Function app.openDoc not returning Doc object although run in privileged function SOLVED

[filip_9460]

Hi everyone,
I am having problems with the security restrictions of JS run in PDFXChange Editor. My goal is to have a button which when I click on it, it saves the made changes, creates a copy of the file, flattens forms and annotations and adds this document (its one page) as a document header to other document (which I chose from app.browseForDoc).

I made this function on my PC, it worked always, I was happy. However then I sent that PDF to my college and that code did not run at all. Error was:

Code: Select all

NotAllowedAccess: Security settings prevent access to this property or method

.

I googled the issue and implemented the code as privileged fuction and store in locally (should solve the issue). The loading of the function works, so there is an improvement. HOWEVER In the privileged function I need to open new file by app.openDoc and get the doc object. And this still doesnt work. See my privileged test function to addess the issue:

Code: Select all

global.trustedSimpleFcn = app.trustedFunction(function(originalDoc) 
{

	app.beginPriv();
	var originalPath = originalDoc.path;

	// Get the path for the temp file
	var tempPath = app.getPath("user", "temp") + "/my_temp_pdf.pdf";

	// This saves the original file as temp
	originalDoc.saveAs(tempPath);

	// Open original again
	app.openDoc(originalPath); 

	// Open the temp to get the doc object
	var tempDoc = app.openDoc(tempPath);
	if (!tempDoc) {
	app.alert("tempDoc is empty!", 0, 0, "Error");
	app.endPriv();
	return;
	}

	app.alert("tempDoc is provided!", 3, 0, "Info");
	app.endPriv();
})

If I call this privileged function:

Code: Select all

global.trustedSimpleFcn(this);

through the console, everything works fine. HOWEVER if I call this function through a button in a PDF file which I havent created or havent created the button, then it doesnt return the doc object. See the attached PDF file and create .js with the privileged function and put it inside ..\AppData\Tracker Software\\PDFXEditor\3.0\JavaScripts locally.

Test.pdf

Thanks and regards,
Filip

[Daniel - PDF-XChange]

Hello, filip_9460

Thank you for the report, I know there have in the past year been a number of security changes to how and when JS can access specific items, but I am not fluent enough to provide a direct answer here. I have escalated this to our Dev team for their input on the scenario to confirm what might be the cause.

Kind regards,

[Mathew]

Hi everyone,
....
See my privileged test function to addess the issue:
....
Test.pdf

Thanks and regards,
Filip

Hi Filip,
In your script, you still have the document "originalDoc" open (you just saved it to tempPath); I don't think app.openDoc will ever return a document if it's already open. The test script is also not saving the document to the original location first, so when you re-open it, it may not have any unsaved changes - maybe save it first, or use the bCopy parameter of doc.saveAs; also, the two functions that need privilege are app.getPath and doc.saveAs.


That said...

The javascript API says that app.openDoc should return null if the document's disclosed property is false for most cases. (I'm not suggesting I agree with what seems like a backwards approach, though: An unprivileged script can open a pdf document and the security is just preventing that script from getting a handle on it.)

Beginning with the Acrobat 5.0.5 Accessibility and Forms Patch and continuing with Acrobat 6.0 and later, openDoc behaves as follows:

• During a batch, console or menu event, openDoc ignores the disclosed property and returns the Doc object of the file specified by cPath.
  During any other event, openDoc returns the Doc, if disclosed is true, and null, otherwise.

I've found that PXCE makes the disclosed property false on any document by default. Easiest IMO is to search through app.activeDocs (which also needs privilege) after you've opened the file if you get null. I also enclose saveAs and openDoc in try {} catch {} because it can throw errors:

Code: Select all

global.trustedSimpleFcn = app.trustedFunction(function(originalDoc) 
{
    // Get the path for the temp file
    app.beginPriv();
    var tempPath = app.getPath("user", "temp") + "/my_temp_pdf.pdf";

    // This saves a copy of original file as temp
    try {
    originalDoc.saveAs({
        cPath: tempPath,
        bCopy: true});
    } catch (e) {
        return console.println(e); // failed to save the tempDoc - returns nothing
    }

    // Open the copy -- could open it hidden if it doesn't need to be interacted with
    var tempDoc;
    try {
        tempDoc = app.openDoc({
            cPath: tempPath,
            bHidden: false}); 
    } catch(e) {
           console.println(e);
    }
    
    // generally will just get null, so need to search in the open documents
    if (null == tempDoc) tempDoc = app.activeDocs.find(d => d.path === tempPath);

    app.endPriv();
    
    // return the temp file or nothing if couldn't open it
    return tempDoc;
});

[Stefan - PDF-XChange]

Hello Mathew,

Thanks for the post and suggestions!

Kind regards,
Stefan

[filip_9460]

Hello,
thank you for your responses and sorry for the late response. I havent received any notifications. I also have seen this with the disclosed property, but since I cannot really set that one or influence it. I will test the suggest workaround tomorrow.

I actually first asked this in Adobe forum: https://community.adobe.com/community#M528830. However since great ADOBE renewed their forum today, the issue is currently not available. Still the users there tested this exact function with the given PDF (same like I posted here) and in Adobe Acrobat everything worked! They were also suprised that it isnt working for me, since the privileged function shouldnt run into these issues.

So even if the workaround works, this seems to me still as a bug in PDF-Exchange.

[Mathew]

Hello,
thank you for your responses and sorry for the late response. I havent received any notifications. I also have seen this with the disclosed property, but since I cannot really set that one or influence it. I will test the suggest workaround tomorrow.

I actually first asked this in Adobe forum: https://community.adobe.com/community#M528830. However since great ADOBE renewed their forum today, the issue is currently not available. Still the users there tested this exact function with the given PDF (same like I posted here) and in Adobe Acrobat everything worked! They were also suprised that it isnt working for me, since the privileged function shouldnt run into these issues.

So even if the workaround works, this seems to me still as a bug in PDF-Exchange.

Hi Filip,
Well, hopefully the one-liner works for you.

Code: Select all

if (null == tempDoc) tempDoc = app.activeDocs.find(d => d.path === tempPath);

I find it's pretty easy to add this after any app.openDoc() and it won't affect the result even if app.openDoc() does return the document.


Digging a bit deeper, I checked on acrobat, and if I add the following lines to the button script:

Code: Select all

console.show();
console.println("Disclosed: " + this.disclosed);
console.println('Event: ' + event.type + ' / ' + event.name);

I get the following information on both PDF XChange and Acrobat:

Code: Select all

Disclosed: false
Event: Field / Mouse Down

Based on the above, and Adobe's own JavaScript API, I think that actually PDF XChange is responding correctly and the versions of acrobat that people tried it with have the bug.

[Sean - PDF-XChange]

Hi Mathew,

Thanks for the input here.

Kind regards,

[filip_9460]

Hello Mathew,
thank you a lot. The one liner actually works as intendet and the rest of my code runs without any more issues. So SOLVED.

It still doesnt make to me much sense why a privileged function doesnt return always regardless the disclosed property the doc object, but this is an other topic.

Thank you a lot
Cheers
Filip

[Jordan - PDF XChange]