Bug 148678 - SECURITY: Connection of a database won't be closed when database has been closed
Summary: SECURITY: Connection of a database won't be closed when database has been closed
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Base (show other bugs)
Version:
(earliest affected)
6.1.5.2 release
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-04-20 06:16 UTC by Robert Großkopf
Modified: 2023-10-16 09:51 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments
Spreadsheet with password "password" (16.45 KB, application/vnd.oasis.opendocument.spreadsheet)
2022-04-22 14:30 UTC, Andreas Säger
Details
Database document connected to password.password.ods in same folder (2.15 KB, application/vnd.oasis.opendocument.database)
2022-04-22 14:31 UTC, Andreas Säger
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Großkopf 2022-04-20 06:16:01 UTC
Open a database which needs user and password, for example MySQL/MariaDB or PostgreSQL.
Open pane tables.
You will be asked for username and password.
Connection has been established.
Now close the Base file, not the whole LO.
Open any other document and reopen the Base file.
Open pane table.
You aren't asked for username and password any more.

The connection to the database will only be closed when whole LO has been closed. Think this is a security problem. There must be a possibility to set "close connection when closing Base file".

This behavior appears in LO 7.3.3.1 and all other versions of LO I have installed, oldest version here is LO 6.1.5.2 on OpenSUSE 15.3 64bit rpm Linux.
Could be it is inherited by OOo.
Comment 1 Andreas Säger 2022-04-22 14:30:26 UTC
Created attachment 179729 [details]
Spreadsheet with password "password"
Comment 2 Andreas Säger 2022-04-22 14:31:23 UTC
Created attachment 179730 [details]
Database document connected to password.password.ods in same folder
Comment 3 Andreas Säger 2022-04-22 14:33:35 UTC
Also reproducible with a connection to a password protected spreadsheet.
Put both attachments in same folder.
Open the odb, click "Tables", enter password "password". Name does not matter. The table "Sheet1" becomes accessible.
Close the odb.
Reopen the odb.
Click "Tables".
"Sheet1" is accessible with no password prompt until you shut down the office.
Comment 4 Adam664 2023-06-29 18:56:38 UTC
Confirming the behavior exits with:

Version: 7.5.3.2 (X86_64)
Build ID: 50(Build:2)
CPU threads: 1; OS: Linux 6.3; UI render: default; VCL: kf5 (cairo+xcb)
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

and 

Version: 7.7.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: 5a2c6f4df7149f8c1f543f120fe19bd66abfc189
CPU threads: 1; OS: Linux 6.3; UI render: default; VCL: kf5 (cairo+xcb)
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded

Not sure if this is the desired behavior or not, maybe someone with more experience can chime in?
Comment 5 Robert Großkopf 2023-06-29 19:55:38 UTC
Depending on commet3 and comment4 I will set this one to NEW.