bug#33684: DocView bombs out upon password protected PDFs

[Federico Tedin <federicotedin@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 715 bytes --]

Here's the new version of the patch, which enables using MuPDF to open
password-protected PDF files.

One problem I encountered while writing it is that function
`doc-view-pdf->png-converter-mupdf' uses a small hack to add "draw" to
the arguments list passed to `doc-view-start-process', only when
`doc-view-pdfdraw-program' has the value "mutool". This is because the
"mudraw" command has been replaced at some point by the "mutool"
command, which requires passing "draw" as a subcommand to do the same
work. I ended up using the same hack in the new function I created, with
a reference to the original one, but I'm not sure this was the best
possible approach. Is there a cleaner way to solve this?

- Federico


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: patch --]
[-- Type: text/x-diff, Size: 4418 bytes --]

diff --git a/lisp/doc-view.el b/lisp/doc-view.el
index df8a9fc70f..b690fb1bd6 100644
--- a/lisp/doc-view.el
+++ b/lisp/doc-view.el
@@ -183,11 +183,16 @@ doc-view-pdf->png-converter-function
 (defcustom doc-view-ghostscript-options
   '("-dSAFER" ;; Avoid security problems when rendering files from untrusted
     ;; sources.
-    "-dNOPAUSE" "-sDEVICE=png16m" "-dTextAlphaBits=4"
+    "-dNOPAUSE" "-dTextAlphaBits=4"
     "-dBATCH" "-dGraphicsAlphaBits=4" "-dQUIET")
   "A list of options to give to ghostscript."
   :type '(repeat string))
 
+(defcustom doc-view-ghostscript-device "png16m"
+  "Output device to give to ghostscript."
+  :type 'string
+  :version "27.1")
+
 (defcustom doc-view-resolution 100
   "Dots per inch resolution used to render the documents.
 Higher values result in larger images."
@@ -950,16 +955,31 @@ doc-view-dvi->pdf
 			    (list "-o" pdf dvi)
 			    callback)))
 
+(defun doc-view-pdf-password-protected-ghostscript-p (pdf)
+  "Using Ghostscript, check if a PDF file is password-protected. If it
+is, return non-nil."
+  (with-temp-buffer
+    (apply #'call-process doc-view-ghostscript-program nil (current-buffer)
+           nil `(,@doc-view-ghostscript-options
+                 "-sNODISPLAY"
+                 ,pdf))
+    (goto-char (point-min))
+    (search-forward "This file requires a password for access." nil t)))
+
 (defun doc-view-pdf->png-converter-ghostscript (pdf png page callback)
-  (doc-view-start-process
-   "pdf/ps->png" doc-view-ghostscript-program
-   `(,@doc-view-ghostscript-options
-     ,(format "-r%d" (round doc-view-resolution))
-     ,@(if page `(,(format "-dFirstPage=%d" page)))
-     ,@(if page `(,(format "-dLastPage=%d" page)))
-     ,(concat "-sOutputFile=" png)
-     ,pdf)
-   callback))
+  (let ((pdf-passwd (if (doc-view-pdf-password-protected-ghostscript-p pdf)
+                        (read-passwd "Enter password for PDF file: "))))
+    (doc-view-start-process
+     "pdf/ps->png" doc-view-ghostscript-program
+     `(,@doc-view-ghostscript-options
+       ,(concat "-sDEVICE=" doc-view-ghostscript-device)
+       ,(format "-r%d" (round doc-view-resolution))
+       ,@(if page `(,(format "-dFirstPage=%d" page)))
+       ,@(if page `(,(format "-dLastPage=%d" page)))
+       ,@(if pdf-passwd `(,(format "-sPDFPassword=%s" pdf-passwd)))
+       ,(concat "-sOutputFile=" png)
+       ,pdf)
+     callback)))
 
 (defalias 'doc-view-ps->png-converter-ghostscript
   'doc-view-pdf->png-converter-ghostscript)
@@ -980,17 +1000,33 @@ doc-view-djvu->tiff-converter-ddjvu
      ,tiff)
    callback))
 
+(defun doc-view-pdf-password-protected-pdfdraw-p (pdf)
+  "Using MuPDF, check if a PDF file is password-protected. If it is,
+return non-nil."
+  (with-temp-buffer
+    (apply #'call-process doc-view-pdfdraw-program nil (current-buffer) nil
+           ;; FIXME: See FIXME comment in `doc-view-pdf->png-converter-mupdf'.
+           `(,@(if (string-match "mutool[^/\\]*$" doc-view-pdfdraw-program) '("draw"))
+             ,(concat "-o" null-device)
+             ;; In case PDF isn't password-protected, "draw" only one page.
+             ,pdf "1"))
+    (goto-char (point-min))
+    (search-forward "error: cannot authenticate password" nil t)))
+
 (defun doc-view-pdf->png-converter-mupdf (pdf png page callback)
-  (doc-view-start-process
-   "pdf->png" doc-view-pdfdraw-program
-   ;; FIXME: Ugly hack: recent mupdf distribution replaced "mudraw" with
-   ;; "mutool draw".
-   `(,@(if (string-match "mutool[^/\\]*$" doc-view-pdfdraw-program) '("draw"))
-     ,(concat "-o" png)
-     ,(format "-r%d" (round doc-view-resolution))
-     ,pdf
-     ,@(if page `(,(format "%d" page))))
-   callback))
+  (let ((pdf-passwd (if (doc-view-pdf-password-protected-pdfdraw-p pdf)
+                        (read-passwd "Enter password for PDF file: "))))
+    (doc-view-start-process
+     "pdf->png" doc-view-pdfdraw-program
+     ;; FIXME: Ugly hack: recent mupdf distribution replaced "mudraw" with
+     ;; "mutool draw".
+     `(,@(if (string-match "mutool[^/\\]*$" doc-view-pdfdraw-program) '("draw"))
+       ,(concat "-o" png)
+       ,(format "-r%d" (round doc-view-resolution))
+       ,@(if pdf-passwd `("-p" ,pdf-passwd))
+       ,pdf
+       ,@(if page `(,(format "%d" page))))
+     callback)))
 
 (defun doc-view-odf->pdf-converter-unoconv (odf callback)
   "Convert ODF to PDF asynchronously and call CALLBACK when finished.