Opening PDF Using subprocess.Popen Failing

[Naftali]

It actually doesn't fail but it 'cannot open in protected mode' (see here http://blogs.adobe.com/dmcmahon/2012/07/27/adobe-reader-cannot-open-protected-mode-due-to-a-problem-with-your-system-configuration/)

I am using subprocess.Popen("AcroRe32.exe /n <file.pdf>") which is the actuall adobe reader command I'd issue on the command line to open the pdf (the /n option opens it the file in a new instance of reader).

Now, when I issue the command straight from powershell, the pdf opens no problem, but when I open in my script (whether a .py or py2exe) I get the pop up complaining that the PDF cannot be opened in 'protected mode.' One of the options is to open it anyways, which works.

Looking into it (see the link in the first paragraph) my best guess is that it's due to something like "JS-invoked processes: Launching a process through JavaScript is not allowed with Protected Mode enabled."

But my naive understanding was that when I give Popen instruction, the command is handed off to windows and the called program is unaware of how it got called, so my thinking is that either that is incorrect or windows somehow 'cooperates' with reader to figure things out.

I am looking for *any* insight as to how to deal with this, and the 'turn off protected mode" option wont work for me.

Here is my code,

outputname = " unlocked.pdf"

commandstr = "qpdf --decrypt " + sys.argv[1] + outputname
os.system(commandstr)

new_command_str = "AcroRd32.exe /n" + outputname
subprocess.Popen(new_command_str)

sys.exit(0)

[Laura Creighton]

>--
>https://mail.python.org/mailman/listinfo/python-list

I don't have a windows system to test this on, but I read
https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/protectedmode.html

It looks like if you put your output file one of the places that
Acrobat allows, then things might work. You can then move the thing
later to where you want it to go.

There is also this tantalising FAQ entry:


When custom policies fail for certain workflows, what are the
options other than disabling Protected Mode?

One option is to add custom policies to bypass protected mode
restrictions.

Now, I haven't found out _how you do that_ yet, but seems like a
promising area for research.

Laura

[Naftali]

Yes, this is excellent. thank you so much. Will update the list when this works out.

[Naftali]

On Friday, June 19, 2015 at 1:25:12 PM UTC-4, Naftali wrote:

I am running the script via powershell. that sounds very promising. I'm going to read the link Laura pointed to upthread and see what happens outside powershell on Monday when I get back to the windows environment.

But thank you for the heads up cause that makes a lot sense.

[Robin Becker]

.....

Naftali,

I ran the following from python prompt


import os
os.system('"C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe" /n
thello.pdf')


and this worked as did

import subprocess
subprocess.Popen(['C:\Program Files (x86)\Adobe\Reader
11.0\Reader\AcroRd32.exe','/n','thello.pdf'])

however I also tried running

import subprocess
subprocess.Popen('AcroRd32.exe /nthello.pdf')

which seems closer to your

> new_command_str = "AcroRd32.exe /n" + outputname
> subprocess.Popen(new_command_str)

and that fails; the python error is


> C:\Users\rptlab\tmp>tpdf.py
> Traceback (most recent call last):
> File "C:\Users\rptlab\tmp\tpdf.py", line 6, in <module>
> subprocess.Popen('AcroRd32.exe /nthello.pdf')
> File "c:\python27\lib\subprocess.py", line 710, in __init__
> errread, errwrite)
> File "c:\python27\lib\subprocess.py", line 958, in _execute_child
> startupinfo)
> WindowsError: [Error 2] The system cannot find the file specified



--
Robin Becker

[Robin Becker]

On 22/06/2015 11:33, Robin Becker wrote:
> .....
>
> Naftali,
>
> I ran the following from python prompt
>

........
>
>


for what it's worth this also works on my machine

> Windows PowerShell
> Copyright (C) 2009 Microsoft Corporation. All rights reserved.
>
> PS C:\Users\rptlab> cd tmp
> PS C:\Users\rptlab\tmp> python
> Python 2.7.8 (default, Jun 30 2014, 16:08:48) [MSC v.1500 64 bit (AMD64)] on win32
> Type "help", "copyright", "credits" or "license" for more information.

>>>> import subprocess
>>>> subprocess.Popen(['C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe','/n','thello.pdf'])

> <subprocess.Popen object at 0x0000000001D853C8>
>>>>

not sure if you are using 64bits or 32bit windows, but perhaps you just need to
specify the full path to your AcroRd32.exe.

--
Robin Becker

[Naftali]

On Friday, June 19, 2015 at 1:25:12 PM UTC-4, Naftali wrote:

Thank you, Robin, just got in, happy Monday. I don't think it's the path because I added the acrobat exe to my path env variable which is why it didn't crash and burn. I tried running it via the standard prompt (as opposed to powershell) and ran into the same issue but the prompt gave a bit more information the power shell, in that it said 'open unlocked.pdf: Permission denied. based on your success I'm thinking that it has to do with the qpdf creates the file. I'm going to play around with that and will update. thank you so much for your help.

[Laura Creighton]

I think that your problem is that you have Protected Mode enabled.
If you do, you either have to disable that, or write a policy config
file.

https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/protectedmode.html

says.
From: Policy configuration

Protected mode prevents a number of actions which IT can bypass by
creating a white list of allowed actions. The component that reads
these policies is called a “broker.” The broker performs actions based
on those policies, and when an admin provides a properly configured
policy file, the broker can bypass the application’s default
restrictions.

The broker first reads and applies all custom policies prior to
applying the default policies. Since custom policies take precedence,
they are useful for fixing broken workflows, supporting third party
plug-ins, and cases where unsupported machine configurations cause the
Protected Mode to impair required functionality.

Configurable policies have two requirements:

They must reside in the Reader install directory adjacent to
AcroRd32.exe in the install folder. for example: D:\Program
Files (x86)\Adobe\Reader 10.0\Reader\ The name of the policy
file must be ProtectedModeWhitelistConfig.txt.

So, well, I don't have a windows machine. I cannot test this any more
for you, alas.

Laura

[Naftali]

On Friday, June 19, 2015 at 1:25:12 PM UTC-4, Naftali wrote:

Sadly so far it looks like the only answer is to disable protected mode, either generally or on a my app basis, which is the same thing because my app will be registered as the default handler for pdf. So this is a deal breaker. I've even tried routing the opening through a bat file... so either I get this to open up in protected mode or I don't see anyway to make it go, with out using a different reader. But thank you all for your help, will update should I have any success in this.

[Naftali]

On Friday, June 19, 2015 at 1:25:12 PM UTC-4, Naftali wrote:

Well a happy if not completely satisfying ending. So alternative readers worked ok, but IT was ok with turning off protective mode and also disabling javascript in adobe reader, considering the relative benign provenance of the pdf's coming into the system (though I am curious whether or not disabling java script is actually *more* secure than a sandbox, i.e. can a system be harmed by rendering a pdf with no java script?