<html>
<head>
<base href="https://bugs.documentfoundation.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:thomas@intevation.de" title="Thomas Arendsen Hein <thomas@intevation.de>"> <span class="fn">Thomas Arendsen Hein</span></a>
</span> changed
<a class="bz_bug_link
bz_status_UNCONFIRMED "
title="UNCONFIRMED - Libreoffice gives access to the same file (for other Users) with a different UID/GID in Servermode"
href="https://bugs.documentfoundation.org/show_bug.cgi?id=122149">bug 122149</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEEDINFO
</td>
<td>UNCONFIRMED
</td>
</tr>
<tr>
<td style="text-align:right;">Ever confirmed</td>
<td>1
</td>
<td>
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_UNCONFIRMED "
title="UNCONFIRMED - Libreoffice gives access to the same file (for other Users) with a different UID/GID in Servermode"
href="https://bugs.documentfoundation.org/show_bug.cgi?id=122149#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_UNCONFIRMED "
title="UNCONFIRMED - Libreoffice gives access to the same file (for other Users) with a different UID/GID in Servermode"
href="https://bugs.documentfoundation.org/show_bug.cgi?id=122149">bug 122149</a>
from <span class="vcard"><a class="email" href="mailto:thomas@intevation.de" title="Thomas Arendsen Hein <thomas@intevation.de>"> <span class="fn">Thomas Arendsen Hein</span></a>
</span></b>
<pre>These are instructions to reproduce the problem here on Debian stretch,
package versions are:
- libreoffice 1:5.2.7-1+deb9u9
- unoconv 0.7-1.1
1. user1 creates /home/user1/file.odt with text "test"
2. user2 creates /home/user2/file.odt with text "secret",
only readable for user2 (chmod 600 file.odt)
3. user2 runs (on the same machine):
cd /home/user1
unoconv file.odt
-> this fails with a uno.IOException, but keeps a process
named "soffice.bin" running, which listens on port 2002
4. user1 runs (on the same machine):
cd /home/user2
unoconv file.odt
-> this creates a world-readable /home/user2/file.pdf owned
by user2. This way user1 can read "secret" in the pdf!
@Usama: Yes, unoconv is not part of libreoffice, but until I read your comment
we thought it just starts libreoffice in a certain way, so the problem is
caused by libreoffice. But now I think it rather is a unoconv issue, despite
the process being named "soffice.bin".
Should we move this bug report to the unoconv project?
(and even if it is not directly a libreoffice problem, can you reproduce it
using my instructions? If yes, with which versions of libreoffice and unoconv?)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>