-
Bug
-
Resolution: Fixed
-
Low
-
5.1-OD-4, 5.8.5, 5.8.14, 6.15.6, 7.2.1, 7.3.5
-
OnDemand, BTF
-
14
-
Severity 2 - Major
-
11
-
NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.
The Space Admin functionality allows a space to have 'Anonymous Access' allowed and displays the following warning:
WARNING
Anonymous users will not be able to view this space, because they have not been granted the global ‘Use Confluence’ permission. You can grant anonymous access to Confluence from global permissions.
The global permissions of the Confluence environment prevents anonymous users from accessing Confluence.
However, a user that is permissioned to Confluence but does not belong to a group that is currently permissioned to the space is now able to access the space. Examples of this behaviour have been attached.
Removing the anonymous flag from the space will then prevent this user from being able to access the space. You can use the following query to identify spaces with Anonymous permissions enabled:
SELECT spacename,
spacekey
FROM spaces
WHERE spaceid IN (SELECT spaceid
FROM spacepermissions
WHERE permgroupname IS NULL
AND permusername IS NULL);
Cheers,
Paul
- is caused by
-
CONFSERVER-4955 Confluence users should inherit permissions from the anonymous user
- Closed
- is duplicated by
-
-
- Closed
-
- is related to
-
-
- Closed
-
-
- Closed
-
- Gathering Interest
- relates to
-
-
- Closed
-
-
- Gathering Interest
-
PSR-630 Loading...
- mentioned in
-
-
-
-
-
-
-
[CONFSERVER-28946] Anonymous space permission allows non-permissioned groups to access space, when global permissions are set to prevent anonymous access
A fix for this issue is available to Server and Data Center customers in Confluence 7.4.10
Upgrade now or check out the Release Notes to see what other issues are resolved.
A solution has been implemented to eliminate the lack of clarity around this feature by -
1. Displaying a clearer description/message about the feature on the Space permissions screen for the Confluence Admin
2. Displaying a clearer description/message about the feature on the Space tools screen for the space Admin
The description would clearly mention that the "anonymous" permissions apply to "all the logged in users".
In our Confluence Data Center we need to be able to isolate spaces from partners we provide login access to. The site is only accessible from our internal network, so anonymous is unnecessary. We do need to allow a user to create and manage the access permissions themselves, so it is critical for our site security that permissions work as expected. This issue allows someone to unwittingly set anonymous access which then posts the warning that it is not going to work because Global setting overrides it. But, it doesn't alert them to the issue that they've now enabled access to all users unintentionally. This is a serious security flaw. Is there any work around to remove anonymous or disable setting it?
It may be enough to change the wording on the space admin page.
Instead of calling it "Anonymous Access" call it "Global Access" or "General Access".
and/or:
When a user is using Confluence while not logged in, they are using it anonymously. ->
When a user is using Confluence while not logged in or not having any more specific permission assigned, they are using it under global access.
The current behavior:
| Global-level anonymous access | Space-level anonymous access | Result | Working as expected? |
|---|---|---|---|
 Enabled |
Enabled |
Anonymous + all authenticated users can view space |  No, since authenticated users should not be considered "anonymous" |
| Enabled |
Disabled |
Only specific permitted groups/users can view space. Anonymous users cannot view space | Yes |
| Disabled |
Enabled |
All authenticated users can view space. Anonymous users cannot view space | No, since authenticated users should not be considered "anonymous" |
| Disabled |
Disabled |
Only specific permitted groups/users can view space. Anonymous users cannot view space | Yes |
How to potentially clarify this behavior:
- If Anonymous is enabled globally, on the Space Permissions pane it should say "All authenticated + unauthenticated users"
- If Anonymous is disabled globally, on the Space Permissions pane it should say "All authenticated users"
Ed Scharrer
added a comment - Sergey: This applies to BTF/Server instances, too Ed Scharrer
added a comment - I wonder why this has LOW priority, this is a SECURITY issue and should be treated with HIGHEST priority
Ed Scharrer
added a comment - I wonder why this has LOW priority, this is a SECURITY issue and should be treated with HIGHEST priority
A fix for this issue is available to Server and Data Center customers in Confluence 7.13.0
Upgrade now or check out the Release Notes to see what other issues are resolved.