Remove PDF encryption before consumption

[therealshiggins]

I receive payslips as encrypted PDFs and would like to automatically remove the password and import into Paperless. I am okay with the security implications of this.

I have written a pre-consumption script that does this and replaces the original encrypted PDF with a decrypted PDF, however this causes a second import and (harmless) error messages in the logs. It works but is messy and I think it should be considered as a core feature. Or is there is a trick for pre-consumption script to replace an incoming file without causing a second import?

The script works by identifying encrypted PDFs and then attempting to decrypt using a list of pre-saved passwords until one of them works.

[SiM22]

This is something I have been wanting for a while, would you be able to share the script?

[therealshiggins]

Sure: https://gist.github.com/therealshiggins/6857cc80d4b68118285eee71327c5e45

[RobertWalther]

For me it works to replace the file DOCUMENT_WORKING_PATH
https://piep.tech/posts/automatic-password-removal-in-paperless-ngx/

[rajil]

Is there any way to run the consume script on the 'password protected' existing pdfs in paperless-ngx?

[SaschaWeisenberger]

+1 for this. Sometimes the password is important for the "transport" of the document, but in my private space it's OK to have it decrypted. There should be a way to either store the unencrypted file or to store the password (maybe encrypted for the user) and let the user decide whether to run OCR or not.

[SplinterHead]

I've been trying out some document management tools, I just came from Docspell which allows you to define a list of potential passwords to try decrypting with. This might be a good first step into adding document decryption as it should catch the huge use case of pay documents that tend to have the same password

Really looking for a simple way to handle password protected PDFs

[tobse91]

Any chance something like this gets implemented? #1141 (comment)
Or maybe an option to run a specific pre consume script only when a PDF file is encrypted.

My workaround for now is to use qpdf --decrypt --replace-input as pre consumption script, but i dont want every document to be written as a new file in the future.

[roadrunnerjb]

did you try this: https://foosel.net/til/how-to-force-paperless-to-consume-signed-pdfs/
PAPERLESS_OCR_USER_ARGS: '{"invalidate_digital_signatures": true}'

[tobse91]

Tried it, but that doesnt fix my issue: The document gets imported, but because of OCR being impossible, only one version in the "originals" folder is created. The archived one is missing.
The log stays the same:

[paperless.parsing.tesseract] This file is encrypted, OCR is impossible. Using any text present in the original file.

[julianwachholz]

The previous reply is for signed documents, not password protected ones. A document can be both.

The pre consumption script from @RobertWalther works really well for me. (fixed link as their reply has a typo in the URL)