ExcelPackage with password

Dec 3, 2014 at 6:37 PM
Kind of a long story, bear with me please.

Our application allows the user to download an Excel document as a template to fill in data. This template is protected for structure with a password and was created in Excel 2013.

After filling out the document, the user can upload it, which gives an IHttpHandler implementation an HttpPostedFile. We then construct an ExcelPackage with the InputStream, and off we go...most of the time.

We have a client who only has Excel 2007, and that (apparently) treats protection differently. Attempting to upload a copy of the template they've created gives the exception "Package is an OLE compound document. If this is an encrypted package, please supply the password". We think 2007 is encrypting the contents instead of just protecting the sheet.

Of course, I only have the client's saved version of our template; I don't really know how they got it in this state.

So, we tried just adding our password to the ExcelPackage constructor, thinking this would un-encrypt what 2007 did to the contents, and we could read the document.

Sadly, no. Putting password in the constructor requires the stream to be read/write. So, a couple of questions:
  • Why doesn't the no-password constructor require the stream to be the same way?
  • Is there a way for us to try getting a read-only document with the password?
(Of course, trying the password constructor also fails when I download the template and use 'normally', since the stream isn't read/write).

Poking through the ExcelPackage code, I see where you look for CanRead and CanWrite in the (stream, password) case, but I don't see any path to allow the caller to go read-only. I understand that the constructor cannot know whether the user might eventually do a write with this object, but why not delay that check until the write is attempted?

We were trying to use our password as a test, just to see if we could get their spreadsheet in the system. If it worked, we'd figure out how to use it (I suppose a backup if the no-password constructor failed or something).

We did find that taking the client's version, saving it with 2013, then having them upload that works just fine. We have a workaround, but we'd like to figure out a way to make the process smart enough to not have to do that.

Thanks in advance.
Oct 29, 2015 at 10:04 AM
Hi @speterson,

How did you managed to open you xlsx excel file with a password?
I have an excel file with workbook proetction to password 1q2w3e4r5t (just testing) and a sheet protected with the same password. I then do
using (ExcelPackage pck = new ExcelPackage(file, "1q2w3e4r5t"))
but i get an exception of password invalid. How did you managed to make it work?

I'm using EPPlus v3.1.3.0
Oct 29, 2015 at 3:35 PM
Hi Fabio,

I'm looking at the code that we use to do the upload part I talked about. It appears that we're using some NPOI class to take the file's InputStream.

I don't think this is related to EPPlus; I want to say we moved away from EPPlus. I can't remember where we discovered this NPOI stuff to point you in that direction.
Oct 30, 2015 at 9:32 AM

The only way i managed so far is to not protect the workbook but only protect the sheets :S