mirror of
https://github.com/PHPOffice/PhpSpreadsheet.git
synced 2026-10-13 15:27:58 +00:00
Owen Leibman
36b328a9fa
Fix for issue #1897. The existing hashing code seems to work correctly almost all the time, but there are exceptions. It is replaced by an exact implementation of the spec, including a link to the spec in the comments. Cases known to fail are added to the unit test suite. The spec expects the string to be at most 255 bytes (yes, bytes not characters). The program had permitted any length; it will now throw an exception when the maximum length is exceeded. Xls does not support any hashing algorithm except basic. The Xls writer had, nevertheless, accepted the results of any of the other possible algorithms. This leads to (a) a worksheet that can't be unprotected, and (b) deprecation notices during the write (because it is using hexdec, which expects only hex characters, and the other algorithms generate non-hex characters). I have changed Xls writer to ignore passwords generated by other algorithms. An alternative would be to have the password hasher generate both an algorithmic password (for use by Xlsx) and a basic password (for use by Xls); I think that is too complex a solution, but can look into it if you think it worthwhile. I do not see any current support for Worksheet passwords in ODS Reader or Writer. I did not add support in this PR. I added a new test to confirm the password for reading a spreadsheet is consistent with the one used for writing it. As you can see from the comments for the new test, it had an unusual problem with a somewhat unusual solution.
64 lines
2.4 KiB
PHP
64 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace PhpOffice\PhpSpreadsheetTests\Shared;
|
|
|
|
use PhpOffice\PhpSpreadsheet\Shared\PasswordHasher;
|
|
use PhpOffice\PhpSpreadsheet\Spreadsheet;
|
|
use PhpOffice\PhpSpreadsheetTests\Functional\AbstractFunctional;
|
|
|
|
class PasswordReloadTest extends AbstractFunctional
|
|
{
|
|
/**
|
|
* I don't know why separate process is needed for this test.
|
|
* I get a weird error without it, and I would rather just scrap the test
|
|
* than spend any more time debugging it.
|
|
* The test works fine without separate process (on Windows) with:
|
|
* php vendor\phpunit\phpunit\phpunit tests\PhpSpreadsheetTests\Shared\
|
|
* But it fails with:
|
|
* php vendor\phpunit\phpunit\phpunit tests\PhpSpreadsheetTests\
|
|
* The error is a mysterious:
|
|
* simplexml_load_string(): validity error : Validation failed: no DTD found !
|
|
*
|
|
* @runInSeparateProcess
|
|
* @preserveGlobalState disabled
|
|
* @dataProvider providerPasswords
|
|
*/
|
|
public function testPasswordReload(string $format, string $algorithm, bool $supported = true): void
|
|
{
|
|
$password = 'hello';
|
|
$spreadsheet = new Spreadsheet();
|
|
$sheet = $spreadsheet->getActiveSheet();
|
|
$sheet->getCell('A1')->setValue(1);
|
|
$protection = $sheet->getProtection();
|
|
$protection->setAlgorithm($algorithm);
|
|
$protection->setPassword($password);
|
|
$protection->setSheet(true);
|
|
|
|
$reloadedSpreadsheet = $this->writeAndReload($spreadsheet, $format);
|
|
$resheet = $reloadedSpreadsheet->getActiveSheet();
|
|
$reprot = $resheet->getProtection();
|
|
$repassword = $reprot->getPassword();
|
|
$hash = '';
|
|
if ($supported) {
|
|
$readAlgorithm = $reprot->getAlgorithm();
|
|
self::assertSame($algorithm, $readAlgorithm);
|
|
$salt = $reprot->getSalt();
|
|
$spin = $reprot->getSpinCount();
|
|
$hash = PasswordHasher::hashPassword($password, $readAlgorithm, $salt, $spin);
|
|
}
|
|
self::assertSame($repassword, $hash);
|
|
$spreadsheet->disconnectWorksheets();
|
|
$reloadedSpreadsheet->disconnectWorksheets();
|
|
}
|
|
|
|
public function providerPasswords(): array
|
|
{
|
|
return [
|
|
'Xls basic algorithm' => ['Xls', ''],
|
|
'Xls cannot use SHA512' => ['Xls', 'SHA-512', false],
|
|
'Xlsx basic algorithm' => ['Xlsx', ''],
|
|
'Xlsx can use SHA512' => ['Xlsx', 'SHA-512'],
|
|
];
|
|
}
|
|
}
|