Generate password protected PDF with DOMPDF

Problem/Motivation

We need to protect our PDFs with user/owner password so the final user can't edit/modify the PDF.

Searching DOMPDF documentation is possible to do it:

After you have rendered the document you can set restrictions on it using the Cpdf library. In 0.7.0, after calling the render method call the following:

$dompdf->getCanvas()->get_cpdf()->setEncryption('', 'ownerpass', array());

The parameters of setEncryption are:

paramter type - description

1. string - user password (restrictions apply)
2. string - owner password (unlocks document)
3. array - strings indicating allowed actions when user password is supplied (e.g. print, copy). If the array is empty the user is limited to saving the document.

Example:

$dompdf->getCanvas() ->get_cpdf() ->setEncryption(1234, 5678, ['print', 'modify', 'copy', 'add']);

Steps to reproduce

Now all PDF are generated without password protection.

Proposed resolution

Apply the attached patch that:
- Creates a new configuration values only for DOMPDF engine
- Allows administer to add a user/owner pass and permissions. If you leave them empty no password is applied.

Remaining tasks

Simply other users test and code standarization. It is working for us.

User interface changes

New config parameters. If you leave them empty no password is applied.

API changes

None

Data model changes

New config parameters added in this patch:

diff --git a/config/schema/entity_print.schema.yml b/config/schema/entity_print.schema.yml
index 2340dec..8916ff1 100644
--- a/config/schema/entity_print.schema.yml
+++ b/config/schema/entity_print.schema.yml
@@ -49,6 +49,24 @@ entity_print_print_engine.dompdf:
   type: entity_print_engine_pdf
   label: 'Dompdf specific settings'
   mapping:
+    pdf_user_pass:
+      type: string
+      label: 'PDF User pass'
+    pdf_owner_pass:
+      type: string
+      label: 'PDF Owner pass'
+    pdf_permission_print:
+      type: boolean
+      label: 'Enable print PDF permission'
+    pdf_permission_modify:
+      type: boolean
+      label: 'Enable modify PDF permission'
+    pdf_permission_copy:
+      type: boolean
+      label: 'Enable copy PDF permission'
+    pdf_permission_add:
+      type: boolean
+      label: 'Enable add PDF permission'
     enable_html5_parser:
       type: boolean
       label: 'Enable HTML5 parsing'
diff --git a/src/Plugin/EntityPrint/PrintEngine/DomPdf.php b/src/Plugin/EntityPrint/PrintEngine/DomPdf.php
index a6d6db8..12cdeaa 100644
--- a/src/Plugin/EntityPrint/PrintEngine/DomPdf.php
+++ b/src/Plugin/EntityPrint/PrintEngine/DomPdf.php
@@ -119,6 +119,12 @@ class DomPdf extends PdfEngineBase implements ContainerFactoryPluginInterface {
    */
   public function defaultConfiguration() {
     return parent::defaultConfiguration() + [
+      'pdf_user_pass' => '',
+      'pdf_owner_pass' => '',
+      'pdf_permission_print' => TRUE,
+      'pdf_permission_modify' => TRUE,
+      'pdf_permission_copy' => TRUE,
+      'pdf_permission_add' => TRUE,
       'enable_html5_parser' => TRUE,
       'disable_log' => FALSE,
       'enable_remote' => TRUE,
@@ -135,6 +141,42 @@ class DomPdf extends PdfEngineBase implements ContainerFactoryPluginInterface {
    */
   public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
     $form = parent::buildConfigurationForm($form, $form_state);
+    $form['pdf_user_pass'] = [
+      '#title' => $this->t('PDF user password'),
+      '#type' => 'password',
+      '#default_value' => $this->configuration['pdf_user_pass'],
+      '#description' => $this->t("Password to open the PDF file. If you leave it empty no password neither permissions is applied."),
+    ];
+    $form['pdf_owner_pass'] = [
+      '#title' => $this->t('PDF owner password'),
+      '#type' => 'password',
+      '#default_value' => $this->configuration['pdf_owner_pass'],
+      '#description' => $this->t("PDF owner password to edit the file. If you leave it empty no password is applied."),
+    ];
+    $form['pdf_permission_print'] = [
+      '#title' => $this->t('Enable print PDF permission'),
+      '#type' => 'checkbox',
+      '#default_value' => $this->configuration['pdf_permission_print'],
+      '#description' => $this->t("Allows user to print PDF."),
+    ];
+    $form['pdf_permission_modify'] = [
+      '#title' => $this->t('Enable modify PDF permission'),
+      '#type' => 'checkbox',
+      '#default_value' => $this->configuration['pdf_permission_modify'],
+      '#description' => $this->t("Allows user to modify PDF."),
+    ];
+    $form['pdf_permission_copy'] = [
+      '#title' => $this->t('Enable copy PDF permission'),
+      '#type' => 'checkbox',
+      '#default_value' => $this->configuration['pdf_permission_copy'],
+      '#description' => $this->t("Allows user to copy PDF."),
+    ];
+    $form['pdf_permission_add'] = [
+      '#title' => $this->t('Enable add PDF permission'),
+      '#type' => 'checkbox',
+      '#default_value' => $this->configuration['pdf_permission_add'],
+      '#description' => $this->t("Allows user to add PDF."),
+    ];  
     $form['enable_html5_parser'] = [
       '#title' => $this->t('Enable HTML5 Parser'),
       '#type' => 'checkbox',
@@ -238,8 +280,24 @@ class DomPdf extends PdfEngineBase implements ContainerFactoryPluginInterface {
     $this->setupHttpContext();
 
     if (!$this->hasRendered) {
+      $pdf_permissions=array();
+      if ($this->configuration['pdf_permission_print']) {
+        array_push($pdf_permissions, 'print');
+      }
+      if ($this->configuration['pdf_permission_modify']) {
+        array_push($pdf_permissions, 'modify');
+      }
+      if ($this->configuration['pdf_permission_copy']) {
+        array_push($pdf_permissions, 'copy');
+      }
+      if ($this->configuration['pdf_permission_add']) {
+        array_push($pdf_permissions, 'add');
+      }
+      $pdf_user_pass_permission=$this->configuration['pdf_user_pass'];
+      $pdf_owner_pass_permission=$this->configuration['pdf_owner_pass'];
       try {
         $this->dompdf->render();
+        $this->dompdf->getCanvas()->get_cpdf()->setEncryption($pdf_user_pass_permission,$pdf_owner_pass_permission,$pdf_permissions);
         $this->hasRendered = TRUE;
       }
       catch (DompdfLibException $e) {