Apache OpenOffice (AOO) Bugzilla – Issue 76318
Creating a new document from a template removes the signature from all Macros
Last modified: 2017-05-20 10:47:59 UTC
Using Trusted Sources with certificates for Macro Security is difficult with templates. When a new document is created based on a template (.ott) file, all the signatures are removed, including the ones related to the security of the Macro modules (Basic). So when the newly created document (based on the template with signed module) is reopen by the user, he is prompted again to enable/disable macros (while the content of the macro module itself is not modified). How to reproduce: Sign the macro of a new document (Tools > Macros > Digital Signature) and save it as a template e.g BugExample128.ott. Ensure that the settings for Macro security (Tools > Options > OpenOffice.org > Security > Macro Security : Security Level set to Medium and trusted Source > Trusted certificates should contain the certificate used for signing. Start Writer, file Open and selects the template in my case BugExample128.ott: a new document UntitledX will open. And the macro signature is gone! Although this may look compatible with the initial requirements. I think this not the best possible behavior.
Created attachment 44383 [details] Example file with macro signed
Reassigned to MSC.
macro -> reassign to jsk
Hi, not a bug as it works as designed. Maybe an enhancement. Let the iTeam decide. Frank
Does NOT work as designed. Signatures for Document and Macros are separate, and when somebody modifies the document, the macro signature does not break and is not removed. So when using templates with signed macros, the signatures shouldn't disappear.
I have updated the spec to cover this behavior. (see chapter 6.7 Macro Security) http://specs.openoffice.org/appwide/security/Electronic_Signatures_and_Security.sxw FL->JL: Please fix the current behavior accordingly. Thank you..
.
Retargeted to 3.0.
Enhancement->Defect
changed component
jl->mav: Please take over.
mav->jl: Sending to you as discussed.
retargeting
@MAV: Please take over again
Actually this issue looks like an enhancement, that does not mean that the current behavior is correct. The current implementation is just incomplete. The problem is that the current implementation supports only macro signatures in loaded documents, i.e. in documents that have persistence. When a document is created from template, it is a new document without persistence. Allowing a new non-stored document to have a macro signature would be an enhancement, at least from implementation point of view. Setting the target to 3.3 because of not enough resources.
Setting the target to OOo 3.4 since there are no resources to implement it in OOo3.3.
set target to 3.x since not release relevant for 3.4 release.
Reset assigne to the default "issues@openoffice.apache.org".