This fix also opened another regression: CONF-35884 "great job" guys

Hi qian

Thanks for getting in touch. CONF-30930 is being used to track the regression of this issue as it seems as though not all paths that lead to this issue have been dealt with.

Regards
Steve Haffenden
Confluence Bugmaster
Atlassian

Do we have this issue fixed? The top of this page says fixed in 5.5 but at the end of the comment list it says "This issue is duplicated by CONF-30930" and CONF-30930 remains open.

He! I ended up using a RewriteMap indeed, though with a Perl script that does the escaping. Many thanks for your solution, it's more elegant (and I learned something .

You can do that via RewriteMap

This is our current ruleset:

	# Workaround bug: https://jira.atlassian.com/browse/CONF-29144
	AllowEncodedSlashes On
	RewriteEngine On
	RewriteMap escapeblanks int:escape
	RewriteRule ^/download/attachments/(.*) - [CO=CONF29144:${escapeblanks:$1}:%{HTTP_HOST}:1,L]
	RewriteCond %{QUERY_STRING} notpermitted
	RewriteCond %{HTTP_COOKIE} CONF29144=([^;]+)
	RewriteRule ^/login.action /login.action?os_destination=/download/attachments/%1 [B,P]

Here's my set of rules for Apache:

# Workaround bug: https://jira.atlassian.com/browse/CONF-29144
AllowEncodedSlashes On
RewriteEngine On
RewriteRule ^/download/attachments/.* - [CO=CONF29144:%{REQUEST_URI}:%{HTTP_HOST},L]
RewriteCond %{QUERY_STRING} notpermitted
RewriteCond %{HTTP_COOKIE} CONF29144=([^;]+)
RewriteRule ^/login.action /login.action?os_destination=%1 [B,P]

What this does is set a cookie (aptly named against this bug) to memorize the attachment reference. Then if the notpermitted action is triggered AND this cookie is set, change the os_destination parameter to something that will work after login.

Notes:

• the P in the last line will proxy the redirection straight through Confluence, saving one round-trip, but the URL in the browser won't change (it will still display the "not permitted.action"). Download should start right after login. If you prefer to send the redirection to the browser instead, replace P by R (adds an extra round-trip but shows the final URL in the browser)
• AllowEncodedSlashes works only since Apache 2.2.18
• in the example above, the cookie is a session cookie. Ideally it should be deleted after the download to avoid a potential side-effect (a real "not permitted" action). You might want to set a short duration in minutes after the domain like this (2 min here): [CO=CONF29144:$1:example.com:2,L]

P.S. well, this doesn't seem to work with files that have spaces in their name. Confluence is happy to serve a URL like "/download/attachements/12345678/My File.txt" but if you use it as a parameter to "?os_destination" then you'll get the following error in the logs:

“Redirect request to '/download/attachements/12345678/My File.txt' is not allowed. Will send user to the context root instead.”

Any Apache expert around to tell me if it's possible to get a URI like "My File.txt" transfered as "My%20File.txt" in a cookie (instead of being turned into "My File.txt")?

Maybe a similar solution under Linux - Apache ?

A timing would be very much appreciate to fix this issue because users keep complaing about this very frequently

This is the IIS rewrite rule I ended up using on our server to work around the problem. The regex is a little complicated because the URL is slightly different depending on whether you already have a session cookie - if you don't, Confluence will add ";jessionid=..." to the "notpermitted" URL.

Place this under configuration/system.webServer/rewrite/outboundRules in your web config file (web.config or applicationHost.config).

                <rule name="Fix attachment links when not logged in" preCondition="DownloadAttachmentsRequest" enabled="true" patternSyntax="ECMAScript">
                    <match serverVariable="RESPONSE_LOCATION" pattern="(.*)/login\.action(;jsessionid=.*?)?\?os_destination=%2Fnotpermitted\.action.*" />
                    <action type="Rewrite" value="{R:1}/login.action{R:2}?os_destination={UrlEncode:{HTTP_URL}}" />
                </rule>
                <preConditions>
                    <preCondition name="DownloadAttachmentsRequest" patternSyntax="Wildcard">
                        <add input="{REQUEST_URI}" pattern="/download/attachments/*" />
                    </preCondition>
                </preConditions>

This of course assumes you're already running Confluence behind an IIS reverse proxy and you have the URL Rewrite module installed.

After looking over Gareth's solution, i figured out that you really just need to add this to the start of any link:
http://[servername]/login.action?os_destination=

Original Link:
http://[servername]/download/attachments/[12345678]/[filename]?api=v2

Modified Link:
http://[servername]/login.action?os_destination=http://[servername]/download/attachments/[12345678]/[filename]?api=v2

Also, I believe you still have to use the %2520 modification for attachments with spaces in the filename.

cedric3,

Depending on your browser, you may also need to clear your cache, some browsers, as mentioned by janusz.janowski above, will cache the "not permitted" page even though you are logged in.

I'm aware that this is quite annoying, and as I said, this bug is on our backlog.

Thanks
David Rizzuto
Atlassian