dependency treegraph
 
Reported: 2017-03-29 07:00 UTC by Pénzes Dávid
Modified: 2022-09-08 04:58 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:


Attachments
The good result. (15.86 KB, application/vnd.oasis.opendocument.text)
2017-03-29 07:02 UTC, Pénzes Dávid
Details
The bad result. (4.89 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2017-03-29 07:02 UTC, Pénzes Dávid
Details
Test DOCX from MSO with Lock Tracking password "test" (13.61 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-01-07 12:08 UTC, Timur
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Pénzes Dávid 2017-03-29 07:00:55 UTC
Description:
If you save your file docx with Protect Changes, your document lost your Protect password and not protect the changes.

Steps to Reproduce:
1. Open new – blank – page
2. Writing some words eg. lorem ipsum
3. Turn on „Recording Changes”.
4. Turn on Protect Changes and type your password (use Track Change Bar or File – Properties – Security tab – Protect button)
5. Save the document docx
6. Reopen it (LibreOffice).
7. The password and the protection are lost.

Actual Results:  
The password and the protection are lost.

Expected Results:
Keep the password and the protection.


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Comment 1 Pénzes Dávid 2017-03-29 07:02:04 UTC
Created attachment 132243 [details]
The good result.
Comment 2 Pénzes Dávid 2017-03-29 07:02:22 UTC
Created attachment 132244 [details]
The bad result.
Comment 3 Pénzes Dávid 2017-03-29 07:22:04 UTC Comment hidden (obsolete)
Comment 4 Pénzes Dávid 2017-03-29 08:27:07 UTC
I tested it in 5.3.1 and the problem is still present.
Comment 5 Buovjaga 2017-04-01 18:11:45 UTC
Repro.

Arch Linux 64-bit, KDE Plasma 5
Version: 5.4.0.0.alpha0+
Build ID: 541b377a94fb1247dbf4c39b5bcf55deb8e5ef60
CPU threads: 8; OS: Linux 4.10; UI render: default; VCL: kde4; 
Locale: fi-FI (fi_FI.UTF-8); Calc: group
Built on March 31st 2016

Arch Linux 64-bit
Version 3.6.7.2 (Build ID: e183d5b)
Comment 6 Timur 2017-04-04 09:15:26 UTC Comment hidden (obsolete)
Comment 7 Gabor Kelemen (allotropia) 2017-04-04 09:31:14 UTC
(In reply to Timur from comment #6)
> Looks like a duplicate of Bug 66398. 
> If you agree, please marks as Resolved-Duplicate.

No, that's a different feature. In Word that is called "Protect -> Restrict Editing", as seen here:
https://slidehunter.com/wp-content/uploads/Restrict-Editing-option.jpg

This bug is about the Word feature "Track Changes -> Lock Tracking" as seen here:

http://core0.staticworld.net/images/article/2014/12/1-trackchanges-all-markup-100537247-orig.png
Comment 8 QA Administrators 2018-04-27 02:30:48 UTC Comment hidden (obsolete)
Comment 9 Timur 2019-01-07 12:07:14 UTC
My test with LO 6.3+ shows different problem than described or I'll just make it more precise. Please confirm.

If DOCX is edited and saved in LO without turning off Track Changes, "Lock Tracking" remains valid in DOCX as shown in MSO.
But in LO, Track Changes can be turned off and saved, regardless "Lock Tracking". Reopening changed DOCX in MSO shows that.
I'll update the title.

Steps:
In MSO:
1. Open new – blank – page
2. Turn on Review - „Track Changes”.
3. Type some text.
4. Turn on Review - „Track Changes” - "Lock Tracking" and type your password 
5. Save the document DOCX

in LO:
6. Reopen it (LibreOffice).
7a. Type some text keeping Track Changes on and save as DOCX
7b. Turn off Track Changes (which you shouldn't be able) and type some text and save as DOCX

in MSO:
8a. Open DOCX from 7a. and see that „Track Changes” is still on and "Lock Tracking" is still there with the same password - OK
8b. open DOCX from 7b. and see that „Track Changes” is off although "Lock Tracking" seems to be there with the same password - bug
Comment 10 Timur 2019-01-07 12:08:21 UTC
Created attachment 148094 [details]
Test DOCX from MSO with Lock Tracking password "test"
Comment 11 Commit Notification 2019-10-12 07:31:02 UTC
László Németh committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d416250f4f1766e2d596ea3feef6a94b7adf29f4

tdf#106843 DOCX: forbid disabling protected Record Changes

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2019-10-16 10:16:40 UTC
László Németh committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/2756ed9317e3474003c11ffe7d1e2f087c1412bf

tdf#106843 DOCX: export/import change tracking protection

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 László Németh 2019-10-16 10:19:08 UTC
Fix with DOCX import/export of change tracking protection and its
confirmation based protection on UI in the case of DOCX:

tdf#106843 DOCX: export/import change tracking protection

Now change tracking protection from Writer or from ODT files
is exported to DOCX.

In Writer it's always possible to disable change tracking
protection without password in File->Properties->Security page->
Record Changes after confirmation.

Now Writer uses the same confirmation to remove change
tracking protection imported from DOCX, for example clicking
on Record Track Changes. Disabled protection removes the
export of the grab-bagged change tracking protection, too,
to avoid of creating bad DOCX with enabled change tracking
protection and disabled Record change tracking.

See also commit d416250f4f1766e2d596ea3feef6a94b7adf29f4
"tdf#106843 DOCX: forbid disabling protected Record Changes"

First commit: 

tdf#106843 DOCX: forbid disabling protected Record Changes

Password protection of enabled record changes has been grab-
bagged, yet, but it was possible to disable the protection
without password verification, eg. by a simple click on
Record Track Changes. Now it's forbidden to disable the
protected Record Changes, using a dummy password temporarily.
Comment 14 NISZ LibreOffice Team 2019-11-07 15:47:45 UTC
(In reply to László Németh from comment #13)
> 
> In Writer it's always possible to disable change tracking
> protection without password in File->Properties->Security page->
> Record Changes after confirmation.

For the record: that was fixed in bug #128230
Now even if I know the password of the locking, it is rejected and I'm unable to unlock it.

Proper support of password encryption/decryption is still needed here (maybe in  a followup bug).
Comment 15 Timur 2019-12-09 11:30:32 UTC
Verified that 8b. from Comment 9 is resolved. 
But I don't see that "it's forbidden to disable the protected Record Changes" from Comment 13 "by a simple click on Record Track Changes" (noticed in 7b. in Comment 9)
So I set Reopen.

I understand per Comment 14 and bug 128744 that password encryption/decryption is another issue, but mentioned dummy password doesn't work.

PS Thanks for additional explanation of commits, I noticed you're doing it and it's quite nice, especially with complex bug that require further work.
Comment 16 NISZ LibreOffice Team 2019-12-19 08:42:38 UTC
(In reply to Timur from comment #15)
> Verified that 8b. from Comment 9 is resolved. 
> But I don't see that "it's forbidden to disable the protected Record
> Changes" from Comment 13 "by a simple click on Record Track Changes"
> (noticed in 7b. in Comment 9)
> So I set Reopen.
> 

Hi Timur

Thanks for retesting this.
What I see: 

"7b. Turn off Track Changes (which you shouldn't be able) and type some text and save as DOCX"

Testing with your attachment #148094 [details] now the Edit - Track Changes - Record command pops up a confirmation window asking whether you really want to turn off change tracking. Before even this didn't happen, and this is indeed just a temporary measure.

Of course this is not the same as asking for the real password, we are not there yet - that's the topic of the followup bug.

I don't think this is worth a reopening. The followup bug tracks correctly what's left of this issue.
Comment 17 Commit Notification 2020-03-25 08:19:05 UTC
Justin Luth committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/b2471b8ab62abaa7f0c2c8342b4fa61c18f013c6

tdf#106843 docxexport: don't write double docProtect

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 18 Commit Notification 2020-03-25 16:54:54 UTC
Justin Luth committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/21f2b8cfd9ec01f58b468c4c9a4d4d1f721d8bee

tdf#106843 docxexport: don't write double docProtect

It will be available in 6.4.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 Commit Notification 2020-03-31 07:40:15 UTC
Justin Luth committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/41dbdc1499f4512941a38e5972d03d26a2397a89

related tdf#106843 docxexport: if not enforced, let Writer protect

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 20 Justin L 2020-04-11 06:48:26 UTC
based on comment 16's limited scope and follow-up bug 128744, I can verify the fix - where an "are you sure" dialog is popped up for the normal route of edit->track-changes->UNrecord, as well as the inability to disabled the password protected track change protection in File->Properties->Security->Record Changes.
Comment 21 shara hall 2022-09-08 02:06:38 UTC Comment hidden (spam)