Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-10736

Anonymous users can't remove news / blogs even though there is an explicit permissions allowing them to do so

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Low Low
    • 2.8
    • 2.7.1
    • None

      The Space Permissions user interface contains an "Anonymous -> News -> Remove" permission. This permission can be successfully turned on (unlike the Anonymous -> Pages -> Restrictions" permissions. When this is turned on, Anonymous users gain the ability to click the "Remove" button when editing a blog post.

      However, the RemovePageAction contains specific logic to deny the effort to remove blog posts. The user is taken to the login page instead (with no error message saying why).

      Given that "removing" a blog post actually just sends it to trash, there doesn't seem to be any great harm in allowing anonymous users to be permitted to remove blog posts. (I'm not saying I'd recommend it as a good permission to enable on a public site, just that there's nothing particularly insane about allowing the permission to work correctly.

              agnes@atlassian.com Agnes Ro
              don.willis@atlassian.com Don Willis
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: