Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-25213

Customers report that the recommended updates email goes to ALL LDAP users whether logged in or not

      Two customers have reported that the new recommended updates email in Confluence 4.2 goes to ALL LDAP users whether logged in or not.

      See comments on this documentation page: http://confluence.atlassian.com/display/DOC/Configuring+the+Recommended+Updates+Email+Notification

      Please investigate.

            [CONFSERVER-25213] Customers report that the recommended updates email goes to ALL LDAP users whether logged in or not

            This is not fixed in 4.3.

            Upgraded to 4.3, forgot to uncheck the "send by default" flag in the bustle of upgrading, and now the entire company has been spammed (we authenticate with LDAP). The support tickets have already begun coming in, wondering what's going on. Can this flag please be unchecked by default?

            The problem is exacerbated by the bug whereby users receive the recommended updates email even though "subscribe to recommended updates" is not checked in their individual settings.

            Can anyone verify that the "send by default" checkbox actually disables recommended updates in 4.3, or should I turn off the entire plugin to be safe?

            -chris

            Chris Walquist added a comment - This is not fixed in 4.3. Upgraded to 4.3, forgot to uncheck the "send by default" flag in the bustle of upgrading, and now the entire company has been spammed (we authenticate with LDAP). The support tickets have already begun coming in, wondering what's going on. Can this flag please be unchecked by default? The problem is exacerbated by the bug whereby users receive the recommended updates email even though "subscribe to recommended updates" is not checked in their individual settings. Can anyone verify that the "send by default" checkbox actually disables recommended updates in 4.3, or should I turn off the entire plugin to be safe? -chris

            lenzman no, I haven't addressed CONF-5794 probably best to comment on that issue if you are being effected, disabled users will not receive the recommended updates email.

            Steve Lancashire (Inactive) added a comment - lenzman no, I haven't addressed CONF-5794 probably best to comment on that issue if you are being effected, disabled users will not receive the recommended updates email.

            @Steven Lancashire: does it mean CONF-5794 is fixed as well?

            Michael Stelzner [Communardo] added a comment - @Steven Lancashire: does it mean CONF-5794 is fixed as well?

            Hi all. This document should help.

            Please be aware that this system is our public bug tracker. It should be used to track problems in the core code of the application, that need to be fixed by a developer at a code level, and released in a new version of the software. We do not monitor this site for customer requests, so you will likely not receive timely responses here. Any other requests for information, assistance, or configuration issues should be made through https://support.atlassian.com, these go directly to our Support team and will get you the help you need in a much shorter timeframe.

            Kind regards,
            Denise
            Atlassian Support, Sydney

            Denise Unterwurzacher [Atlassian] (Inactive) added a comment - Hi all. This document should help. Please be aware that this system is our public bug tracker. It should be used to track problems in the core code of the application, that need to be fixed by a developer at a code level, and released in a new version of the software. We do not monitor this site for customer requests, so you will likely not receive timely responses here. Any other requests for information, assistance, or configuration issues should be made through https://support.atlassian.com , these go directly to our Support team and will get you the help you need in a much shorter timeframe. Kind regards, Denise Atlassian Support, Sydney

            Exactly, William. I added comment to that issue too.

            Aleksandr Yatskin added a comment - Exactly, William. I added comment to that issue too.

            @Aleksandr Yatskin Take a look at CONF-25780 , is that what you meant?

            William Schneider added a comment - @Aleksandr Yatskin Take a look at CONF-25780 , is that what you meant?

            Hi All.
            I have another question.
            How disable "Recommended update" for all user so that those people who want to recieve notifications can to enable it manually?

            Aleksandr Yatskin added a comment - Hi All. I have another question. How disable "Recommended update" for all user so that those people who want to recieve notifications can to enable it manually?

            Steven, if you handle this question in a separate ticket, please provide a reference on this thread. We were bitten by the LDAP mass-email bug during the 4.0 upgrade, and are waiting for confirmation from the community that this issue is resolved before we upgrade again.

            Thanks!
            -chris

            Chris Walquist added a comment - Steven, if you handle this question in a separate ticket, please provide a reference on this thread. We were bitten by the LDAP mass-email bug during the 4.0 upgrade, and are waiting for confirmation from the community that this issue is resolved before we upgrade again. Thanks! -chris

            Hi Steven,
            I checked this function in confluence 4.2.7 and 4.2.8, it not work for both versions.

            Aleksandr Yatskin added a comment - Hi Steven, I checked this function in confluence 4.2.7 and 4.2.8, it not work for both versions.

            Hi Aleksandr, If you want to raise a support ticket or seperate bug report, I can have a look at it, please include the version of confluence you are running.

            Steve Lancashire (Inactive) added a comment - Hi Aleksandr, If you want to raise a support ticket or seperate bug report, I can have a look at it, please include the version of confluence you are running.

            Hi Steven,
            I checked this function for test users.
            Recommended updates stop to receive when I click “Stop receiving these messages” in email.
            But if I disable option “Subscribe to recommended updates” in user profile notifications come anyway.
            Is it possible to fix this bug?

            Aleksandr Yatskin added a comment - Hi Steven, I checked this function for test users. Recommended updates stop to receive when I click “Stop receiving these messages” in email. But if I disable option “Subscribe to recommended updates” in user profile notifications come anyway. Is it possible to fix this bug?

            Hi Aleksandr,
            Is it possible that you have multiple accounts with the same email address? Try clicking unsubscribe link at the base of the email, this will disable it for the user the email was sent to.

            Steve Lancashire (Inactive) added a comment - Hi Aleksandr, Is it possible that you have multiple accounts with the same email address? Try clicking unsubscribe link at the base of the email, this will disable it for the user the email was sent to.

            Sorry, Denise. I checked it again. It is worked OK. Users not logged in confluence don’t receive recommended updates.
            But if I disable option “Subscribe to recommended updates” in my profile I anyway get notifications.
            Is there any solution for this problem?

            Aleksandr Yatskin added a comment - Sorry, Denise. I checked it again. It is worked OK. Users not logged in confluence don’t receive recommended updates. But if I disable option “Subscribe to recommended updates” in my profile I anyway get notifications. Is there any solution for this problem?

            Hi Everyone. In the linked ticket CONF-25572, there was a regression of this issue, which was fixed in 4.2.5. I have updated the fix version in this ticket accordingly.

            Aleksandr, we don't expect that this behaviour would still be happening in 4.2.7, so I am going to open a ticket in our support system (https://support.atlassian.com), so we can look into your issue. You'll receive details, and a login to the system if you don't already have one, shortly. Could you also please confirm your email address is correct?

            Kind regards,
            Denise
            Atlassian Support - Sydney

            Denise Unterwurzacher [Atlassian] (Inactive) added a comment - - edited Hi Everyone. In the linked ticket CONF-25572 , there was a regression of this issue, which was fixed in 4.2.5. I have updated the fix version in this ticket accordingly. Aleksandr, we don't expect that this behaviour would still be happening in 4.2.7, so I am going to open a ticket in our support system ( https://support.atlassian.com ), so we can look into your issue. You'll receive details, and a login to the system if you don't already have one, shortly. Could you also please confirm your email address is correct? Kind regards, Denise Atlassian Support - Sydney

            In confluence v.4.2.7 this problem is still relevant. Would this issue resolved?

            Aleksandr Yatskin added a comment - In confluence v.4.2.7 this problem is still relevant. Would this issue resolved?

            Andrey added a comment -

            Steven Lancashire [Atlassian] added a comment - 29/May/12 6:45 PM
            Yes, Michael, 4.2.3 fixes this situation.

            I upgraded confluence to 4.2.3 but all ldap users get emails even they did not sign for them. As a workaround ,I disable the Confluence daily summary email plugin. But how to fix the problem?

            Andrey added a comment - Steven Lancashire [Atlassian] added a comment - 29/May/12 6:45 PM Yes, Michael, 4.2.3 fixes this situation. I upgraded confluence to 4.2.3 but all ldap users get emails even they did not sign for them. As a workaround ,I disable the Confluence daily summary email plugin. But how to fix the problem?

            Stuart Uren added a comment - - edited

            I upgraded a test copy of Confluence 3.2.1 -> 3.5.13 -> 4.2.4 earlier this week. I created a blog post on Wednesday afternoon which was then emailed out to our user base (~70 users) yesterday at 1pm. We use LDAP, and no one had logged in to Confluence except myself. BTW, we use OpenLDAP.

            Can I suggest in future that any new features that might mass email be set off by default. It certainly saves a lot of embarrassment. Thank goodness we don't have thousands of users.

            Stuart Uren added a comment - - edited I upgraded a test copy of Confluence 3.2.1 -> 3.5.13 -> 4.2.4 earlier this week. I created a blog post on Wednesday afternoon which was then emailed out to our user base (~70 users) yesterday at 1pm. We use LDAP, and no one had logged in to Confluence except myself. BTW, we use OpenLDAP. Can I suggest in future that any new features that might mass email be set off by default. It certainly saves a lot of embarrassment. Thank goodness we don't have thousands of users.

            Yes, Michael, 4.2.3 fixes this situation.

            Steve Lancashire (Inactive) added a comment - Yes, Michael, 4.2.3 fixes this situation.

            We are on 4.2.2 and the daily summary is sent to disabled users.
            Does the bug fix also handle this situation?

            Michael Stelzner [Communardo] added a comment - We are on 4.2.2 and the daily summary is sent to disabled users. Does the bug fix also handle this situation?

            Re-Tested this, was able to replicate the issue, it seems to occur when ldap groups are given permission in confluence and everyone in that group was being sent an email, re-tested with Steves patch and was not getting notifications for the users who had ever logged in and had activity within confluence.

            Glenn Martin (Inactive) added a comment - Re-Tested this, was able to replicate the issue, it seems to occur when ldap groups are given permission in confluence and everyone in that group was being sent an email, re-tested with Steves patch and was not getting notifications for the users who had ever logged in and had activity within confluence.

            As per the comments above, this issue appears to still be happening after upgrading to 4.2.2, so I am reopening this ticket for investigation.

            Denise Unterwurzacher [Atlassian] (Inactive) added a comment - As per the comments above, this issue appears to still be happening after upgrading to 4.2.2, so I am reopening this ticket for investigation.

            Steve added a comment -

            I cloned this issue https://jira.atlassian.com/browse/CONF-25467 as I couldn't re-open the one I commented on.

            Steve added a comment - I cloned this issue https://jira.atlassian.com/browse/CONF-25467 as I couldn't re-open the one I commented on.

            Steve's comment has me worried. I've disabled this plug-in. I'd like to get some additional confirmation that our LDAP users are not going to get spammed again after I upgrade.

            Chad Barnes added a comment - Steve's comment has me worried. I've disabled this plug-in. I'd like to get some additional confirmation that our LDAP users are not going to get spammed again after I upgrade.

            Steve added a comment -

            This issue does not appear to be fixed. I upgraded yesterday and today 08/10/2012 at 1pm users that have never logged into confluence were receiving recommended updates emails. These users only exist in AD and do not use any of our Atlasssian apps. This plugin should ship "OFF" by default.

            Confluence 4.2.2

            Steve added a comment - This issue does not appear to be fixed. I upgraded yesterday and today 08/10/2012 at 1pm users that have never logged into confluence were receiving recommended updates emails. These users only exist in AD and do not use any of our Atlasssian apps. This plugin should ship "OFF" by default. Confluence 4.2.2

            Brett Ryan added a comment -

            Not entirely, it was someone that clicked the "like" button that triggered the mass email for us to all employees in the company.

            Brett Ryan added a comment - Not entirely, it was someone that clicked the "like" button that triggered the mass email for us to all employees in the company.

            Hi Brett,
            By default the recommended updates email sends one email once a week definitely not after each like.

            The like notifications are restricted to watchers of a page and a users followers, and are only sent to followers who have network notifications turned on, and this is an existing opt-in setting.

            I hope that clarifies things?

            Steve

            Steve Lancashire (Inactive) added a comment - Hi Brett, By default the recommended updates email sends one email once a week definitely not after each like. The like notifications are restricted to watchers of a page and a users followers, and are only sent to followers who have network notifications turned on, and this is an existing opt-in setting. I hope that clarifies things? Steve

            Brett Ryan added a comment -

            That's pretty nasty! The reason I say that is because we are periodically evaluating 4.2 (not yet upgraded) by running on a test system. If someone on that test system clicks the "like" button it will then email 450 unsuspecting users on our system if during the upgrade process we "forgot" to go into the admin section and un-tick "Send by default".

            I have a feeling I might not be alone when saying this should be reversed and the recommended updates should be an opt-in affair or localised to a network, heck, the emails produced would end up spamming everyone if people start liking everything.

            Brett Ryan added a comment - That's pretty nasty! The reason I say that is because we are periodically evaluating 4.2 (not yet upgraded) by running on a test system. If someone on that test system clicks the "like" button it will then email 450 unsuspecting users on our system if during the upgrade process we "forgot" to go into the admin section and un-tick "Send by default". I have a feeling I might not be alone when saying this should be reversed and the recommended updates should be an opt-in affair or localised to a network, heck, the emails produced would end up spamming everyone if people start liking everything.

            Hi Brett,
            If you are using LDAP, by default the email is sent to all user that have confluence use permission and have logged into confluence before. Users can opt out of the email via the link in the email or from their confluence email settings. Admins can change the default behavior from the Recommended Updates Email administration section so that it is opt in rather than opt out.

            Whilst content from a particular person you are following is given a higher rank, it is not restricted to content from within a users network.

            Steve Lancashire (Inactive) added a comment - Hi Brett, If you are using LDAP, by default the email is sent to all user that have confluence use permission and have logged into confluence before. Users can opt out of the email via the link in the email or from their confluence email settings. Admins can change the default behavior from the Recommended Updates Email administration section so that it is opt in rather than opt out. Whilst content from a particular person you are following is given a higher rank, it is not restricted to content from within a users network.

            Brett Ryan added a comment -

            gmartin, can you confirm that this also only sends emails to those that are following the particular person or does it send to everyone that has logged into confluence?

            Brett Ryan added a comment - gmartin , can you confirm that this also only sends emails to those that are following the particular person or does it send to everyone that has logged into confluence?

            QA'ed this and was able to verify that the recommended update emails only get sent to the users who have logged in to confluence previously.

            Testing involed: setting up Active Directory, add several users in AD account with same email address, enabled AD in Confluence instance, all users show up on user list from LDAP, only use 2 users to actually log into Confluence, added content and generated the email, other users with my email address did not get the update.

            Glenn Martin (Inactive) added a comment - QA'ed this and was able to verify that the recommended update emails only get sent to the users who have logged in to confluence previously. Testing involed: setting up Active Directory, add several users in AD account with same email address, enabled AD in Confluence instance, all users show up on user list from LDAP, only use 2 users to actually log into Confluence, added content and generated the email, other users with my email address did not get the update.

            This issue is currently in technical review and should make it into 4.2.2. We will update the fix version once 4.2.2 is built.

            Steve Lancashire (Inactive) added a comment - This issue is currently in technical review and should make it into 4.2.2. We will update the fix version once 4.2.2 is built.

            Deleted Account (Inactive) added a comment - We were also affected by this, and have disabled the plugin per http://confluence.atlassian.com/display/DOC/Configuring+the+Recommended+Updates+Email+Notification#ConfiguringtheRecommendedUpdatesEmailNotification-DisablingtheRecommendedUpdatesnotificationfortheentiresite Please update this bug and confirm if this fix makes it into 4.2.2

            I've experienced exactly the same issue on a test upgrade to a development/staging instance of Confluence. Some not very happy people here.

            If I still get the go ahead to upgrade our main production instance I will be sure to turn this feature off as soon as the server starts up as there seems to be a delay between the upgrade being completed and the email being sent out.

            I highly doubt I will be turning this "feature" back on.

            Deleted Account (Inactive) added a comment - I've experienced exactly the same issue on a test upgrade to a development/staging instance of Confluence. Some not very happy people here. If I still get the go ahead to upgrade our main production instance I will be sure to turn this feature off as soon as the server starts up as there seems to be a delay between the upgrade being completed and the email being sent out. I highly doubt I will be turning this "feature" back on.

            We had the same issue in our organization. We have a Dev environment running Confluence 4.2 to test new features amongst a small team of 10 before we upgrade. The "Recommended Updates" email went out to 8,000 LDAP users and support calls started streaming in.

            I've since disabled the plugin, but it did cause some confusion initially.

            Adam Saint-Prix added a comment - We had the same issue in our organization. We have a Dev environment running Confluence 4.2 to test new features amongst a small team of 10 before we upgrade. The "Recommended Updates" email went out to 8,000 LDAP users and support calls started streaming in. I've since disabled the plugin, but it did cause some confusion initially.

            We had the same problem.

            Steve Gerstner [bridgingIT] added a comment - We had the same problem.

            My apologies, this is indeed an issue and we are working to fix it in 4.2.2. The email should not be sending to all LDAP users, just those that have logged in. For now can I suggest you disable sending of the email until this issue is resolved. This can be done via the Recommended Updates Email menu in the admin section.

            Stefan, the recommended updates should not continue to send after restarting the server, but you should also disable it to prevent it from happening the following week.

            Steve Lancashire (Inactive) added a comment - My apologies, this is indeed an issue and we are working to fix it in 4.2.2. The email should not be sending to all LDAP users, just those that have logged in. For now can I suggest you disable sending of the email until this issue is resolved. This can be done via the Recommended Updates Email menu in the admin section. Stefan, the recommended updates should not continue to send after restarting the server, but you should also disable it to prevent it from happening the following week.

            Brett Ryan added a comment -

            We have just experienced this. We are trailing a new confluence site with 4.2, suddenly the recommended updates went to all employees causing widespread confusion.

            We have a lot of users who will not be permitted 'confluence-users' access to confluence who also received this email, thus we are now dealing with a lot of support calls from some very confused people.

            Brett Ryan added a comment - We have just experienced this. We are trailing a new confluence site with 4.2, suddenly the recommended updates went to all employees causing widespread confusion. We have a lot of users who will not be permitted 'confluence-users' access to confluence who also received this email, thus we are now dealing with a lot of support calls from some very confused people.

            A test server were we tried the update to 4.2 has sent more than 5000 mails to all adresses Confluence was able to find. We shutted down the server to stop mailing. Would the mail sending process continue if we start the server again?

            Stefan Jaeger added a comment - A test server were we tried the update to 4.2 has sent more than 5000 mails to all adresses Confluence was able to find. We shutted down the server to stop mailing. Would the mail sending process continue if we start the server again?

              slancashire Steve Lancashire (Inactive)
              smaddox SarahA
              Affected customers:
              16 This affects my team
              Watchers:
              32 Start watching this issue

                Created:
                Updated:
                Resolved: