Issue 119318 - Accepting secured registered changes
Summary: Accepting secured registered changes
Status: CONFIRMED
Alias: None
Product: Writer
Classification: Application
Component: editing (show other issues)
Version: OOO330m20
Hardware: PC All
: P3 Major (vote)
Target Milestone: ---
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-05-08 06:27 UTC by Pawel
Modified: 2013-02-08 09:42 UTC (History)
5 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description Pawel 2012-05-08 06:27:08 UTC
In Writer, when option "Edit/Changes/Secure registered chenges" is selected, anyone who doesn't have password can accept or reject changes just by clicking right mouse button on it and by selecting Accept or Reject from context menu. This type of accepting isnt registered by the program.
This bug makes "secure registered changes" option completely useless.
Comment 1 Du Jing 2012-05-28 06:18:11 UTC
I can't find the option "Edit/Changes/Secure registered changes",can you provide detailed steps for reproduce the defect?
Comment 2 Pawel 2012-05-28 07:03:15 UTC
(In reply to comment #1)
> I can't find the option "Edit/Changes/Secure registered changes",can you
> provide detailed steps for reproduce the defect?

My mistake.
The option is located in "Edit/Changes/Protect records". I'm using a polish language pack and I translate this option by myself. In English language pack it is named a little bit different. Now I have installed an english pack (GB) and I saw the proper english name.
Comment 3 Terry Yang 2012-06-12 05:58:58 UTC
Find below in the help file, 
Protect Records: Prevents a user from deactivating the record changes feature, or from accepting or rejecting changes unless the user enters a password.

From my understanding, when select  "Protect records" and input password, this document will go to "Protect records" mode, in this mode, users changes will not save automatic until user Accept and reject the changes, or exit this mode by input password again. So this is  not a defect , it is a feature by design.
Comment 4 orcmid 2012-06-12 06:23:45 UTC
I think we're talking about two different features. 

Here is my analysis using Apache OpenOffice 3.4.0:

On File | Properties, the properties dialog has a "Security" tab (bad name, have to fix that) which has a File sharing option called Record changes.  There is provision for setting a Password on that (both, either?) option.

This seems to lock both Edit | Changes | Record Changes and | Protect Record as set. Any attempt to release either of those requires the password set in File | Properties | "Security".

Edit | Changes | Show Changes can be toggled regardless of the Protect Record lock.

However, although I can select Edit | Changes | Accept or Reject ... and I am shown the list of changes, there is no ability to actually choose to accept or reject a change (the buttons are all greyed out and non-functional). 

It *is* possible to accept or reject a change using the context menu on a shown change. (On LO 3.3.2, the context menu does not offer an accept/reject change option in this scenario.)
Comment 5 Pawel 2012-06-12 13:00:32 UTC
(In reply to comment #4)
> I think we're talking about two different features. 
> 
> Here is my analysis using Apache OpenOffice 3.4.0:
> 
> On File | Properties, the properties dialog has a "Security" tab (bad name,
> have to fix that) which has a File sharing option called Record changes. 
> There is provision for setting a Password on that (both, either?) option.
> 
> This seems to lock both Edit | Changes | Record Changes and | Protect Record
> as set. Any attempt to release either of those requires the password set in
> File | Properties | "Security".
> 
> Edit | Changes | Show Changes can be toggled regardless of the Protect
> Record lock.
> 
> However, although I can select Edit | Changes | Accept or Reject ... and I
> am shown the list of changes, there is no ability to actually choose to
> accept or reject a change (the buttons are all greyed out and
> non-functional). 
> 
> It *is* possible to accept or reject a change using the context menu on a
> shown change. (On LO 3.3.2, the context menu does not offer an accept/reject
> change option in this scenario.)

Exactly, "It *is* possible to accept or reject a change using the context menu on a shown change." -whitout password. In my opinion it is a bug. For example:
1. I've made some changes on protected document. Document is from Mr. "X" and only he knows the protect password.
2. I put document on shared folder.
3. Ms. "Y" opens this document and reject all my changes.
4. Mr. "X" opens this document and see there is no changes. He even dont know who and when could made any changes.

This is a bug.
Comment 6 Terry Yang 2012-06-13 01:53:35 UTC
(In reply to comment #5)
> (In reply to comment #4)
> > I think we're talking about two different features. 
> > 
> > Here is my analysis using Apache OpenOffice 3.4.0:
> > 
> > On File | Properties, the properties dialog has a "Security" tab (bad name,
> > have to fix that) which has a File sharing option called Record changes. 
> > There is provision for setting a Password on that (both, either?) option.
> > 
> > This seems to lock both Edit | Changes | Record Changes and | Protect Record
> > as set. Any attempt to release either of those requires the password set in
> > File | Properties | "Security".
> > 
> > Edit | Changes | Show Changes can be toggled regardless of the Protect
> > Record lock.
> > 
> > However, although I can select Edit | Changes | Accept or Reject ... and I
> > am shown the list of changes, there is no ability to actually choose to
> > accept or reject a change (the buttons are all greyed out and
> > non-functional). 
> > 
> > It *is* possible to accept or reject a change using the context menu on a
> > shown change. (On LO 3.3.2, the context menu does not offer an accept/reject
> > change option in this scenario.)
> 
> Exactly, "It *is* possible to accept or reject a change using the context
> menu on a shown change." -whitout password. In my opinion it is a bug. For
> example:
> 1. I've made some changes on protected document. Document is from Mr. "X"
> and only he knows the protect password.
> 2. I put document on shared folder.
> 3. Ms. "Y" opens this document and reject all my changes.
> 4. Mr. "X" opens this document and see there is no changes. He even dont
> know who and when could made any changes.
> 
> This is a bug.

From this scenario, yes this is a bug, if the document is password Protect Record, User should not accept or reject the record untill input password.
Comment 7 Mohammed Kuranga 2012-06-13 03:22:13 UTC
PLATFORM: MAC OSX 10.7.3
OpenOffice 3.3.0
OOO330m20 (Build: 9567)

I tried the earlier reports on the platform & versions specified above. My findings are written below.

As Orcmid said this are two different features (or bug).

File > Properties > Security Tab
 To protect/unprotect Record changes password is required, so This is a feature not a bug

Edit > Chnages
> Show, once new document is created show is ticked (default)
when changes made to the document no difference is noticed.
>record
Now, I went on to tick record and made changes
Noticed that changes were highlighted.
Now untick show and they were not highlighted
Then thick show again and they were highlighted
Up to this point I believe This two features (show & Record) work right.

> protect record
ticked protect record and it immediately prompts password…
made changes and went to accept/Reject
it displays a list of record of changes made (including even before being under protected mode)
The accept/reject buttons are greyed out.
I believe this is a BUG (It shouldn’t be greyed out…this is the only way to accept or reject changes)
Now, I untick record but prompts password
Entered password and it automatically unticks protect records also.
Now I can go and accept/reject changes without being prompted for password. (This part is not a bug because by unticking record you are no longer in protected mode so its right to allow you accept or reject changes without prompting password).
Personally, I think the Bug in this features is the fact that the accept or reject changes buttons are greyed out without even prompting for password.
Comment 8 Cem Kaner 2012-06-19 21:27:28 UTC
I was working with Mohammed Kuranga on this. I have a Windows 7 64-bit system and am running OOo 3.4.0 build 9590.

The program seems to accept and change the status of protect records in a reasonable way (deselecting record also deselects protect record seems ok).

The program blocks accepting or rejecting changes (from the Edit | Changes | Accept or Reject) selection until the user changes the password. As Mohammed notes, when the program is in protected mode and you view changes, it does not provide an option _at_that_dialog to enter a password and accept or reject changes. This is an inconvenience that some people might consider a bug, but it is not a security issue.

But with protect records on, if I simply move the cursor to a recorded change and right-click, the context menu provides an accept or reject change option and I can accept or reject the change. This is inconsistent with the protection provided by the accept/reject dialog and so it appears to be a bug. This replicates the original report and we see it on my system and Mohammed's.
Comment 9 Du Jing 2012-07-17 01:59:54 UTC
still can reproduce the defect on the build AOO_Rev1359641

steps:
1.launch oo and new a text document
2.set the document as protected by "edit->changes->protect records..."
3.input some text,and the text will be highlighted
4.select the text and enable the context menu,the "Accept the change" or "reject change" is enabled.
5.save the document and open it under another account logging in
6.open the document,and select the text to enable context menu,the two buttons "Accept or reject change" are still enabled.
Comment 10 Pawel 2013-02-08 09:42:06 UTC
In version 3.4.1 (AOO341m1(Build:9593) - Rev. 1435053) the bug still exist.