Apache OpenOffice (AOO) Bugzilla – Issue 60305
Calc forgets sheet password when loading/saving Excel file with password-protected sheet(s)
Last modified: 2013-08-07 15:12:27 UTC
1. Create the Excel file and protect sheet with password. 2. Save and close the file. 3. Open the file with Calc. 4. Go to menu Tool-> Protect Document. 5. I can uncheck sheet and document without password. Why Calc doesn't ask password? If you select Tool-> Protect Document-> Sheet and type password. Open the file by Excel and cancel protect document, Excel doesn't ask password too.
confirmed on Windows XP Pro SP2 with OOo 2.0.1
Hi Daniel, as discussed on the phone, proceed as needed. Frank
cannot be solved now -> later
*** Issue 72862 has been marked as a duplicate of this issue. ***
Just FYI, I'm working on something similar at the moment, and I *may* touch this issue too while I'm at it.
To fix this issue, you would have to add the 16-bit hash into the Calc model, including API access and ODF roundtrip, this is the only way to not ask the password for every sheet on import time.
Thanks for the advice, Daniel. That'll give me an initial pointer to follow up on.
I'm taking over.
accepting the issue.
work in on-going in scsheetprotection01 CWS. http://eis.services.openoffice.org/EIS2/cws.ShowCWS?Path=SRC680%2Fscsheetprotection01
Issue 72862 was previously marked as a duplicate of this issue. However, as far as I understand it, Issue 72862 describes the opposite situation, namely saving a Calc document with a password-protected sheet as .xls and losing the password protection. If these are duplicate issues, then please remember to handle both situations. Thank you.
@robbk: yes, that _is_ really a duplicate since this issue handles both import and export scenarios.
setting MS interop keyword.
Changing the title to something more appropriate.
*** Issue 89087 has been marked as a duplicate of this issue. ***
Hi. This is quite similar to Issue 39527, except that one deals with the entire suite. Could we dup one of them just for cleaning? BTW, the OS and version could be broadened. I saw this in Win2k w/ OOo 2.4. Cross-posting in Issue 39527 on purpose. Thanks,
As I've explained in Issue 39527, this is not a duplicate of Issue 39527. Looks similar in appearance, but is a whole different beast under the skin.
*** Issue 89799 has been marked as a duplicate of this issue. ***
The core work is done. I'm currently working with the ODF TC to handle the necessary change in the ODF file format.
Kohei, I am testing scsheetprotection02 CWS (actually ooo-build's patches) and have found a "Vista only" bug. On Vista you cannot save new files (works fine with old files) because of crash. After some digging I think I found the problematic file. Seems like rFilter.EqualsAscii("MS Excel 97") in sfx2/source/dialog/filedlghelper.cxx:FileDialogHelper_Impl::execute is the crasher. Let me know if you need additional information.
@rail: If you are capable of debugging on Vista, can you check the value of the _pFilter there? My guess is that value is NULL. That's the only possible explanation for a crash in that code block. So, as a temporary solution, change the if statement there from if (_pFilter->GetFilterName().EqualsAscii("MS Excel 97")) to if (_pFilter && _pFilter->GetFilterName().EqualsAscii("MS Excel 97")) and see if the crash goes away. Let me know what happens. Thanks!
Kohei, you are right, after adding "_pFilter &&" it worked. FYI, this bug can be reproduced only with Vista's native file picker, OOo's file picker works fine. Thanks for prompt reply!
Kohei, Another crasher for you. :) The attached XLS file crashes in XclImpDocProtectBuffer::ReadDocProtect.
Created attachment 56632 [details] crasher
@kohei: 1) is it possible to make it work in all BIFF versions? 2) will there be API to be able to implement it in oox?
@rail: Nice QA'ing action going on here. :-) > The attached XLS file crashes in XclImpDocProtectBuffer::ReadDocProtect. I actually just fixed that one yesterday. See this for more details: https://bugzilla.novell.com/show_bug.cgi?id=427434 The fix is also in the upstream CWS (scsheetprotection02). > 1) is it possible to make it work in all BIFF versions? Yes and no. I believe this feature doesn't exist in BIFF 5, so that means no for BIFF 5 (Excel 95). BIFF 11 OTOH should have that feature, but the filter code for that is in oox, not in sc. So it'll take a little bit of effort to support it there. But dr said he will keep the two filter codes in sync, so I suppose it will be supported eventually, once it is integrated. > 2) will there be API to be able to implement it in oox? Once the feature is integrated, or close to integration, I'm sure dr will poke me to implement the API (since it's his area). So, "yes" eventually, but "no" in the short term. The discussion wrt the ODF file format change is still on-going on the ODF TC, so the integration will have to wait longer, unfortunately.
If you are interested, here is the ODF proposal I've made to the TC: http://wiki.oasis-open.org/office/Spreadsheet_Table_Protection_Options We're basically waiting on the official URI for the Excel legacy hash algorithm to be decided. (Well there is more to it than just that, but that's the gist of it.)
@kohei: > But dr said he will keep the two filter codes in sync, so I > suppose it will be supported eventually, once it is integrated. Please note that it was actually me who asked these questions. ;-) > Yes and no. I believe this feature doesn't exist in BIFF 5, so that means no > for BIFF 5 (Excel 95) Sheet passwords are supported in all BIFF versions, starting with BIFF2. In single-sheet formats (BIFF2/BIFF3/BIFF4) the PASSWORD record contains the sheet password that can be considered the document password at the same time. In multi-sheet a.k.a. workbook formats (BIFF4W/BIFF5/BIFF8/BIFF12/OOXML), there is a PASSWORD in the workbook globals data (document password) and one in each sheet substream (sheet password). The 16-bit password hash algorithm is the same in all BIFF/OOXML versions.
@dr: > Please note that it was actually me who asked these questions. ;-) Ah, you two look so much alike that I couldn't tell. ;-) >Sheet passwords are supported in all BIFF versions, starting with BIFF2. Ah, well then it's possible for the sheet password. I was thinking of sheet protection options. That one, I believe, is new in BIFF 8, correct?
Right. In detail (BIFF record names in parentheses): BIFF2 knows contents protection (PROTECT), password (PASSWORD), protected window settings (WINDOWPROTECT). BIFF3 adds drawing objects and protection (OBJECTPROTECT). BIFF5 adds scenarios and protection (SCENPROTECT). BIFF8 (starting from Excel XP) adds all other sheet protection options (SHEETPROTECTION, RANGEPROTECTION).
Any progress on this issue? Still occurs in version 3.0. Thanks.
Hello, i have the same problem in 3.0.1. 1. Create the Sheet in Calc and protect sheet with password 2. Save and close the file as .xls 3. Open the file with Calc 4. Go to menu Tool -> Protect Document 5. I can uncheck sheet and document without password If i open the same file by Excel and unprotect the sheet, Excel doesn`t ask password too. This happens with OOo 3.0.1 on Windows XP SP3. If i do the same on OOo 3.0.1 on Ubuntu 9.04 OOo ask me for the password when i try to unprotect the sheet. If i copy the file to a Windows PC and open it by OOo i can unprotect the sheet without password. But when i open it by Excel it ask me for the password. So whats the different between OOo 3.0.1 for Windows and OOo 3.0.1 for Linux? Tobias
>whats the different between OOo 3.0.1 for Windows and OOo 3.0.1 for Linux? Your Linux version shipped with Ubuntu is the Go-OO variant* that has this feature partially integrated. Your Windows version probably is the official version that doesn't yet. That's the main difference. Once this feature gets integrated upstream into the official version, there will be no difference between the two. * http://go-oo.org/
*** Issue 101503 has been marked as a duplicate of this issue. ***
*** Issue 101658 has been marked as a duplicate of this issue. ***
*** Issue 103404 has been marked as a duplicate of this issue. ***
*** Issue 106406 has been marked as a duplicate of this issue. ***
Anybody working on this? I think it is a quite serious issue. Personally I wanted to pass a sheet on to a potential customer, but can't really, because he then easily could see all the formulas (and he certainly is not supposed to).
Yeah I'm working on this at the moment. It's basically blocking on the ODF file format change approval. Most of the bits are already integrated; we just need to get the file format squared out and enable the feature. Here is my proposal: http://wiki.oasis-open.org/office/Spreadsheet_Table_Protection_Options The key is to get the password hash bit blessed by the TC. Then we can got ahead with enabling this, I guess.
*** Issue 95979 has been marked as a duplicate of this issue. ***
*** Issue 113102 has been marked as a duplicate of this issue. ***
*** Issue 113328 has been marked as a duplicate of this issue. ***
Running Windows XP SP 3 I created a Calc spreadsheet in OOo version 3.2.1 Build 9502 and password protected it using Tools>Protect document>Sheet then entering my password. I then used Edit>Save as and selected Microsoft Excel 97/2000(xls) to save the file in .xls format. I then opened the file using MS Excel 2003 (11.8328.8329) SP3. The cells I had previously locked by password protection had remained locked. Cells that I had not marked as locked could be edited as usual. By using Tools>Protection>Unprotect sheet I was able to unlock all cells for editing including those that had previously been locked. I was not asked for a password and did not need to supply one. This appears to me to be a serious security issue when exporting files to others. Is there any movement in solving it please? I note the similarity to issue 72862 which has been marked as a duplicate
Currently, Excel and OpenOffice Calc (using ODF) do not use compatible protection keys. The keys are digital hashes produced in a different way using different hash algorithms. It is not possible to translate between the two. The current behavior is to make no attempt to preserve the protection locks arriving in a "non-native" format because the lock formats are incompatible and not inter-convertible. This is true in both directions. The 2008 proposal that kyoshida@ links to was never incorporated in ODF 1.2. (That proposal is best re-activated by breaking it into separate individual proposals and having them introduced as JIRA issues for features in ODF 1.3.) In order for the same password to work, it is necessary to be able to preserve the Excel password digest and method in OpenOffice and in the resulting ODF document, when saving as ODF. If the protection is first set in OpenOffice, the entered password needs to be hashed twice, once each in ODF and Microsoft hash format, so that the correct form can be used when the document is saved (either as ODF or .xls or .xlsx). It is permissible to add the Excel digest algorithm to ODF 1.2 documents as an implementation-defined value. Ideally, the URI used to identify that method is published and becomes one that all producers of ODF documents can use to preserve protection passwords originally set in a Microsoft Office documents. If one becomes standard in ODF 1.3, migration to that URI can occur over time.
Reset assignee on issues not touched by assignee in more than 1000 days.