Issue 127942 - Recent documents - clear list only hides entries but do not delete it in real
Summary: Recent documents - clear list only hides entries but do not delete it in real
Status: UNCONFIRMED
Alias: None
Product: General
Classification: Code
Component: security (show other issues)
Version: 4.2.0-dev
Hardware: All All
: P5 (lowest) Normal (vote)
Target Milestone: ---
Assignee: AOO security list
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-21 18:18 UTC by jmpoo
Modified: 2018-11-22 15:54 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description jmpoo 2018-11-21 18:18:48 UTC 
All Versions of AOO

File -> Recent Documents -> Clear List do not delete recent file entrys.
They are still stored in registrymodification.xcu and could easily be shown if you choose "Insert Hyperlink" -> "Dokument" and open the Path list by clicking at the black arrow right beside the input box.
Comment 1 Peter 2018-11-22 09:21:47 UTC 
Can you elaborate why this is a security issue for you?
To me it is at maximum an ordinary bug.
Comment 2 oooforum (fr) 2018-11-22 10:27:36 UTC 
(In reply to Peter from comment #1)
> To me it is at maximum an ordinary bug.
For me, not even a bug: clear is not delete
Comment 3 Peter 2018-11-22 11:10:35 UTC 
But how can someone clean the registrymodification.xcu then?
Which seems to be the core issue.

Would you think we need a separate delete function? Or wouldn't it be easier to just remove the list also in the file?
Comment 4 jmpoo 2018-11-22 15:54:28 UTC 
The Bugzilla Help indicates that the security component addresses security and privacy issues.
In my view, "privacy" applies and so I use this component instead of "ui".

If I empty the recent files list, I assume that it works like deleting the history of a trustable web browser.

However, only the display of recently used files is prevented. In fact, the value of the "PickList" entries is changed from oor: op = "replace" to oor: op = "remove" (Registrymodifications.xcu). The entries themselves are retained. What for? The user can not re-view them.

In addition, OpenOffice actually saves two lists in Registrymodifications.xcu (" Recent files "and" URL History ") when I only open files.

URL history entries are completely ignored by clearing "recent files". This list can not be cleared or deleted using the user interface. Instead, anyone who inserts hyperlinks is able to see the entire file history.

And also everyone who looks at the registrymodifications.xcu.

I suspect, many users do not know anything about the document list in the hyperlink window or xcu-file and therefore would not even get any idea that they might be investigated.

For me a clear privacy problem. The entries should be deleted in the xcu-file and in all histories.