Bug 159521 - LibreOffice Calc 24.2.0.3 (X86_64) ODS files saved with new experimental password protection feature causes data loss (Windows 7)
Summary: LibreOffice Calc 24.2.0.3 (X86_64) ODS files saved with new experimental pass...
Status: RESOLVED DUPLICATE of bug 159519
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
24.2.0.3 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: Password-Protected
  Show dependency treegraph
 
Reported: 2024-02-02 07:31 UTC by Jimmy
Modified: 2024-02-27 08:52 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
Example spreadsheet to document this bug (6.77 KB, application/vnd.oasis.opendocument.spreadsheet)
2024-02-02 07:35 UTC, Jimmy
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jimmy 2024-02-02 07:31:05 UTC
Description:
In trying to get LibreOffice Calc 24.2.0.3's password protection feature working, I have uncovered and reported two (2) critical bugs:  
https://bugs.documentfoundation.org/show_bug.cgi?id=159519  
and  
https://bugs.documentfoundation.org/show_bug.cgi?id=159512  

In an attempt to work around these critical bugs, I tried enabling what appears to be a new experimental password protection feature, described in:  
https://bugs.documentfoundation.org/show_bug.cgi?id=105844#c47

As specified in that post, I enabled LibreOffice Calc's Experimental Features.  Now, when trying to use LibreOffice Calc to password protect a file, the result is immediate data loss.

STR below.

Steps to Reproduce:
1. Install LibreOffice Calc 24.2.0.3 (X86_64).
2. Enable Experimental Features via {{bc|Tools|Options|LibreOffice|Advanced}}.
3. Restart LibreOffice Calc to allow the Experimental Features to take effect.
4. Create a new spreadsheet by adding a string to cell A1.
5. Save the new spreadsheet with a password.
6. Close LibreOffice Calc.
7. Open LibreOffice Calc.
8. Open the spreadsheet saved in step 5.
9. Notice no password is needed, and the spreadsheet is empty.

Actual Results:
No password is needed, and the spreadsheet is empty.

Expected Results:
Password required.  Spreadsheet contains its data.


Reproducible: Always


User Profile Reset: Yes

Additional Info:
Version: 24.2.0.3 (X86_64) / LibreOffice Community
Build ID: da48488a73ddd66ea24cf16bbc4f7b9c08e9bea1
CPU threads: 4; OS: Windows 6.1 Service Pack 1 Build 7601; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL threaded
Comment 1 Jimmy 2024-02-02 07:35:11 UTC
Created attachment 192339 [details]
Example spreadsheet to document this bug

The attached ODS file documents this bug.  Although the file is supposed to be password protected, the password is not needed to open it.  For reference, the password used to save the file was `criticalbug3`.  The spreadsheet was not empty when saved by LibreOffice Calc 24.2.0.3, but when opened in the same version of LibreOffice Calc, no data is displayed.
Comment 2 Stéphane Guillou (stragu) 2024-02-02 07:55:11 UTC
On Linux, I get a different issue: I am prompted to enter a password, but always tells me it's the wrong password.

Michael, can you please have a look?

Version: 24.2.0.3 (X86_64) / LibreOffice Community
Build ID: da48488a73ddd66ea24cf16bbc4f7b9c08e9bea1
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded
Comment 3 Buovjaga 2024-02-02 10:01:53 UTC
Not reproduced from scratch with experimental features activated.

Version: 24.2.0.3 (X86_64) / LibreOffice Community
Build ID: da48488a73ddd66ea24cf16bbc4f7b9c08e9bea1
CPU threads: 2; OS: Windows 10.0 Build 22621; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded
Comment 4 Jimmy 2024-02-02 10:32:03 UTC
(In reply to Stéphane Guillou (stragu) from comment #2)
> On Linux, I get a different issue: I am prompted to enter a password, but
> always tells me it's the wrong password.
> 
> Michael, can you please have a look?
> 
> Version: 24.2.0.3 (X86_64) / LibreOffice Community
> Build ID: da48488a73ddd66ea24cf16bbc4f7b9c08e9bea1
> CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
> Locale: en-AU (en_AU.UTF-8); UI: en-US
> Calc: threaded

Interesting.  That's the exact same result described in:  
https://bugs.documentfoundation.org/show_bug.cgi?id=159512

But for that bug report, experimental functions were disabled, and the files were saved with 7.6.4.
Comment 5 Michael Stahl (allotropia) 2024-02-02 14:25:00 UTC
the attached file contains an encrypted-package, but it is not encrypted - that's very bad...

so here the framework component believes it's storing an encrypted file, but the package component believes it's storing unencrypted?  quite similar to bug 159519

(In reply to Stéphane Guillou (stragu) from comment #2)
> On Linux, I get a different issue: I am prompted to enter a password, but
> always tells me it's the wrong password.

trying this on master, i get no password prompt and an empty spreadsheet, the file does have text in it which is not imported.

i'm really interested to know how to reproduce this...
Comment 6 Stéphane Guillou (stragu) 2024-02-05 02:01:40 UTC
(In reply to Michael Stahl (allotropia) from comment #5)
> (In reply to Stéphane Guillou (stragu) from comment #2)
> > On Linux, I get a different issue: I am prompted to enter a password, but
> > always tells me it's the wrong password.
> 
> trying this on master, i get no password prompt and an empty spreadsheet,
> the file does have text in it which is not imported.
> 
> i'm really interested to know how to reproduce this...
Sorry, should have been clearer:
- I tested with the STR from comment 0 ("string" in A1, saved with password "test"), with the results above (prompted for password, but not accepted). Have you tried those?
- I just now also tested opening the attachment and see the same as you and Jimmy: no prompt for password, empty spreadsheet.
Comment 7 Michael Stahl (allotropia) 2024-02-05 11:57:47 UTC
(In reply to Stéphane Guillou (stragu) from comment #6)

> - I tested with the STR from comment 0 ("string" in A1, saved with password
> "test"), with the results above (prompted for password, but not accepted).
> Have you tried those?

i had not, but now i have (on Linux, master and 24.2.0.3), can't reproduce it...
Comment 8 Michael Stahl (allotropia) 2024-02-22 11:46:40 UTC

*** This bug has been marked as a duplicate of bug 159519 ***
Comment 9 Stéphane Guillou (stragu) 2024-02-27 08:52:00 UTC
(In reply to Michael Stahl (allotropia) from comment #7)
> (In reply to Stéphane Guillou (stragu) from comment #6)
> 
> > - I tested with the STR from comment 0 ("string" in A1, saved with password
> > "test"), with the results above (prompted for password, but not accepted).
> > Have you tried those?
> 
> i had not, but now i have (on Linux, master and 24.2.0.3), can't reproduce
> it...
Comment 0 steps now work as expected with:

Version: 24.8.0.0.alpha0+ (X86_64) / LibreOffice Community
Build ID: d2fa44db6f8a1badece63856ee0f12db4cba9b28
CPU threads: 8; OS: Linux 6.5; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

Thanks!