Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-43671

As a Confluence administrator I would like to disable the 'Show Changed Content' to all users

    • Icon: Suggestion Suggestion
    • Resolution: Unresolved
    • None
    • None
    • 14
    • 20
    • We collect Confluence feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion.

      Problem Definition

      By default, the Show Changed Content functionality is enabled to all users as described in the product documentation: Email Notifications.

      This functionality may overload the Confluence server and/or the email infrastructure if many changes in pages occur at the same time.

      Currently, there's no way for the Confluence administrator to disable this functionality to all users.

      Suggested Solution

      Make it possible to disable/enable this feature site-wide or to make it disabled by default to new users.

      Workaround

      The following KB describes a workaround to disable this functionality to all existing users in the database.
      How to disable Show Changed Content to all users

            [CONFSERVER-43671] As a Confluence administrator I would like to disable the 'Show Changed Content' to all users

            m4nu3l14 added a comment -

            In some environments, Confluence can contain restricted data, which by security policy is not allowed to end up in an email.  Thus we currently have to disable ALL emails from Confluence and Jira which drastically limits our collaborative experience.  Therefore this feature is necessary for us to be able to work with emails notifications. Please prioritize. 

            m4nu3l14 added a comment - In some environments, Confluence can contain restricted data, which by security policy is not allowed to end up in an email.  Thus we currently have to disable ALL emails from Confluence and Jira which drastically limits our collaborative experience.  Therefore this feature is necessary for us to be able to work with emails notifications. Please prioritize. 

            We also need this feature to fulfill a security requirement.

            Please prioritize.

            Steffen Becker added a comment - We also need this feature to fulfill a security requirement. Please prioritize.

            Rigoberto added a comment -

            Bump

            Rigoberto added a comment - Bump

            We use spaces to maintain sensitive system functional information that should NEVER NEVER leave confluence. When we found that if a user selects email notification: 'Show Changed Content' allows information be copied to an email and sent out, we were quite alarmed and upset.    

            Its very important that this be a Space Admin over ride option.  It is the Space Admin who should have right to lock down the information from being emailed out where the email could be accidently forwarded.

              

            Keith Sottung added a comment - We use spaces to maintain sensitive system functional information that should NEVER NEVER leave confluence. When we found that if a user selects email notification: 'Show Changed Content' allows information be copied to an email and sent out, we were quite alarmed and upset.      Its very important that this be a Space Admin over ride option.  It is the Space Admin who should have right to lock down the information from being emailed out where the email could be accidently forwarded.   

            Disabling this is very important for sites that have sensitive information

             

             

            Joe Johnstone added a comment - Disabling this is very important for sites that have sensitive information    

            I think this is a really important issue. 
            1000s of companies use confluence.
            1000s of pages of sensitive data that are thus being sent via email everyday.
            It feels very insecure.

            John Winstanley added a comment - I think this is a really important issue.  1000s of companies use confluence. 1000s of pages of sensitive data that are thus being sent via email everyday. It feels very insecure.

            Chris Held added a comment -

            The comment above describes the same issue we have! :/

            Chris Held added a comment - The comment above describes the same issue we have! :/

            Daphne Thunnissen added a comment - - edited

            In the Netherlands we have something called the BIR. In this document there are rules concerning the way content is shared and what can and cannot be done. 1 Of the problems is that content with the status "confidential" can only be shared through e-mail which is encrypted and the content is in a password protected file. 

            So if we start using Confluence and we create a page which has confidential content it cannot be emailed. We can as a rule ask all the users to disable the possibility to uncheck the "Show changed content" in their settings but there is no way to check this. This is therefore not an option.

            We have tried the solution https://confluence.atlassian.com/confkb/how-to-globally-disable-e-mail-notifications-with-page-content-718670714.html but still this doesn't work. The mention functionality doens't work anymore. When you are a watcher you do not get warnings that a page is changed or a comment is made. The text of a blog will be send completely. 

            The solution above (https://confluence.atlassian.com/confkb/how-to-disable-show-changed-content-to-all-users-407725054.html) is not a solution for us. We can't afford to have people changing there settings and being able to get classified content in their email.

            I can't imagine that this effects so few companies with all the security scandals these days.

             

             

            Daphne Thunnissen added a comment - - edited In the Netherlands we have something called the BIR. In this document there are rules concerning the way content is shared and what can and cannot be done. 1 Of the problems is that content with the status "confidential" can only be shared through e-mail which is encrypted and the content is in a password protected file.  So if we start using Confluence and we create a page which has confidential content it cannot be emailed. We can as a rule ask all the users to disable the possibility to uncheck the "Show changed content" in their settings but there is no way to check this. This is therefore not an option. We have tried the solution https://confluence.atlassian.com/confkb/how-to-globally-disable-e-mail-notifications-with-page-content-718670714.html  but still this doesn't work. The mention functionality doens't work anymore. When you are a watcher you do not get warnings that a page is changed or a comment is made. The text of a blog will be send completely.  The solution above ( https://confluence.atlassian.com/confkb/how-to-disable-show-changed-content-to-all-users-407725054.html) is not a solution for us. We can't afford to have people changing there settings and being able to get classified content in their email. I can't imagine that this effects so few companies with all the security scandals these days.    

            william added a comment -

            Being able to disable "show changed content" for all users and not allow users to turn it back on would solve a lot of problems for us.

            william added a comment - Being able to disable "show changed content" for all users and not allow users to turn it back on would solve a lot of problems for us.

            Yep, seems like a security hole, and one we've had raised internally.

            I'd like to add to the initial request with the following requirements:

            1. Enforcement (ie, stopping users changing it back) is defiantely required to make this useful.
            2. This needs to be available on the Cloud edition also; we don't even have a workaround.

             

            Ian Appleby added a comment - Yep, seems like a security hole, and one we've had raised internally. I'd like to add to the initial request with the following requirements: Enforcement (ie, stopping users changing it back) is defiantely required to make this useful. This needs to be available on the Cloud edition also; we don't even have a workaround.  

              Unassigned Unassigned
              jcurry Jeff Curry
              Votes:
              65 Vote for this issue
              Watchers:
              45 Start watching this issue

                Created:
                Updated: