Unsigned PDF blocked as DocMDP P=1 because of an unreferenced signature object
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with DocMdpHandler, which the issue identifies as scanning the raw PDF, and trace how it decides whether a DocMDP certification is active. Use the attached synthetic reproducer to compare the unused /P 1 object with the explicitly referenced negative control. Done means unused objects no longer block signing while genuine active P1 certifications still do; the issue author says regression tests are prepared.
由索引模型根据 Issue 内容生成。
描述
Describe the bug
LibreSign refuses to sign an unsigned PDF if it contains an unused signature dictionary with a DocMDP /P 1 entry, even though that object is not referenced by the document's active structure. It returns HTTP 422 with “This document has been certified with no changes allowed. You cannot add more signers to this document.” I originally reproduced this on 13.4.5 and still get the same error after upgrading to 13.4.7.
To reproduce
When trying to sign a PDF that was previously signed outside LibreSign, I got the error below.
I reproduced the same issue with simple test PDFs containing no real signatures or contract data.
The attached ZIP contains three reproduction files:
01-unsigned-control.pdf: a plain unsigned PDF.02-unreferenced-docmdp-p1.pdf: the same document with an unused signature dictionary containing DocMDP/P 1.03-rewritten-control.pdf: a rewritten copy of 02 with the unused object removed.
For each file:
- Upload it to LibreSign.
- Create a signing request.
- Open the request as the signer.
- Confirm signing.
I used two Nextcloud accounts that I control, one requesting the signature and the other signing.
Results from my tests on LibreSign 13.4.5:
| File | Result |
|---|---|
| 01: unsigned baseline | Signed successfully |
| 02: unused DocMDP P1 object | Blocked with HTTP 422 and the certification error |
| 03: rewritten control | Signed successfully |
After upgrading to 13.4.7, the same signing error still occurs. The detailed three-file results above are from the original 13.4.5 tests.
The ZIP also contains a fourth PDF with an explicitly referenced P1 dictionary. That is a separate structural negative control with dummy signature bytes, not part of the three browser signing tests.
Expected behavior
All three unsigned reproduction PDFs should pass the existing-certification check because none contains an active certification signature. An unused DocMDP object should not prevent signing. Genuine active P1 certifications should continue to block additional signatures.
Screenshots
Operational System
Server: Debian, Nextcloud running in Docker
Browser Type and Version
Google Chrome / Edge
Libresign Version
13.4.7; originally reproduced on 13.4.5.
Nextcloud Server Version
33.0.10.1
Logs from Nextcloud Server
No LibreSign exception explaining the rejection.
The signing request returned HTTP 422 with the explicit DocMDP error in its JSON response, included below.
Logs from Developers tools
The failing request is:
POST /ocs/v2.php/apps/libresign/api/v1/sign/uuid/<test-request-uuid>?async=true
HTTP status: 422 Unprocessable Content
Response:
{
"ocs": {
"meta": {
"status": "failure",
"statuscode": 422,
"message": ""
},
"data": {
"action": 2000,
"errors": [
{
"message": "This document has been certified with no changes allowed. You cannot add more signers to this document.",
"code": 422
}
]
}
}
}
Additional context
The failing test PDF has no AcroForm, signature fields, or catalog reference to a certification. It only contains an unused signature object with /P 1.
DocMdpHandler seems to scan the raw PDF and pick up that unused object anyway.
I have a possible fix and regression tests prepared and can submit a PR
- 主要语言
- PHP
- 星标
- 838
- 派生
- 171
- 平均合并
- 1 天 3 小时
- 30 天内合并 PR
- 414
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
LibreSign/libresign 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 83/100
LibreSign/libresign#9007 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
Define LibreSign Behat taxonomy and reusable context conventions可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭backend enhancement php
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
good first issue
难度 2/5 1-3 小时 新手友好度 78/100
LibreSign/libresign#8284 · 5 条评论 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 20/100
LibreSign/libresign#9249 · 2 条评论 ·
维护者通常 1 天内回复
-
backend php
难度 4/5 3-5 天 新手友好度 53/100
维护者通常 1 天内回复
查看 LibreSign/libresign 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
unopim/shopify-connector#55 ·
-
14.3.x
难度 2/5 1-3 小时 新手友好度 65/100
-
bug
难度 2/5 1-3 小时 新手友好度 68/100
-
CMS video element: "CmsVideoPlugin" sets `volume = 0`, so videos cannot be unmuted on Android Chrome未关闭needs-triage Platform(Default)
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
PrestaShop/ps_googleanalytics#187 ·