Bug 123912 - DOCX Text in protected form created in Writer is editable in Word
Summary: DOCX Text in protected form created in Writer is editable in Word
Status: RESOLVED NOTABUG
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
6.2.0.3 release
Hardware: All All
: medium normal
Assignee: Justin L
URL:
Whiteboard: target:6.3.0
Keywords: bibisected, bisected, filter:docx, regression
Depends on:
Blocks: DOCX-ActiveX-Legacy DOCX-Doc-Protection
  Show dependency treegraph
 
Reported: 2019-03-07 01:15 UTC by Aron Budea
Modified: 2019-05-25 06:40 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments
Sample DOCX (15.91 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-03-07 01:15 UTC, Aron Budea
Details
sectProt_notSection0-enforced.docx: forms protection enabled, but first part is not protected. (12.66 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-04-13 13:34 UTC, Justin L
Details
sectProt_section0-enforced.docx: forms protection enabled, first section protected. (12.72 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-04-13 13:38 UTC, Justin L
Details
sectProt_section0-notEnforced.docx: forms protection NOT enabled (12.71 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2019-04-13 13:48 UTC, Justin L
Details
sectProt.odt: useful for testing how implicit sections round-trip (12.52 KB, application/vnd.oasis.opendocument.text)
2019-04-13 13:51 UTC, Justin L
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Aron Budea 2019-03-07 01:15:44 UTC
Created attachment 149778 [details]
Sample DOCX

The attached DOCX, created in Word, contains a single drop-down form field, and has been restricted so only forms can be filled.

Save it in Writer and open in Word again, then switch to edit mode.

=> Drop-down isn't editable (the selected value can't be changed).
After removing and readding restriction, the drop-down is editable again.

Observed using LO 6.2.0.3 / Windows 7.
No issue when saved in 6.1.0.3.
=> regression

Bibisected to the following commit using repo bibisect-win32-6.2. I'm a bit confused after reading the commit description, this document does not seem to contain sections (or editable regions). When editing is restricted to filling in forms, nothing, apart the different form fields can be edited. Adding Cc: to Justin Luth, please take a look.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=fa667b6dc410f3af57ef436cc117352c829f95e7
author		Justin Luth <justin.luth@collabora.com>		2018-10-18 09:38:47 +0300
committer	Justin Luth <justin_luth@sil.org>	2018-10-20 06:32:29 +0200

sw mso export: PROTECT_FORM shouldn't force section to protected
Comment 1 Aron Budea 2019-03-07 01:40:25 UTC
Another commit I noticed is the following, which causes this document to be opened with a single section, as mentioned before I'm not sure this is necessary for restricted documents where only filling in forms is enabled.

I would consider the following part of the commit message debatable:
"So, if global enforcement is enabled, map the section protection to LO native protection. On startup, the sections will all be protected because of the global compatibility flag. If the flag is turned off, then you enter a similar mode to Word's "Edit document" where the sections are still protected. In LO, *each* section's protection must be turned off individually to fully disable enforcement."

Based on my (not overly extensive) experience, Edit document does not alter restriction at all, just turns the default read-only mode (for restricted docs) into edit mode. I actually find the step inconvenient, wouldn't most of the document be read-only, anyway, due to the protection? It feels unnecessary, and I'm not sure LO needs it at all, are there compelling arguments for it?

The way Protect form switch used to work is that it turned restrict editing setting on (to restrict to filling inn forms) and off. It's indeed limited compared to Word, which gives you more options, including making the document read-only, with potentially specifying editable regions (which I assume would turn into protected sections and unprotected areas in LO). I think something like extending Protect form to a multiple choice setting could better accomodate what is available in Word (and then have the option to (un)protect individual or all sections). What is your opinion on this?

https://cgit.freedesktop.org/libreoffice/core/commit/?id=3955e5efc225b184b9507db94c226c031a602168
author		Justin Luth <justin.luth@collabora.com>	2018-10-18 11:44:11 +0300
committer	Justin Luth <justin_luth@sil.org>	2018-10-31 05:00:21 +0100

writerfilter: implement formprot
Comment 2 Aron Budea 2019-03-29 00:35:51 UTC
Another symptom after the commit in the description, and before the commit in comment 1 (which affects behavior):

Start an empty document, enter some text, enable 'Form protection' in Tools -> Options..., LibreOffice Writer -> Compatibility, save it as DOCX, and open the file in Word.

=> When switching to edit mode in Word, the text is editable. It should be read-only, since only form filling should be enabled, and the document contains no form fields.

Note that in Writer the text still appears to be read-only, the bug can only be seen in Word.
Comment 3 Justin L 2019-03-30 05:46:54 UTC
(In reply to Aron Budea from comment #0)
> Save it in Writer and open in Word again, then switch to edit mode.
I must be doing something wrong because I can "reproduce" this directly from the unaltered docprot.docx using Office 2013, 2010 and 2003.
1.) Open the original attachment and toggle the value in the dropdown.
2.) Review tab - Restrict Editing - Stop Protection. see that the dropdown is now missing.  Double-clicking on the field brings up a "Drop-Down form field options dialog, so it appears to be in developer/design mode.

Everything seems identical to me when doing this on round-tripped files by 6.1.5, 6.2.2, and master.  I can toggle the value initially, and when switching into unprotected mode, the document is in form design mode.  (Note, 2013 is the first version that initially opens into a read-only mode where you have to start with View-Edit Document.)

Tested using Windows 7 for Office, and Linux for LibreOffice round-tripping.
Comment 4 Justin L 2019-03-30 14:09:42 UTC
(In reply to Aron Budea from comment #2)
> Start an empty document, enter some text, enable 'Form protection' in Tools
> -> Options..., LibreOffice Writer -> Compatibility, save it as DOCX, and
> open the file in Word - the file is editable.
>
> Note that in Writer the text still appears to be read-only, the bug can only
> be seen in Word.
In LO 6.3, the text is editable, similarly to Word due to Serge's 2018-12-20 15:16:34 +0100 commit 0898595532d1e3f498c259b6dfee462249b00667.

Probably the only time this regression will be seen is when authoring a document in Writer, when there is no section and form protection is enabled.
Proposed fix at https://gerrit.libreoffice.org/69957
Comment 5 Aron Budea 2019-03-30 16:37:39 UTC
(In reply to Justin L from comment #3)
> (In reply to Aron Budea from comment #0)
> > Save it in Writer and open in Word again, then switch to edit mode.
> I must be doing something wrong because I can "reproduce" this directly from
> the unaltered docprot.docx using Office 2013, 2010 and 2003.
> 1.) Open the original attachment and toggle the value in the dropdown.
Indeed, the issue has been fixed by bug 122456's fix, I missed that. To be clear, the repro was just that the document simply saved in Writer, and opened in Word, the selected value wasn't changeable (with the addition that in latter Word versions, 2013 as you mention, first you had to switch to edit mode, because protected documents open in read-only mode).

The fixing commit is bug 122456's:
https://git.libreoffice.org/core/+/f18300642c3e962d7c0c6d13daad1676b877b30b%5E%21

Let's repurpose this bug report for the issue mentioned in comment 2.

(In reply to Justin L from comment #4)
> (In reply to Aron Budea from comment #2)
> > Start an empty document, enter some text, enable 'Form protection' in Tools
> > -> Options..., LibreOffice Writer -> Compatibility, save it as DOCX, and
> > open the file in Word - the file is editable.
> >
> > Note that in Writer the text still appears to be read-only, the bug can only
> > be seen in Word.
> In LO 6.3, the text is editable, similarly to Word due to Serge's 2018-12-20
> 15:16:34 +0100 commit 0898595532d1e3f498c259b6dfee462249b00667.
> 
> Probably the only time this regression will be seen is when authoring a
> document in Writer, when there is no section and form protection is enabled.
> Proposed fix at https://gerrit.libreoffice.org/69957
Thanks for the proposed fix! Perhaps Serge's commit is the reason why switching on Protect form isn't effective immediately, I'll have to check that (originally I meant to check after a reload). With the patch it works as expected in Word.

Please note that not adding sections is the normal way with form protection, at least in Word you just throw up form fields along with accompanying text, switch on restriction to only permit editing forms, and there you go. This is the reason why I find it strange that sections pop up in such documents after the commit mentioned in comment 1.
Comment 6 Commit Notification 2019-03-30 18:29:43 UTC
Justin Luth committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/d9a6eab15a747cf4c8a3d04f4b21fe1a1c3d0721%5E%21

tdf#123912 ww8 export: re-protect implicit section

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Aron Budea 2019-03-30 23:53:03 UTC
(In reply to Aron Budea from comment #5)
> Thanks for the proposed fix! Perhaps Serge's commit is the reason why
> switching on Protect form isn't effective immediately, I'll have to check
> that (originally I meant to check after a reload). With the patch it works
> as expected in Word.
Opened bug 124451 on the mentioned case, indeed it's a regression since that commit.
Comment 8 Justin L 2019-04-02 15:40:25 UTC
(In reply to Aron Budea from comment #1)
Previously it was just all or nothing protection.  If we want to support Word documents with partial protection where some sections are protected and others are not, then the ALL protection (Protect Forms) needs to be turned off so that LO native selective protection can be used. I don't think there are any other options.

(In reply to Aron Budea from comment #5)
> Please note that not adding sections is the normal way with form protection,
> at least in Word you just throw up form fields along with accompanying text,
> switch on restriction to only permit editing forms, and there you go. This
> is the reason why I find it strange that sections pop up in such documents
> after the commit mentioned in comment 1.
Well, sections are very different in Word, so direct comparisons aren't really possible. I forced a section creation because without a section things didn't protect properly, but with the other fixes from Serge, this might work now.  It should be easy to do with just SectionPropertyMap::ApplyProtectionProperties
-  if ( !xSection.is() )
-      xSection = rDM_Impl.appendTextSectionAfter( m_xStartingRange );

But lets wait with trying that until Protect Forms actually works again (bug 124451)
Comment 9 Justin L 2019-04-13 13:34:54 UTC
Created attachment 150731 [details]
sectProt_notSection0-enforced.docx: forms protection enabled, but first part is not protected.

I designed a series of test documents. This one round-trips multiple times just fine.  Testing with Word 2010.
Comment 10 Justin L 2019-04-13 13:38:43 UTC
Created attachment 150732 [details]
sectProt_section0-enforced.docx: forms protection enabled, first section protected.

This one also round-trips multiple times just fine.
Comment 11 Justin L 2019-04-13 13:48:07 UTC
Created attachment 150733 [details]
sectProt_section0-notEnforced.docx: forms protection NOT enabled

Round-tripping loses all information about which sections Word had marked as protected.  That makes sense because Word has a "kill switch" which turns off all protection. LO previously had the opposite "force complete protection" compatibility switch "Protect Forms".  So, on import we have to mark every section as not-protected when "Protect Forms" is off. Either the section protection setting will need to be grabbag'd for round-tripping, or else "Protect Forms" will need to be changed into a kill switch.

So, this isn't actually terrible. Rarely would someone pass around a section-protected document with protection disabled.  And if they do want to protect it again, they just need to tick which sections are protected again.
Comment 12 Justin L 2019-04-13 13:51:17 UTC
Created attachment 150734 [details]
sectProt.odt: useful for testing how implicit sections round-trip

likely the commit in comment 6 should be reverted. People will just need to learn not use "Protect Form" as a shortcut for making form documents in LO.
Comment 13 Aron Budea 2019-04-17 04:03:44 UTC
(In reply to Justin L from comment #8)
> (In reply to Aron Budea from comment #1)
> Previously it was just all or nothing protection.  If we want to support
> Word documents with partial protection where some sections are protected and
> others are not, then the ALL protection (Protect Forms) needs to be turned
> off so that LO native selective protection can be used. I don't think there
> are any other options.

I see now how this works in Word, thanks for the clarification! Before, I haven't seen that protection can be set per section (I haven't been dealing with such documents), and confused it with the read-only restriction setting's editable regions.

I think in Writer we're missing a single convenient place where protection could be set. Something similar to Word's Restrict Editing sidebar would be straightforward (only the part related to filling in forms). It'd make sense if the user didn't have to change the individual sections' protection settings, but could do it with a checklist similar to Word (and the same with the password).

What I found convenient in the current Protect Form setting is that as I understand it's supposed to take care of the most common protection setting. In the end I'd expect to have a similar functionality where you switch to form protection, and turn it on. Personally I'd prefer to keep it for the time being as an all/none form protection setting, but when it comes to discussing the topic further, I'd rather think about how to enhance the functionality to take it closer to Word's.
Comment 14 Commit Notification 2019-05-25 05:37:27 UTC
Justin Luth committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/+/d57735bad093d028d69d131672c71308acf02f74%5E%21

revert tdf#123912 ww8 export: re-protect implicit section

It will be available in 6.3.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Justin L 2019-05-25 06:40:51 UTC
(In reply to Justin L from comment #12)
> likely the commit in comment 6 should be reverted.

Reverted comment 6 bugfix because LO has changed the behaviour of implicit sections when Protect Forms is enabled. Now they are editable, making the Protect Form compatibility option nearly useless. (bug 122201 commit d9a6eab15a747cf4c8a3d04f4b21fe1a1c3d0721 which was backported to LO 6.2).

Since implicit sections are now editable in LO, they should export as editable. See bug 124451 for a one-sided discussion about this.