Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Unsigned PDF blocked as DocMDP P=1 because of an unreferenced signature object

Abierto
  • ¿Algo no está bien?
#9,271 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
65/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php
Área
backend, security

Línea de trabajo

Start with DocMdpHandler, which the issue identifies as scanning the raw PDF, and trace how it decides whether a DocMDP certification is active. Use the attached synthetic reproducer to compare the unused /P 1 object with the explicitly referenced negative control. Done means unused objects no longer block signing while genuine active P1 certifications still do; the issue author says regression tests are prepared.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug

LibreSign refuses to sign an unsigned PDF if it contains an unused signature dictionary with a DocMDP /P 1 entry, even though that object is not referenced by the document's active structure. It returns HTTP 422 with “This document has been certified with no changes allowed. You cannot add more signers to this document.” I originally reproduced this on 13.4.5 and still get the same error after upgrading to 13.4.7.

To reproduce

When trying to sign a PDF that was previously signed outside LibreSign, I got the error below.
I reproduced the same issue with simple test PDFs containing no real signatures or contract data.

The attached ZIP contains three reproduction files:

  1. 01-unsigned-control.pdf: a plain unsigned PDF.
  2. 02-unreferenced-docmdp-p1.pdf: the same document with an unused signature dictionary containing DocMDP /P 1.
  3. 03-rewritten-control.pdf: a rewritten copy of 02 with the unused object removed.

For each file:

  1. Upload it to LibreSign.
  2. Create a signing request.
  3. Open the request as the signer.
  4. Confirm signing.

I used two Nextcloud accounts that I control, one requesting the signature and the other signing.

Results from my tests on LibreSign 13.4.5:

File Result
01: unsigned baseline Signed successfully
02: unused DocMDP P1 object Blocked with HTTP 422 and the certification error
03: rewritten control Signed successfully

After upgrading to 13.4.7, the same signing error still occurs. The detailed three-file results above are from the original 13.4.5 tests.

The ZIP also contains a fourth PDF with an explicitly referenced P1 dictionary. That is a separate structural negative control with dummy signature bytes, not part of the three browser signing tests.

synthetic-reproducer.zip

Expected behavior

All three unsigned reproduction PDFs should pass the existing-certification check because none contains an active certification signature. An unused DocMDP object should not prevent signing. Genuine active P1 certifications should continue to block additional signatures.

Screenshots
Image
Operational System

Server: Debian, Nextcloud running in Docker

Browser Type and Version

Google Chrome / Edge

Libresign Version

13.4.7; originally reproduced on 13.4.5.

Nextcloud Server Version

33.0.10.1

Logs from Nextcloud Server

No LibreSign exception explaining the rejection.

The signing request returned HTTP 422 with the explicit DocMDP error in its JSON response, included below.

Logs from Developers tools

The failing request is:

POST /ocs/v2.php/apps/libresign/api/v1/sign/uuid/<test-request-uuid>?async=true

HTTP status: 422 Unprocessable Content

Response:

{
  "ocs": {
    "meta": {
      "status": "failure",
      "statuscode": 422,
      "message": ""
    },
    "data": {
      "action": 2000,
      "errors": [
        {
          "message": "This document has been certified with no changes allowed. You cannot add more signers to this document.",
          "code": 422
        }
      ]
    }
  }
}
Additional context

The failing test PDF has no AcroForm, signature fields, or catalog reference to a certification. It only contains an unused signature object with /P 1.

DocMdpHandler seems to scan the raw PDF and pick up that unused object anyway.

I have a possible fix and regression tests prepared and can submit a PR

Lenguaje dominante
PHP
Estrellas
838
Forks
171
Merge medio
1 d 3 h
PR fusionados (30 d)
414

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de LibreSign/libresign

Todos los issues de LibreSign/libresign

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.