[Libreoffice-bugs] [Bug 117825] New: Base allows users to execute macro code even when macro execution is blocked by security setting

[bugzilla-daemon at bugs.documentfoundation.org]

https://bugs.documentfoundation.org/show_bug.cgi?id=117825

            Bug ID: 117825
           Summary: Base allows users to execute macro code even when
                    macro execution is blocked by security setting
           Product: LibreOffice
           Version: 6.0.4.2 release
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: medium
         Component: Base
          Assignee: libreoffice-bugs at lists.freedesktop.org
          Reporter: drewjensen.inbox at gmail.com

Description:
Open a Base file containing macros and with system options set to disable macro
execution - most attempts to start a macro will issue a security warning and
fail, but one way allows the macro to run.

Steps to Reproduce:
1. From LibO open Tools->Options->Scurity
2. Click on Macro Security
3. Make sure the Macro Security setting is HIGH (only signed macros from
trusted sources are allowed)
4. Close options dialog
5. download and open attached ODB file (security warning box opens; 
"This document contains macros.

Macros may contain viruses. Execution of macros is disabled due to the current
macro security setting in Tools - Options - LibreOffice - Security.

Therefore, some functionality may not be available."

6. clear message box
7. Open the Basic editor Tools->Macros->Run Macro
8. Select file "tst_macro_security" and open library 'TestLibrary", Module1
9. select Main
10. Click on Run (no warning message is displayed, but the macro doesn't run
either)
12. Select Tools->Macros->Organize Macros->Libreoffice Basic
13. Select file "tst_macro_security", open library 'TestLibrary", Module1
14. Select Main and click edit
15. From inside the Basic editor try to Run the macro Main
16. Security Notification is displayed:
"For security reasons, you cannot run this macro.

For more information, check the security settings."
17. Close the Basic editor
18. Select Tools->Macros->Organize Macros->Libreoffice Basic
19. Select file "tst_macro_security" and open library 'TestLibrary", Module1
20. Double click on the sub procedure "Main"


Actual Results:  
The code runs, a form is opened.

Expected Results:
The same security message as when the user tried to run the macro from inside
the Basic editor.


Reproducible: Always


User Profile Reset: No



Additional Info:
Tested on Ubuntu 18.04 with build:
Version: 6.0.4.2
Build ID: 9b0d9b32d5dcda91d2f1a96dc04c645c450872bf
CPU threads: 4; OS: Linux 4.15; UI render: default; VCL: gtk2; 
Locale: en-US (en_US.UTF-8); Calc: group


User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Ubuntu Chromium/66.0.3359.181 Chrome/66.0.3359.181 Safari/537.36

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/libreoffice-bugs/attachments/20180526/378481f7/attachment-0001.html>