Bug Hunting Session
Bug 79413 - FILESAVE removes worksheet protection password
Summary: FILESAVE removes worksheet protection password
Status: RESOLVED INVALID
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: Other All
: medium enhancement
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-05-29 14:13 UTC by wilhelm
Modified: 2015-04-01 14:51 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description wilhelm 2014-05-29 14:13:53 UTC
Hi! 

I want to appoint to a situation can bring problems. Let's say you have a password protected sheet. It is trivial for an user to bypass this protection by simply saving the file as .xls (MS Excel formats in general).

The question is that CALC should exige the user to provide the password for this sheet OR NOT LETTING HIM TO SAVE THE FILE AS EXCEL FORMATS at all (or at least, let the creator of the file the option to exige this) . 

Related to, as a protected sheet is accesible by macros, you should be able to avoid, at a file level, the CREATION OF NEW MACROS for this file, so the 'malicious' user can not read the protected sheet by this way.

Awesome job anyway, I think you are getting to the point of making LO able to susbstitute MSOffice! 

Kind regards.
Comment 1 wilhelm 2014-05-29 14:23:09 UTC
Additionally, I'm thinking it also should be possible to avoid accessing the contains of the proteected sheet by simply linking it FROM OTHER SHEETS...
Comment 2 ign_christian 2014-07-01 13:23:06 UTC
Hi Wilhelm,

We should not mark NEW to our own report. Others will review & confirm that.

As far as I understand, you request an enhancement because of a bug: XLS can't save password protected sheet.

(In reply to comment #0)
> I want to appoint to a situation can bring problems. Let's say you have a
> password protected sheet. It is trivial for an user to bypass this
> protection by simply saving the file as .xls (MS Excel formats in general).
Please attach sample file with that problem. I can't see the problem with LO 4.2.5.2.

> Related to, as a protected sheet is accesible by macros, you should be able
> to avoid, at a file level, the CREATION OF NEW MACROS for this file, so the
> 'malicious' user can not read the protected sheet by this way.
Sorry I'm not familiar with macros. Perhaps you could describe with simple test case how macros could 'hack' protected sheet.

Then please change status to UNCONFIRMED to let others reviewing.
Comment 3 ign_christian 2014-07-01 13:41:13 UTC
> (In reply to comment #0)
> > I want to appoint to a situation can bring problems. Let's say you have a
> > password protected sheet. It is trivial for an user to bypass this
> > protection by simply saving the file as .xls (MS Excel formats in general).
> Please attach sample file with that problem. I can't see the problem with LO
> 4.2.5.2.
Just found some: Bug 71322 and Bug 71281

(In reply to comment #1)
> Additionally, I'm thinking it also should be possible to avoid accessing the
> contains of the proteected sheet by simply linking it FROM OTHER SHEETS...
So please explain more detailed about your idea.
Comment 4 QA Administrators 2015-02-19 04:33:59 UTC
Dear Bug Submitter,

This bug has been in NEEDINFO status with no change for at least 6 months. Please provide the requested information as soon as possible and mark the bug as UNCONFIRMED. Due to regular bug tracker maintenance, if the bug is still in NEEDINFO status with no change in 30 days the QA team will close the bug as INVALID due to lack of needed information.

For more information about our NEEDINFO policy please read the wiki located here: 
https://wiki.documentfoundation.org/QA/FDO/NEEDINFO

If you have already provided the requested information, please mark the bug as UNCONFIRMED so that the QA team knows that the bug is ready to be confirmed.


Thank you for helping us make LibreOffice even better for everyone!


Warm Regards,
QA Team

Message generated on: 2015-02-18
Comment 5 QA Administrators 2015-04-01 14:51:40 UTC
Dear Bug Submitter,

Please read this message in its entirety before proceeding.

Your bug report is being closed as INVALID due to inactivity and
a lack of information which is needed in order to accurately
reproduce and confirm the problem. We encourage you to retest
your bug against the latest release. If the issue is still
present in the latest stable release, we need the following
information (please ignore any that you've already provided):

a) Provide details of your system including your operating
   system and the latest version of LibreOffice that you have
   confirmed the bug to be present

b) Provide easy to reproduce steps – the simpler the better

c) Provide any test case(s) which will help us confirm the problem

d) Provide screenshots of the problem if you think it might help

e) Read all comments and provide any requested information

Once all of this is done, please set the bug back to UNCONFIRMED
and we will attempt to reproduce the issue. Please do not:

a) respond via email 

b) update the version field in the bug or any of the other details
   on the top section of our bug tracker

-- The LibreOffice QA Team This NEEDINFO Message was generated on: 2015-04-01

Warm Regards,
QA Team