-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
High
-
None
-
Affects Version/s: 10.2.4
-
Component/s: Repository - File Browsing
-
None
-
1
-
Severity 3 - Minor
Issue Summary
When an unauthenticated (anonymous) user or a user without repository permissions browses a public repository, multiple web fragment conditions throw AuthorisationException that gets logged as ERROR. Two distinct web fragments are affected:
- Merge Queue navigation - RepositoryMergeQueueEnabledCondition attempts to evaluate merge queue settings via DefaultMergeQueueSettingsService.validateReadPermissions(), throwing an AuthorisationException logged by DefaultWebInterfaceManager.
- Repository Archived Banner - HasRepositoryArchivePermissionCondition calls DefaultPolicyService.getRepositoryArchivePolicy() via validateForGlobal(), throwing an AuthorisationException logged by WebFragmentSupport.
Both errors are triggered on every page load for the affected repository (e.g., by search engine crawlers like Googlebot), resulting in excessively large log files impacting disk space and log readability.
Steps to Reproduce
- Enable anonymous access or have a public repository accessible to unauthenticated users.
- Access the repository browse page as an anonymous user or via a bot/crawler (e.g., GET /projects/EDELIVERY/repos/eessi-as4.net/browse/... or GET /projects/rproj/repos/publicrepo/browse).
- Observe the atlassian-bitbucket.log file.
Expected Results
The web fragment conditions (RepositoryMergeQueueEnabledCondition and HasRepositoryArchivePermissionCondition) should gracefully handle the case where the user lacks permissions either by checking permissions before attempting to load settings, or by catching the AuthorisationException internally without propagating it to DefaultWebInterfaceManager/WebFragmentSupport. No ERROR-level logging should occur for this expected scenario.
Actual Results
The below exception is thrown in the atlassian-bitbucket.log file:
Error 1 - Merge Queue condition (DefaultWebInterfaceManager):
2026-06-22 13:51:39,528 ERROR [http-nio-7990-exec-5] @1TWIGI0x831x148x0 10.230.0.213,172.50.0.2 "GET /projects/rproj/repos/publicrepo/browse HTTP/1.1" c.a.p.w.i.DefaultWebInterfaceManager Could not evaluate condition 'com.atlassian.plugin.web.conditions.AndCompositeCondition@67b12db7' for descriptor: com.atlassian.bitbucket.server.bitbucket-server-web-fragments:bitbucket.repository.nav.merge.queue (null) com.atlassian.bitbucket.AuthorisationException: You are not permitted to access this resource at com.atlassian.stash.internal.aop.ExceptionRewriteAdvice.afterThrowing(ExceptionRewriteAdvice.java:37) at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService$5.visit(DefaultMergeQueueSettingsService.java:491) at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService$5.visit(DefaultMergeQueueSettingsService.java:475) at com.atlassian.bitbucket.scope.RepositoryScope.accept(RepositoryScope.java:26) at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService.validateReadPermissions(DefaultMergeQueueSettingsService.java:475) at com.atlassian.bitbucket.internal.mergequeue.DefaultMergeQueueSettingsService.getEffectiveSettings(DefaultMergeQueueSettingsService.java:202) at com.atlassian.bitbucket.web.conditions.RepositoryMergeQueueEnabledCondition.shouldDisplay(RepositoryMergeQueueEnabledCondition.java:46) at com.atlassian.plugin.web.conditions.AndCompositeCondition.shouldDisplay(AndCompositeCondition.java:16) at com.atlassian.plugin.web.impl.DefaultWebInterfaceManager.filterFragmentsByCondition(DefaultWebInterfaceManager.java:187)
Error 2 - Repository Archived Banner condition (WebFragmentSupport):
Affected Web Fragments:
- com.atlassian.bitbucket.server.bitbucket-server-web-fragments:bitbucket.repository.nav.merge.queue
- com.atlassian.bitbucket.server.bitbucket-server-web-fragments:repository-archived-banner
Workaround
Configure log filtering in the Bitbucket home directory (<BITBUCKET_HOME>/shared/data/log-properties/) to suppress or reduce the log level for com.atlassian.plugin.web.impl.DefaultWebInterfaceManager and com.atlassian.stash.internal.web.fragments.WebFragmentSupport to avoid excessive disk usage.
If the Merge Queue feature was not unboarded yet as it requires explicit configuration and onboarding before it can be used, you can safely suppress the error by adding the following to your bitbucket.properties file:
feature.merge.queue=false
After making this change, please restart your Bitbucket instance for it to take effect.