From 21b0f4acfc0d6827f3d2d9a85873b7b649dc96f0 Mon Sep 17 00:00:00 2001 From: Jay Berkenbilt Date: Thu, 4 Feb 2021 15:55:41 -0500 Subject: Require --allow-insecure to create certain encrypted files (fixes #501) For now, --allow-insecure allows creation of files with the owner passwords empty or matching the user password. --- ChangeLog | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'ChangeLog') diff --git a/ChangeLog b/ChangeLog index 2670dd07..32410df9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2021-02-04 Jay Berkenbilt + + * By default, give an error if a user attempts to encrypt a file + with an empty owner password or an owner password that is the same + as the user password. Such files are insecure. Most viewers either + won't open such files or will not enforce security settings. To + allow explicit creation of files like this, pass the new + --allow-insecure option. Fixes #501. + 2021-02-02 Jay Berkenbilt * Bug fix: if a form XObject lacks a resources dictionary, -- cgit v1.2.3-54-g00ecf