Module Prawn::Document::Security
In: lib/prawn/security.rb

Implements PDF encryption (password protection and permissions) as specified in the PDF Reference, version 1.3, section 3.5 "Encryption".

Methods

Constants

PermissionsBits = { :print_document => 3, :modify_contents => 4, :copy_contents => 5, :modify_annotations => 6 }   Flags in the permissions word, numbered as LSB = 1
FullPermissions = 0b1111_1111_1111_1111_1111_1111_1111_1111
PasswordPadding = "28BF4E5E4E758A4164004E56FFFA01082E2E00B6D0683E802F0CA9FE6453697A". scan(/../).map{|x| x.to_i(16)}.pack("c*")

Public Class methods

Encrypts the given string under the given key, also requiring the object ID and generation number of the reference. See Algorithm 3.1.

Public Instance methods

Encrypts the document, to protect confidential data or control modifications to the document. The encryption algorithm used is detailed in the PDF Reference 1.3, section 3.5 "Encryption", and it is implemented by all major PDF readers.

options can contain the following:

:user_password:Password required to open the document. If this is omitted or empty, no password will be required. The document will still be encrypted, but anyone can read it.
:owner_password:Password required to make modifications to the document or change or override its permissions. If this is set to :random, a random password will be used; this can be useful if you never want users to be able to override the document permissions.
:permissions:A hash mapping permission symbols (see below) to true or false. True means "permitted", and false means "not permitted". All permissions default to true.

The following permissions can be specified:

:print_document:Print document.
:modify_document:Modify contents of document (other than text annotations and interactive form fields).
:copy_contents:Copy text and graphics from document.
:modify_annotations:Add or modify text annotations and interactive form fields.

Examples

Deny printing to everyone, but allow anyone to open without a password:

  encrypt_document :permissions => { :print_document => false },
                   :owner_password => :random

Set a user and owner password on the document, with full permissions for both the user and the owner:

  encrypt_document :user_password => 'foo', :owner_password => 'bar'

Set no passwords, grant all permissions (This is useful because the default in some readers, if no permissions are specified, is "deny"):

  encrypt_document

Caveats

  • The encryption used is weak; the key is password-derived and is limited to 40 bits, due to US export controls in effect at the time the PDF standard was written.
  • There is nothing technologically requiring PDF readers to respect the permissions embedded in a document. Many PDF readers do not.
  • In short, you have no security at all against a moderately motivated person. Don‘t use this for anything super-serious. This is not a limitation of Prawn, but is rather a built-in limitation of the PDF format.

[Validate]