-
Bug
-
Resolution: Fixed
-
Medium
-
5.6, 5.7, 5.8, 5.9.1, 5.8.10, 5.9.10, 5.8.13, 5.8.14, 5.9.12
-
42
-
Severity 2 - Major
-
In Confluence 5.6.x, member of "confluence-administrators" group can click "Edit" button and start editing the page. They receive a "Not Permitted" page when "Save" button is clicked.
If the "Close" button is clicked instead (to exit the editor without saving), a blank page will be returned instead.
Steps to replicate
- Make User B as the member of confluence-administrators group
- User A creates a page and applies a restriction to a specific group
- User B is Not a member of that group but Is a Space Administrator for the space
- User B goes to the page and the edit function is enabled
- User B Clicks Edit and starts to make changes
- User B finishes making changes to the page and clicks Save (which is enabled)
- User B gets the message "You are not permitted to perform this operation"
Other Steps to replicate
- Make User A as the member of confluence-administrators group
- User A creates a space and makes User B the only Space Administrator
- User A goes to the page and the edit function is enabled
- User A Clicks Edit and starts to make changes
- User A finishes making changes to the page and clicks Save (which is enabled)
- User A gets the message "You are not permitted to perform this operation"
- User A gets blank page below main Confluence top navigation bar when clicking Close after entering editor.
Workarounds
There are a few workarounds to this, and reasons why we don't see this bug as critical:
- Most importantly, Atlassian recommends not using your administration account for regular use of Confluence. Create separate admin and user accounts instead.
- Use your admin powers to grant yourself permission to edit the page (at space and page level as required), then edit the page again.
- Use the back button to get back to your changes and copy/paste them for saving as a user that is explicitly permitted to edit the page. (If the back button doesn't work in your scenario, please raise a ticket with steps to reproduce - we'd like to fix this.)
- Until CONF-4616 is fixed, grant administrators "System Administration" permission but do not put them in the "confluence-administrators" group if you do not wish them to have access to all content in your system. (This is in relation to the original bug.)
- causes
-
CONFSERVER-55006 Members of confluence-administrators group cannot edit pages unless given explicit permission
- Gathering Impact
- is duplicated by
-
CONFSERVER-31330 confluence-administrators permission shows page edit button but does not allow page edit
- Closed
-
CONFSERVER-34714 Page restricted to one admin in unable to be edited by another admin
- Closed
- is related to
-
CONFSERVER-26973 Plugins can change a page when restrictions should prevent editing (for users who are admins, but don't currently have elevated permissions)
- Closed
- relates to
-
CONFSERVER-45327 Members of the confluence-administrators group are able to edit pages they do not have permission to
- Closed
-
CONFSERVER-31330 confluence-administrators permission shows page edit button but does not allow page edit
- Closed
-
CONFSERVER-34714 Page restricted to one admin in unable to be edited by another admin
- Closed
-
CONFSERVER-38943 Blank page when members of confluence-administrators exit from the editor in a restricted pages
- Closed
-
CONFSERVER-39774 Clicking close after attempting to edit a restricted page you do not have editing rights on results in a blank page
- Closed
-
CONFSERVER-43965 Cannot go direct to page edit link with user belong to confluence-administrator
- Gathering Impact
-
CONFSERVER-39756 Remove EDIT button if administrator doesn't have permissions to edit pages
- Gathering Impact
-
CONFSERVER-4616 Remove/rework special privileges of confluence-administrators ("superuser") group
- Gathering Interest