Bug 147022 - readable previews of last recently used files are shown even if the file disappeared
Summary: readable previews of last recently used files are shown even if the file disa...
Status: RESOLVED NOTABUG
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
6.4.7.2 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-01-27 16:37 UTC by di_wisch
Modified: 2022-01-27 16:56 UTC (History)
0 users

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description di_wisch 2022-01-27 16:37:08 UTC
Description:
As a normal user I want to save documents on a encrypted file system and be sure that after unmounting the filesystem, data is protected. Similar, when I delete a file, I do not want to see its contents anymore (without special tools).
But as I just opened libreoffice, I saw readable previews of LRU documents (in my case: PIN numbers of credit cards^^).


Steps to Reproduce:
1. save file on a stick with secrets
2. close libre office
3. unmount stick
4. open libre office
5. inspect welcome screen

Actual Results:
you will be able to read the secrets

Expected Results:
do not expose file contents of non existing/readable files.


Reproducible: Always


User Profile Reset: No



Additional Info:
I do not know if libreOffice uses tmp files (on systems/users temp folder!?) - if so it shouldnt.
Comment 1 Mike Kaganski 2022-01-27 16:55:46 UTC
LibreOffice uses thumbnails stored in its profile (registrymodifications.xcu), created for documents without passwords. LibreOffice has no way to know if they are on some encrypted/otherwise secured medium (that's transparent to the application). It doesn't know if the file is only temporarily unavailable, and it even shouldn't try to test its availability (for some filesystems, trying to check if file is accessible may result in delays, and would hang LibreOffice for long time). So for LibreOffice, you opened some normal document, it generated its preview normally, and shows it to you the next time.

All in all, if you want to avoid thumbnails, either use password on those files, or disable RecentDocsThumbnail in Options | LibreOffice | Advanced | Expert Configuration.

Regarding temporary files, LibreOffice used temporary directory, and backup directory, configured in Options | LibreOffice | Paths.