Bug 132637 - Fileopen: DOC with Lock Tracking (Protect changes) does not use password to prevent disabling track changes
Summary: Fileopen: DOC with Lock Tracking (Protect changes) does not use password to p...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: filter:doc
Depends on: 132636
Blocks: DOC-Doc-Protection
  Show dependency treegraph
 
Reported: 2020-05-03 12:54 UTC by Timur
Modified: 2020-11-27 11:13 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
Sample DOC (26.00 KB, application/msword)
2020-05-03 12:56 UTC, Timur
Details
Lock.screenshot.jpg: What word 2016/2013 look like after opening Lock.doc (51.52 KB, image/jpeg)
2020-05-06 10:46 UTC, Justin L
Details
LockC.doc: Word 2003 locked to allow only inserted comments (19.50 KB, application/msword)
2020-05-06 10:47 UTC, Justin L
Details
LockR.doc: Word 2003 locked to be read-only. (19.50 KB, application/msword)
2020-05-06 10:49 UTC, Justin L
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Timur 2020-05-03 12:54:38 UTC Comment hidden (obsolete)
Comment 1 Timur 2020-05-03 12:56:03 UTC
Created attachment 160275 [details]
Sample DOC
Comment 2 Attila Baraksó (NISZ) 2020-05-04 11:46:30 UTC Comment hidden (obsolete)
Comment 3 Timur 2020-05-04 14:42:17 UTC Comment hidden (obsolete)
Comment 4 NISZ LibreOffice Team 2020-05-05 12:06:24 UTC Comment hidden (obsolete)
Comment 5 Justin L 2020-05-05 13:02:35 UTC Comment hidden (obsolete)
Comment 6 Justin L 2020-05-05 18:55:33 UTC Comment hidden (obsolete)
Comment 7 Justin L 2020-05-06 08:01:21 UTC
In Word 2003, Lock.doc opens in read-write mode.
In Word 2013, it opens in read-only mode. You need to View - Edit document to get started (but of course with no password).

So, the question is how far do we want to take this for the DOC format? Currently, when LO round-trips the file, ALL of this information is lost.

Laszlo has implemented most of this for DOCX - import and export. But is it worth doing it for the old DOC format?  Opening up as read-only (like DOCX) seems very stupid to me, so my recommendation would be to just ignore the password completely in this case (since it is lost anyway) and open in read-write mode (just like sensible Word 2003). Otherwise we also need to map it to the correct document security functions, and export it. That seems like unnecessary effort at this stage in the game.

[For completeness, I also looked at the fourth lock option, which allow comments only. I don't think Writer has support for that, so it should be treated the same as a read-only protection - requiring the password to unlock to edit.]

In all cases - including read-only, all of the protection is lost just by round-tripping. So if a password is defeating you, just save-as and reload - no password, no protection (except forms, which protects the section, but without a password).

Proposed fix (which just ignores LockRev/password) at https://gerrit.libreoffice.org/c/core/+/93551
Comment 8 Timur 2020-05-06 10:15:46 UTC
(In reply to Justin L from comment #7)
> In Word 2003, Lock.doc opens in read-write mode.
> In Word 2013, it opens in read-only mode. You need to View - Edit document
> to get started (but of course with no password).

I don't confirm. In Word 2016, it opens in read-write mode. 
Maybe your read-only is because file is from internet, please resave it.

I didn't also understand your explanation. We need Lo to behave as MSO: file is read-write and can be edited, without password, and it keeps Track Changes. Password is needed only to turn off Edit-Track Changes-Protect.
Comment 9 Timur 2020-05-06 10:37:34 UTC
Filesave is another issue, See Also bug 132636.
Comment 10 Justin L 2020-05-06 10:46:28 UTC
Created attachment 160422 [details]
Lock.screenshot.jpg: What word 2016/2013 look like after opening Lock.doc

(In reply to Timur from comment #8)
> Maybe your read-only is because file is from internet, please resave it.

I copied it to the desktop on both 2013 and 2016 and it still opens in read-only mode. 

> I didn't also understand your explanation. We need Lo to behave as MSO:
> file is read-write

Yes

> and can be edited, without password, 

Yes - the password is lost actually.

> and it keeps Track Changes.

Yes - completely unaffected.

>Password is needed only to turn off Edit-Track Changes-Protect.

No. So far LO doesn't keep the password for forms or read-only mode either, and after a round-trip, the document is unprotected in Word.
Comment 11 Justin L 2020-05-06 10:47:59 UTC
Created attachment 160423 [details]
LockC.doc: Word 2003 locked to allow only inserted comments

After round-tripping this in LO, the comment protection is lost.
Comment 12 Justin L 2020-05-06 10:49:39 UTC
Created attachment 160424 [details]
LockR.doc: Word 2003 locked to be read-only.

The read-only protection is lost when round-tripped by LO.
Comment 13 Commit Notification 2020-05-07 04:20:03 UTC
Justin Luth committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/0f7f3ede6699df09be5b0d9d24818cf1fbbaf6f6

tdf#132637 doc import: don't open readonly for lockRev

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Justin L 2020-05-07 04:27:17 UTC
The issue of actually locking track changes depends on the ability to export it. So this issue is not yet resolved, but at least the document can be used in the meantime.

I will not be attempting to do the export or import, so removing myself as the assignee.