Bug 56173 - FILESAVE impossible for password protected shared .ods
Summary: FILESAVE impossible for password protected shared .ods
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
3.4.1 RC1
Hardware: All All
: medium major
Assignee: Markus Mohrhard
URL:
Whiteboard: target:6.0.0 target:5.3.5 target:5.4.0.2
Keywords: bibisectRequest, regression, security
Depends on:
Blocks:
 
Reported: 2012-10-19 10:41 UTC by Bartosz Bartczak
Modified: 2017-07-03 19:09 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
password is: test (11.49 KB, application/vnd.oasis.opendocument.spreadsheet)
2015-12-10 12:49 UTC, Oliver Brinzing
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Bartosz Bartczak 2012-10-19 10:41:16 UTC
x86-64bit Linux version: 3.6.2.2 (Build ID: 3.6.2.2 ArchLinux build-2)
x86-32bit windows version 3.6.2.2 (Build ID: da8c1e6)

Can't save changed shared document with other users with pasword.

1. Open calc
2. save as-> save with password.
3. Tools->shared document-> share document with other users
4. save
5. open file
6. try change anythink and save. Can't save changed file.

recurrence:
Always
Comment 1 Rainer Bielefeld Retired 2012-10-19 10:53:07 UTC
Reproducible] with "LibreOffice 3.6.3.1” German UI/ German Locale [Build-ID: f8fce0b] on German WIN7 Home Premium (64bit), detailed research results following soon!
Comment 2 Rainer Bielefeld Retired 2012-10-19 13:59:39 UTC
Steps how to reproduce with parallel installation of Master "LOdev  3.7.0.0.alpha0+   -  ENGLISH UI / German Locale  [Build ID: 747ecb]"  {tinderbox: @16, pull time 2012-10-08 09:46:32} on German WIN7 Home Premium (64bit) with separate User Profile for Master Branch:

11. open a new Spreadsheet document from LibO start center
12. Type an x ax contents to cell A1
13. Menu 'File → Save As – Save with Password → “sample.ods as file name  <Save>
14. PW “X” (also for confirmation) <ok>
15. Menu 'Tools → Share Document → Check “Share this document”
16. Answer “The spreadsheet must be saved ...” with <Yes>
17. Menu 'File → Close
     > Closes Document, Start center Appears
18. Menu 'File → Recent Documents → “sample.ods”
    > opens document after password input with “... document is in shared mode …
19. Type a “y”  to cell A2  <Enter>
20. Menu 'File → Close'
    Expected: Question “Document has been modified, should I save”, then save 
              “sample.ods”  
    Actual: some strange short flickering on screen, same when yuo click 
            <save> icon

Unfortunately it's impossible to "unshare" the document, but you can save it with new name, what works fine, and then also unshare works again.

Because of this easy workaround and because I do not believe that many users share password protected documents I think this one is less than critical.

Already [Reproducible] with Server installation (own profile) of "LibreOffice  3.5.6.2  German UI/Locale [Build-ID: e0fbe70-5879838-a0745b0-0cd1158-638b327] on German WIN7 Home Premium (64bit)

Already reproducible with 3.4.1.1 RC, seems the bug appeared with 3.4?

Still worked fine with Server Installation of "LibreOffice 3.3.3  German UI/Locale [OOO330m19 (Build:301) tag libreoffice-3.3.3.1] on German WIN7 Home Premium (64bit) 

@Bartosz Bartczak:
If you find evidence that this might affect many users (I doubt for this old bug) please feel free to add this one to the MAB bracking bug 44446 following hints on <http://wiki.documentfoundation.org/Most_Annoying_Bugs>
Comment 3 Rainer Bielefeld Retired 2012-10-19 14:01:22 UTC
@Spreadsheet Team
Please set Status to ASSIGNED and add yourself to "Assigned To" if you accept this Bug or forward the Bug if it's not your turf (and remove others in team from CC).
Comment 4 Bartosz Bartczak 2012-10-22 07:39:58 UTC
The existence of error 56173 it entails further errors.

BUG nr 2:
1. Open calc
2. save as-> save with password.
3. Tools->shared document-> share document with other users
4. save
5. open file
6. file->save as -> save without password
7. Can't save without password !!!

Bug nr 3:
1. Open calc
2. save as-> save with password.
3. Tools->shared document-> share document with other users
4. save
5. open file
6. Tools->shared document-> untag share document with other users
7. can't save file

I admire the work of LibreOffice developers, but I'm surprised they do not understand how important the function deprive the program.
Disabling shared file storage for unencrypted file weaken security.
Encrypt the data in two pososoby user-level and second at the file level.
Let's say the drive if the computer falls into the hands of unauthorized access to the data and remains open because the file is unencrypted!
That's why for 10 years we use file encryption critically important shared. Only trusted users have access to the file and no one else!
The file must be shared because several people róznocześnie working on a file at the same time we want to have 100% security in case of theft file.

Password file is shared by our high security critical data!
We can not afford to keep unencrypted files of LibreOffice developers pleases us.
We will look for other software sieli not wanting to lose the flexibility it gave us the current StarOffice, OpenOffice, LibreOffice. I see end off good software.
Best Regards.
Comment 5 Markus Mohrhard 2012-10-22 16:09:50 UTC
Most likely related to our latest the m106 merge from OOo before 3-4 branch off. Looks like we may have another place were we still use SID_PASSWORD instead of the new SID_ENCRYTPTIONDATA.

I once spend some time cleaning the most obvious problems but without test cases it is nearly impossible to know what needs to be a SID_PASSWORD and which one needs to be a SID_ENCRYPTIONDATA. Sadly the OOo developer creating this half fnished transformation no longer works on OpenOffice or Libreoffice.
Comment 6 Markus Mohrhard 2012-10-22 16:11:51 UTC
Not to forget a pointer to the location that is most likely related to this.

http://opengrok.libreoffice.org/xref/core/sc/source/ui/docshell/docsh.cxx#824

There are some other places in this class that need to be checked. However as mentioned without good test cases this is a risky change.
Comment 7 Markus Mohrhard 2012-10-26 19:10:31 UTC
(In reply to comment #6)
> Not to forget a pointer to the location that is most likely related to this.
> 
> http://opengrok.libreoffice.org/xref/core/sc/source/ui/docshell/docsh.cxx#824
> 
> There are some other places in this class that need to be checked. However
> as mentioned without good test cases this is a risky change.

Actually after fixing the password bug in master I can not reproduce any of these problems.

@Rainer: Can you test with a master build that contains my fix from yesterday? Maybe I'm doing something totally wrong but for me every of these instructions work as they should.
Comment 8 Markus Mohrhard 2012-11-08 15:32:58 UTC
I need some more information here!
Comment 9 Markus Mohrhard 2012-11-26 11:44:11 UTC
After one month without providing the necessary information I'm closing this bug. Please reopen if it still happens and the information are provided.
Comment 10 gallz 2013-01-19 14:44:14 UTC
"Password file is shared by our high security critical data!"

I can't change version 3.3.4.
When will it bug fix?

Best Regards.
Comment 11 Markus Mohrhard 2013-01-19 14:52:51 UTC
Provide a test document before you reopen! This bug can't be fixed without a test document.

And please don't mess around with the importance of bugs.
Comment 12 Rainer Bielefeld Retired 2013-01-19 17:11:59 UTC
(In reply to comment #7)
@Markus:
Sorry, I'm a little late here. I will do a new test next week hopeful to be able to confirm the WFM.
Comment 13 gallz 2013-10-17 14:32:07 UTC
(In reply to comment #12)
> (In reply to comment #7)
> @Markus:
> Sorry, I'm a little late here. I will do a new test next week hopeful to be
> able to confirm the WFM.

Hi,

Succeeded the test?
Comment 14 retired 2013-10-17 19:01:16 UTC
Rainer left the QA team. So I think there won't be a test. You can always test a new release yourself if you want.
Comment 15 gallz 2014-11-12 10:56:36 UTC
(In reply to Markus Mohrhard from comment #11)
> Provide a test document before you reopen! This bug can't be fixed without a
> test document.
> 
> And please don't mess around with the importance of bugs.

Hi, 
Very important this bug fix me!
How to can i test?
Comment 16 gallz 2015-08-18 09:41:47 UTC
I try version 5.0.0.5 (x64) on Hungarian Windows 7, but impossible save password protected shared .ods yet.
This bug is resolved worksforme since 3 years. 

How can i help to test?
Comment 17 Oliver Brinzing 2015-12-10 12:49:50 UTC
Created attachment 121200 [details]
password is: test
Comment 18 Oliver Brinzing 2015-12-10 12:51:45 UTC
i can confirm the problem with Lo 5.0.41 Win7 64bit:
saving is not possible if a shared document is password protected

adding a sample document
Comment 19 Jean-Baptiste Faure 2016-04-12 12:16:54 UTC
According to https://wiki.documentfoundation.org/images/0/06/Prioritizing_Bugs_Flowchart.jpg
set importance to critical.

Reproducible with current master on Ubuntu 15.10 x86-64

Best regards. JBF
Comment 20 Jean-Baptiste Faure 2016-04-12 12:19:28 UTC
Oops, sorry, not all files impacted. Set back to major
Comment 21 mahfiaz 2016-04-17 18:20:06 UTC
I downloaded the Oliver's test document. Did some changes. Saved it. Used Save As. No errors. Looks like it works for me in 5.1.2.1 (Ubuntu 64-bit).

Is it really solved or did I go somewhere wrong?
Comment 22 Oliver Brinzing 2016-04-17 19:26:21 UTC
i just tried with lo 5.1.2.2 32bit (Win 10/64bit): i cannot save the test document
Comment 23 Aron Budea 2016-09-11 03:14:24 UTC
I can't save the file either, with v5.2.1.2 / Windows 7. Same thing happens in Ubuntu 16.04.

If I click save there's no error message, but nothing happens, and upon closing the "Save document?" dialog appears, and clicking Save returns to the (still unsaved) document.

Saving via Save as can be used as a workaround.
Comment 24 Xisco Faulí 2016-09-20 16:10:37 UTC
Adding keyword 'bibisectRequest' to see whether this regression is already present in the oldest build of bibisect-43all repository or not.
In case it's already present, change 'bibisectRequest' to 'preBibisect'.
Otherwise, change 'bibisectRequest' to 'bibisected' and add a comment with the output from 'git bisect log'
Comment 25 Commit Notification 2017-06-28 02:32:11 UTC
Markus Mohrhard committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=669c12d59b6131f44945f166c77ae98df52ebb9e

handle SID_ENCRYPTIONDATA for shared password protected docs, tdf#56173

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 26 Commit Notification 2017-07-03 19:09:32 UTC
Markus Mohrhard committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=20ca5b5fae58ee46362fbd4c5f51ee21e89c3c35&h=libreoffice-5-3

handle SID_ENCRYPTIONDATA for shared password protected docs, tdf#56173

It will be available in 5.3.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 27 Commit Notification 2017-07-03 19:09:45 UTC
Markus Mohrhard committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=967fd3e7a6e37495be17c2dfa62e05944cfa6af8&h=libreoffice-5-4

handle SID_ENCRYPTIONDATA for shared password protected docs, tdf#56173

It will be available in 5.4.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.