These forums are now Read Only. If you have an Acrobat question, ask questions and get help from one of our experts.

Comment - Reviewer Identity Security?

nquinnell
Registered: Mar 6 2008
Posts: 6

Greetings:

Software: Acrobat 8, professional.
System: Windows XP, on a Server 2003 environment.

Problem: We are trying to use the Review and Commenting functions for drawing/design review. We've gotten all the network issues resolved, and have sucessfully started and used the reviewing tools in a webdav folder.

However, we've found a large security hole we don't know how to plug.

As you know, reviewers are listed by their name, e-mail, and title as entered into the Adobe Acrobat software. When comments are created, this information is used to identify the originator of the comment.

If I modify my Adobe identity, i.e. enter someone elses' name, e-mail, and title, I automatically get their ability to delete and modify their comments. For example, I am user "john smith". I enter a comment of "delete this wall" into the review process. In the review, user "bob jones" enters some comments. He notes that "john smith" has the "delete this wall" comment, and doesn't like it. Bob Jones then goes and edits his Adobe data to pretend he's "john smith" and deletes Johns' comment in the review.

How do I stop this from happening? Am I missing something on the security? If there's no way to stop this, the Adobe software commenting becomes almost useless to us.

Thank you for your help.

My Product Information:
Acrobat Pro 8.1.2, Windows
Danious
Registered: Apr 14 2008
Posts: 10
Hi nquinnell,

I'm in the same situation. In the "Javascript for Acrobat API Reference" is the "identity" object detailled. It says that you can change the email, name and corporation of the current user (the Access is R/W) in a privileged context.

Unfortunately, I didn't manage to change these values. When I try, it simply does nothing (the values don't change, and no error message is shown).

If you find a solution, please give it to me, I'll do the same if I find.
nquinnell
Registered: Mar 6 2008
Posts: 6
Thanks, Danious, its nice to know I'm not alone in this situation.

I think I'm going to have to call ADobe on this one, and see if they can give me any sort of relevant answer.

Being able to enter someone elses' name, and then change all their comments, seems like a very insecure way to have this set up.
jimmy_et
Registered: Aug 29 2008
Posts: 3
Were any of you able to resolve this security issue?
I am experiencing the same problem.
Thanks for any help.
-James
nquinnell
Registered: Mar 6 2008
Posts: 6
Nope. Even in Version 9, you can go in and change the identity of the comment creator, and/or change your identity to be whomever you want to be.

So far, we haven't had anybody abuse this yet, but its still a major concern for us. We remain with our fingers crossed.