Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Unsigned PDF blocked as DocMDP P=1 because of an unreferenced signature object

オープン
  • 何か問題がありますか？
#9,271 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
65/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
php
領域
backend, security

調査の方向性

Start with DocMdpHandler, which the issue identifies as scanning the raw PDF, and trace how it decides whether a DocMDP certification is active. Use the attached synthetic reproducer to compare the unused /P 1 object with the explicitly referenced negative control. Done means unused objects no longer block signing while genuine active P1 certifications still do; the issue author says regression tests are prepared.

索引モデルが issue の本文から書いたものです。

説明

Describe the bug

LibreSign refuses to sign an unsigned PDF if it contains an unused signature dictionary with a DocMDP /P 1 entry, even though that object is not referenced by the document's active structure. It returns HTTP 422 with “This document has been certified with no changes allowed. You cannot add more signers to this document.” I originally reproduced this on 13.4.5 and still get the same error after upgrading to 13.4.7.

To reproduce

When trying to sign a PDF that was previously signed outside LibreSign, I got the error below.
I reproduced the same issue with simple test PDFs containing no real signatures or contract data.

The attached ZIP contains three reproduction files:

  1. 01-unsigned-control.pdf: a plain unsigned PDF.
  2. 02-unreferenced-docmdp-p1.pdf: the same document with an unused signature dictionary containing DocMDP /P 1.
  3. 03-rewritten-control.pdf: a rewritten copy of 02 with the unused object removed.

For each file:

  1. Upload it to LibreSign.
  2. Create a signing request.
  3. Open the request as the signer.
  4. Confirm signing.

I used two Nextcloud accounts that I control, one requesting the signature and the other signing.

Results from my tests on LibreSign 13.4.5:

File Result
01: unsigned baseline Signed successfully
02: unused DocMDP P1 object Blocked with HTTP 422 and the certification error
03: rewritten control Signed successfully

After upgrading to 13.4.7, the same signing error still occurs. The detailed three-file results above are from the original 13.4.5 tests.

The ZIP also contains a fourth PDF with an explicitly referenced P1 dictionary. That is a separate structural negative control with dummy signature bytes, not part of the three browser signing tests.

synthetic-reproducer.zip

Expected behavior

All three unsigned reproduction PDFs should pass the existing-certification check because none contains an active certification signature. An unused DocMDP object should not prevent signing. Genuine active P1 certifications should continue to block additional signatures.

Screenshots
Image
Operational System

Server: Debian, Nextcloud running in Docker

Browser Type and Version

Google Chrome / Edge

Libresign Version

13.4.7; originally reproduced on 13.4.5.

Nextcloud Server Version

33.0.10.1

Logs from Nextcloud Server

No LibreSign exception explaining the rejection.

The signing request returned HTTP 422 with the explicit DocMDP error in its JSON response, included below.

Logs from Developers tools

The failing request is:

POST /ocs/v2.php/apps/libresign/api/v1/sign/uuid/<test-request-uuid>?async=true

HTTP status: 422 Unprocessable Content

Response:

{
  "ocs": {
    "meta": {
      "status": "failure",
      "statuscode": 422,
      "message": ""
    },
    "data": {
      "action": 2000,
      "errors": [
        {
          "message": "This document has been certified with no changes allowed. You cannot add more signers to this document.",
          "code": 422
        }
      ]
    }
  }
}
Additional context

The failing test PDF has no AcroForm, signature fields, or catalog reference to a certification. It only contains an unused signature object with /P 1.

DocMdpHandler seems to scan the raw PDF and pick up that unused object anyway.

I have a possible fix and regression tests prepared and can submit a PR

主要言語
PHP
スター
838
フォーク
171
平均マージ
1日 3時間
マージ済み PR（30日）
414

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

LibreSign/libresign のほかの issue

LibreSign/libresign の issue をすべて見る

似ている issue

PHP の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。