> Caution: Password to modify is not a security feature. ... Malicious users can edit the file and remove the password.
This type of "protection" is also present in the VBA blobs (where you can change a few bytes and work around the VBA protection)
Saving a file with a password to open actually employs encryption. The exact setting can be tuned with registry settings, but is typically AES-128-CBC.
Saving a file as "read-only" encrypts the file with the standard password "VelvetSweatshop"
> Inside Microsoft – A ‘Velvet Sweatshop’ or a High-Tech Heaven?
https://www.seattletimes.com/business/archive-inside-microso...
Alternatively, hash the contents and signed using asymmetric keys. This would allow for non private key owners to validate the integrity
How would you validate the signature?
I’ve done hardcoded frontend identity whitelists for authorization. Some times it’s fine to let hackers access stuff, but not the vanilla mass-market browsers. Feature flags etc
I knew about the xml trick, but I could never get it to work consistently. This looks useful, thanks for sharing.
xmldata = ZipFile(docxfile).open("word/settings.xml").read().decode()
xmldata = re.sub("<w:documentProtection .\*/>", "", xmldata)