Popular label macro fails to render when a non-admin user has access to a large number of spaces on a Confluence instance with Faster Permissions enabled

XMLWordPrintable

    • 3
    • Severity 3 - Minor
    • 23

      Issue Summary

      1. Popular label macro fails to render when a non-admin user has access to more than 2100 spaces on a Confluence instance when using MS SQL Server database and Confluence has Faster Permissions enabled
      2. Popular label macro fails to render when a non-admin user has access to more than 1000 spaces on a Confluence instance when using Oracle database and Confluence has Faster Permissions enabled

      Steps to Reproduce

      1. Deploy Confluence with SQL Server
      2. Create 2105 Spaces via REST API:
        1. Navigate to Confluence Administration » General Configuration » Authentication Methods
          1. Ensure Allow basic authentication on API calls is enabled
        2. Run this Shell script on the Terminal to create the 2105 Spaces
        3.   
          BASE_URL="http://localhost:8090"
AUTH="<USERNAME>:>PASSWORD>"
for i in $(seq 1 2105); do
  key="TEST${i}"
  name="TEST${i}"
  description="TEST${i}"
  curl -u "$AUTH" -X POST -H 'Content-Type: application/json' -d "{\"key\":\"$key\", \"name\":\"$name\", \"type\":\"global\", \"description\":{\"plain\": { \"value\": \"$description\",\"representation\": \"plain\" }}}" "$BASE_URL/rest/api/space" > /dev/null 2> /dev/null
done
      3. In Confluence UI, check in Spaces » Space directory that there are new spaces created
      4. Create a new Confluence page with: Popular Labels macro
        1. Label the page with testlabel
        2. Wait a couple of minutes and check that the published page returns data from the Popular Labels macro
      5. Now, navigate to Confluence Administration » General Configuration » Faster Permissions and ensure Faster Permissions is enabled
      6. Create a new non-admin user called testuser as it can only be reproduced with a non-admin user
      7. Log out of Confluence and re-login as non-admin user testuser
      8. Navigate back to the Confluence page with the popular labels macro

      Expected Results

      Confluence page should load the page successfully with the Popular Labels macro returning data

      Actual Results

      Confluence page fails to render the Popular Labels with this appearing in the UI:
      Please see screenshot attached

      atlassian-confluence.log shows below error :

      2026-07-23 13:49:03,577 WARN [http-nio-29222-exec-7 url: /c9222/spaces/PD/pages/166050/test+page, /c9222/pages/viewpage.action; user: testuser] [hibernate.query.internal.QueryParameterBindingsImpl] expandListValuedParameters HHH000443: Dialect [com.atlassian.confluence.impl.hibernate.dialect.SQLServerDialect] limits the number of elements in an IN predicate to 2100 entries.  However, the given parameter list [permittedSpaceIds] contained 2107 entries, which will likely cause failures to execute the query in the database
 -- page: 166050 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 08eb7305eb79a280 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/166050/test+page
2026-07-23 13:49:03,585 WARN [http-nio-29222-exec-7 url: /c9222/spaces/PD/pages/166050/test+page, /c9222/pages/viewpage.action; user: testuser] [engine.jdbc.spi.SqlExceptionHelper] logExceptions SQL Error: 8003, SQLState: S0001
 -- page: 166050 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 08eb7305eb79a280 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/166050/test+page
2026-07-23 13:49:03,586 ERROR [http-nio-29222-exec-7 url: /c9222/spaces/PD/pages/166050/test+page, /c9222/pages/viewpage.action; user: testuser] [engine.jdbc.spi.SqlExceptionHelper] logExceptions The incoming request has too many parameters. The server supports a maximum of 2100 parameters. Reduce the number of parameters and resend the request.
 -- page: 166050 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 08eb7305eb79a280 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/166050/test+page
2026-07-23 13:49:03,587 ERROR [http-nio-29222-exec-7 url: /c9222/spaces/PD/pages/166050/test+page, /c9222/pages/viewpage.action; user: testuser] [security.denormalisedpermissions.impl.DenormalisedPermissionRouter] getVisibleLabelIds Denormalised permission execution failed for getVisibleLabelIds, label ids set size: 1. Exception: org.hibernate.exception.SQLGrammarException: could not extract ResultSet
 -- page: 166050 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 08eb7305eb79a280 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/166050/test+page
javax.persistence.PersistenceException: org.hibernate.exception.SQLGrammarException: could not extract ResultSet
	at org.hibernate.internal.ExceptionConverterImpl.convert(ExceptionConverterImpl.java:154)
	at org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1626)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.content.dao.DenormLabelDao.findVisibleLabelIds(DenormLabelDao.java:128)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.DenormalisedPermissionServiceImpl.getVisibleLabelIds(DenormalisedPermissionServiceImpl.java:438)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.DenormalisedPermissionOverrideProxyServiceImpl.getVisibleLabelIds(DenormalisedPermissionOverrideProxyServiceImpl.java:83)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.DenormalisedPermissionRouter.getVisibleLabelIds(DenormalisedPermissionRouter.java:205)
..
Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The incoming request has too many parameters. The server supports a maximum of 2100 parameters. Reduce the number of parameters and resend the request.
	at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:270)
	at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(SQLServerStatement.java:1735)
	at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.doExecutePreparedStatement(SQLServerPreparedStatement.java:675)
	at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement$PrepStmtExecCmd.doExecute(SQLServerPreparedStatement.java:594)
	at com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:7745)
	at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:4391)
	at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(SQLServerStatement.java:276)
	at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(SQLServerStatement.java:246)
	at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.executeQuery(SQLServerPreparedStatement.java:509)
	at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeQuery(ProxyPreparedStatement.java:52)
	at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeQuery(HikariProxyPreparedStatement.java)
	at org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.extract(ResultSetReturnImpl.java:57)

      Similar error is seen if using Oracle DB as well : 

      2026-07-23 14:08:36,824 WARN [http-nio-29222-exec-5 url: /c9222/spaces/PD/pages/164720/test+label+page, /c9222/pages/viewpage.action; user: testuser] [hibernate.query.internal.QueryParameterBindingsImpl] expandListValuedParameters HHH000443: Dialect [com.atlassian.confluence.impl.hibernate.dialect.OracleDialect] limits the number of elements in an IN predicate to 1000 entries.  However, the given parameter list [permittedSpaceIds] contained 1007 entries, which will likely cause failures to execute the query in the database
 -- page: 164720 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 43b25fc36428e612 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/164720/test+label+page
2026-07-23 14:08:36,838 WARN [http-nio-29222-exec-5 url: /c9222/spaces/PD/pages/164720/test+label+page, /c9222/pages/viewpage.action; user: testuser] [engine.jdbc.spi.SqlExceptionHelper] logExceptions SQL Error: 1795, SQLState: 42000
 -- page: 164720 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 43b25fc36428e612 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/164720/test+label+page
2026-07-23 14:08:36,838 ERROR [http-nio-29222-exec-5 url: /c9222/spaces/PD/pages/164720/test+label+page, /c9222/pages/viewpage.action; user: testuser] [engine.jdbc.spi.SqlExceptionHelper] logExceptions ORA-01795: maximum number of expressions in a list is 1000\n
 -- page: 164720 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 43b25fc36428e612 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/164720/test+label+page
2026-07-23 14:08:36,840 ERROR [http-nio-29222-exec-5 url: /c9222/spaces/PD/pages/164720/test+label+page, /c9222/pages/viewpage.action; user: testuser] [security.denormalisedpermissions.impl.DenormalisedPermissionRouter] getVisibleLabelIds Denormalised permission execution failed for getVisibleLabelIds, label ids set size: 1. Exception: org.hibernate.exception.SQLGrammarException: could not extract ResultSet
 -- page: 164720 | referer: http://localhost:29222/c9222/spaces/PD/pages/163916/Product+Development | traceId: 43b25fc36428e612 | userName: testuser | action: viewpage | url: /c9222/spaces/PD/pages/164720/test+label+page
javax.persistence.PersistenceException: org.hibernate.exception.SQLGrammarException: could not extract ResultSet
	at org.hibernate.internal.ExceptionConverterImpl.convert(ExceptionConverterImpl.java:154)
	at org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1626)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.content.dao.DenormLabelDao.findVisibleLabelIds(DenormLabelDao.java:128)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.DenormalisedPermissionServiceImpl.getVisibleLabelIds(DenormalisedPermissionServiceImpl.java:438)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.DenormalisedPermissionOverrideProxyServiceImpl.getVisibleLabelIds(DenormalisedPermissionOverrideProxyServiceImpl.java:83)
	at com.atlassian.confluence.security.denormalisedpermissions.impl.DenormalisedPermissionRouter.getVisibleLabelIds(DenormalisedPermissionRouter.java:205)
..
Caused by: java.sql.SQLSyntaxErrorException: ORA-01795: maximum number of expressions in a list is 1000
	at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:509)
	at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:461)
	at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:1104)
	at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:550)
	at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:268)
	at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:655)
	at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:270)
	at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:91)
	at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:807)
	at oracle.jdbc.driver.OracleStatement.executeMaybeDescribe(OracleStatement.java:983)
	at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1168)
	at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3666)
	at oracle.jdbc.driver.T4CPreparedStatement.executeInternal(T4CPreparedStatement.java:1426)
	at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:3713)
	at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeQuery(OraclePreparedStatementWrapper.java:1167)
	at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeQuery(ProxyPreparedStatement.java:52)
	at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeQuery(HikariProxyPreparedStatement.java)
	at org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.extract(ResultSetReturnImpl.java:57)

       

      Workarounds

      1. Please navigate to '<base-url>/admin/darkfeatures.action' and enable dark feature 'confluence.label.nonteam.filter.legacy'. After this, popular label macro will start rendering for non-admin users as well. 

        1. Screenshot 2026-07-23 at 2.58.48 pm.png
          Screenshot 2026-07-23 at 2.58.48 pm.png
          121 kB

              Assignee:
              Prakhar Agarwal
              Reporter:
              Jaskaran Singh
              Votes:
              2 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: