Uploaded image for project: 'Confluence Cloud'
  1. Confluence Cloud
  2. CONFCLOUD-73450

Request Access feature does not notify space administrators as expected

    XMLWordPrintable

Details

    • 1
    • 8
    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

    Description

      NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report.

      Problem summary

      According to https://support.atlassian.com/confluence-cloud/docs/add-or-remove-page-restrictions/, the Request Access feature works by notifying users who are able to grant restriction access to a page, using this logic in order:

      1. The last person to edit the page
      2. All non-admin users that can set permissions on the page (given that an admin user can always set permissions)
      3. The page creator
      4. All the space administrators

      Step 4 is failing. No space admins are notified despite space permission settings. What appears to be happening instead is that a single Confluence superuser (i.e. a member of the "confluence-administrators" group) will be notified. If there are more than one user in this group, the first username on this list, sorted alphabetically, will be sent the request access notification. This user does not need to be in a space administrator for the relevant content. In fact, it doesn't matter who is a space admin on that space, as that configuration does not appear to affect the behavior.

      Steps to reproduce

      1. Set up a Confluence
      2. Create 5 users:
        • UserA
        • UserB
        • UserC
        • SuperX - place this user in confluence-administrators group (superuser)
        • SuperY - place this user in confluence-administrators group (superuser)
      3. Create a space with UserA, so that this user is automatically a space admin
      4. Create a page with UserB within this space
      5. Using SuperX, restrict the page so that only SuperX can view it
      6. Using UserC, try to view the page by going to the page URL directly. The user cannot see it, and will be asked to request access. Click through.

      Expected behavior

      UserA receives the notification, because although he is not the page creator or the last person to edit the page, he is a full space admin and can set page restrictions.

      Actual behavior

      SuperX receives the notification, because he is the first superuser alphabetically.

      Now rename SuperX to SuperZ, and repeat step 6. Observe that now SuperY is the one who receives the notification, since that is the first superuser alphabetically.

      Additional notes

      There are actually two parts this is issue:

      • Space admins are being ignored in the Request Access logic
      • Only one admin is notified, not all, as detailed in the documentation

      Attachments

        Issue Links

          Activity

            People

              66bfe2effd45 Kristen Waters
              rchang Robert Chang
              Votes:
              17 Vote for this issue
              Watchers:
              22 Start watching this issue

              Dates

                Created:
                Updated: