Bug 456381

Summary:	Respect Config Option to Not Notify about Embedded Signatures
Product:	[Applications] okular	Reporter:	Billy McCann <thebillywayne>
Component:	general	Assignee:	Okular developers <okular-devel>
Status:	RESOLVED NOT A BUG
Severity:	minor	CC:	aacid
Priority:	NOR
Version First Reported In:	22.04.2
Target Milestone:	---
Platform:	Arch Linux
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:

Description Billy McCann 2022-07-06 05:19:55 UTC

SUMMARY
***
Okular gives a notification regarding the signatures of digitally signed pdfs irrespective of gui configuration. When "Notify about embedded files, forms, or signatures" is true, notifications regarding all three about will be displayed. Yet if this option is turned off, notifications about signatures still appear while those for embedded files and forms do not. Hence, notifications about signatures are displayed irrespective of the configuration, which other notifications are suppressed as per the configuration. Suggest patching `gui/signatureguiutils.cpp`.
***

STEPS TO REPRODUCE
1. Ensure that "Settings > Configure Okular > General Options > Notify about embedded files, forms, or signatures" is checked.
2. Open a pdf with both forms and a digital signature.
3. Observe notifications about both forms and signature.
4. Change settings such that "Settings > Configure Okular > General Options > Notify about embedded files, forms, or signatures" is no longer checked.
6. Observe notifications about only the signature and not forms.

OBSERVED RESULT
Notifications about signatures is observed even though "Notify about embedded files, forms, or signatures" is not checked in the options. However, all notifications are observed if the option is checked.

EXPECTED RESULT
No notifications regarding embedded files, forms or signatures if the option is unchecked. Expect notifications regarding signatures to be suppressed along with others.

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Linux 5.18.8
KDE Plasma Version: 5.25.2
KDE Frameworks Version: 5.95.0
Qt Version: 5.15.5

ADDITIONAL INFORMATION
Suggest adding logic to `if (anySignatureUnsighted)` conditional beginning on line 204 of `gui/signatureguiutils.cpp` to check preferences.

Comment 1 Albert Astals Cid 2022-07-06 21:33:50 UTC

Can you attach a file that shows this problem?

Comment 2 Billy McCann 2022-07-07 23:02:02 UTC

(In reply to Albert Astals Cid from comment #1)
> Can you attach a file that shows this problem?

Looking for a file that both does this behavior and doesn't exceed the upload file size limit has led to a small discovery. That is, it's only certain files that exhibit this behavior. When I found a test pdf online[1] that contains both forms and signatures, Okular behaves exactly as I expect with regards to the notification options. 

The only pdfs that exhibit this behavior are very large files that have been shared with me by clients. And the most common message I see is "This document is digitally signed. There have been changes since last signed." 

Should that notification regarding the digital signature not be suppressed by the configuration option?

[1]https://kbdeveloper.qoppa.com/wp-content/uploads/blank_signed.pdf

Comment 3 Bug Janitor Service 2022-07-22 04:36:34 UTC

Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least
15 days. Please provide the requested information as soon as
possible and set the bug status as REPORTED. Due to regular bug
tracker maintenance, if the bug is still in NEEDSINFO status with
no change in 30 days the bug will be closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

If you have already provided the requested information, please
mark the bug as REPORTED so that the KDE team knows that the bug is
ready to be confirmed.

Thank you for helping us make KDE software even better for everyone!

Comment 4 Albert Astals Cid 2022-08-03 22:29:11 UTC

> Should that notification regarding the digital signature not be suppressed by the configuration option?

No, it's a warning because the document has been signed and then been changed, so what you are seeing is not what was signed, your boss may have signed a file that said "We have raised your salary 1%" and then someone else changed the file to say "You're fired".

You really want to know that what you're seeing is not what was signed.