Issue Summary

In Confluence 9.2.13, calling the Gatekeeper endpoint/plugins/gatekeeper-plugin/who-can-view/evaluate.action with a filter parameter that matches a Confluence user who does not have view access to the specified page, while omitting the start and count pagination parameters, returns HTTP 400 Bad Request with the response body / by zero }}and a {{java.lang.ArithmeticException: / by zero in the application log.

When start=0&count=10 is explicitly included in the request alongside the filter parameter in 9.2.13, the endpoint also returns HTTP 200 OK with an empty owners array, confirming the issue is specific to the omission of pagination parameters when the filtered result set is empty.

Steps to Reproduce

1. Set up a Confluence Data Center 9.2.13 instance.
2. Create a test space (e.g. TEST) and a test page within it.
3. Create or identify a Confluence user (e.g. testuser) who does not have view access to the test page.
4. Execute the following request omitting start and count:  

   curl -i -u admin:password \ "https://<CONFLUENCE_URL>/plugins/gatekeeper-plugin/who-can-view/evaluate.action\ ?spaceKey=TEST&pageId=<PAGE_ID>&hideAnonymous=false&ignoreRestrictions=false\ &filter=testuser"  

5. Observe HTTP 400 response with body / by zero.
6. Repeat the same request with start=0&count=10 added: 

   curl -i -u admin:password \ "https://<CONFLUENCE_URL>/plugins/gatekeeper-plugin/who-can-view/evaluate.action\ ?spaceKey=TEST&pageId=<PAGE_ID>&hideAnonymous=false&ignoreRestrictions=false\ &start=0&count=10&filter=testuser"  

7. Observe HTTP 200 OK with {{{{{"totalOwners":0,"owners":[],...{}}}}.}}
8. Repeat steps 4–5 on Confluence 9.2.9 to confirm the regression.

Expected Results

The endpoint should return HTTP 200 OK with an empty owners array when the

1. filtered user has no view access to the page, regardless of whether start }}and {{count are supplied. This is the behaviour observed in Confluence 9.2.9: 

   HTTP/2 200
   Content-Type: application/json
   {"totalOwners":0,"owners":[],"helpLink":"https://docs.atlassian.com/confluence/docs-92/Check+who+can+view+a+page"} 

    

Actual Results

1. The endpoint returns HTTP 400 Bad Request with the following response body and application log entry in Confluence 9.2.13:
   HTTP Response: 

   HTTP/2 400
   Content-Type: text/plain;charset=UTF-8
   / by zero 

   Application log (atlassian-confluence.log): 

   java.lang.ArithmeticException: / by zero
   	at com.atlassian.confluence.plugins.gatekeeper.evaluator.WhoCanViewEvaluator.getUsers(WhoCanViewEvaluator.java:30)
   	at com.atlassian.confluence.plugins.gatekeeper.controllers.WhoCanViewAction.evaluate(WhoCanViewAction.java:111) 

Workaround

• Explicitly include start=0&count=10 (or any non-zero count value) in all requests to the who-can-view/evaluate.action endpoint when using the filter parameter: 

  /plugins/gatekeeper-plugin/who-can-view/evaluate.action
    ?spaceKey=<SPACE_KEY>
    &pageId=<PAGE_ID>
    &hideAnonymous=false
    &ignoreRestrictions=false
    &start=0
    &count=10
    &filter=<USERNAME>