Uploaded image for project: 'Confluence Cloud'
  1. Confluence Cloud
  2. CONFCLOUD-72064

Confluence Space Imports are now Adding users to the site

XMLWordPrintable

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      When importing a space using:

      https://<sitename>.atlassian.net/wiki/admin/importspace/importconfluencespace.action

      Once the import is complete users that have content (page, drafts, likes, comments, etc.) in the space are added to the site and show in the admin.atlassian.com management portal as having site access.

      Previously this was not the case and the users would simply show as unlicensed.

      An option to choose whether or not to import users during the Space Migration would be beneficial.

            [CONFCLOUD-72064] Confluence Space Imports are now Adding users to the site

            EMS Databob added a comment -

            So it took more than two years to close a security issue. Somewhat frightening.

            EMS Databob added a comment - So it took more than two years to close a security issue. Somewhat frightening.
            Rebekkah Dorhout made changes -
            Labels New: RIBS
            Rebekkah Dorhout made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 793739 ]
            Giuliano C. made changes -
            Link New: This issue has a derivative of CONFCLOUD-75236 [ CONFCLOUD-75236 ]
            Steven Bao made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Gathering Interest [ 11772 ] New: Closed [ 6 ]

            Steven Bao added a comment - - edited

            Hey everyone, this should not be happening for either XML or CSV space imports from cloud to cloud.

            For space imports from server to cloud, we need to create the user in the userbase if they do not have an Atlassian account. They do not get product access however.

            Steven Bao added a comment - - edited Hey everyone, this should not be happening for either XML or CSV space imports from cloud to cloud. For space imports from server to cloud, we need to create the user in the userbase if they do not have an Atlassian account. They do not get product access however.
            Steven Bao made changes -
            Assignee New: Steven Bao [ sbao ]

            Steve Luebbe added a comment -

            This shouldn't be enabled by default. In testing a migration of content between sites it just sent out 50 invites to users that shouldn't have access to this test instance. 

            Steve Luebbe added a comment - This shouldn't be enabled by default. In testing a migration of content between sites it just sent out 50 invites to users that shouldn't have access to this test instance. 

            Charles Blaxland added a comment - - edited

            I'll add my voice to the chorus of disapproval here. A recent Confluence space import in our instance resulted in 80 or so unauthorised users being automatically created in our directory and invited to our instance. These users then even showed up in our user pickers for Jira tickets! I'd have thought this is a pretty major security issue and as such a high priority fix.

            Edit: in addition to the security issues this thread rightly points out possible legal issues with GDPR, as the imported users contain email addresses and profile pictures. Please fix!

            Charles Blaxland added a comment - - edited I'll add my voice to the chorus of disapproval here. A recent Confluence space import in our instance resulted in 80 or so unauthorised users being automatically created in our directory and invited to our instance. These users then even showed up in our user pickers for Jira tickets! I'd have thought this is a pretty major security issue and as such a high priority fix. Edit: in addition to the security issues this thread rightly points out possible legal issues with GDPR, as the imported users contain email addresses and profile pictures. Please fix!
            Giuliano C. made changes -
            Link New: This issue relates to CONFCLOUD-75236 [ CONFCLOUD-75236 ]

              sbao Steven Bao
              gprosper@atlassian.com Gerson P.
              Votes:
              50 Vote for this issue
              Watchers:
              55 Start watching this issue

                Created:
                Updated:
                Resolved: