Problem Definition

Although anonymous access can be disabled in the global permissions, it can still be enabled in space permissions. Since users in the 'confluence-users' group have access to any content allowed for anonymous access, then all users in that group will be able to see the spaces where anonymous access is enabled, even though it is disabled at the global level.

Suggested Solution

Disable/hide the anonymous section under Space permissions when global anonymous permissions are disabled.

Workaround

Hide the anonymous access section of the space permissions page from anyone who is not a system administrator by adding the following to the Confluence admin -> General configuration -> Custom HTML at the end of the body:

<script type="text/javascript">
    AJS.toInit(function(){
       if (!AJS.params.isConfluenceAdmin) {
      AJS.$('#aPermissionsTable').hide();
}
    });
</script>

Incase the above script doesn't work, you can use the below script to hide the anonymous section for all users :

<script type="text/javascript">
    AJS.toInit(function(){
	  AJS.$('#aPermissionsTable').hide();
    });
</script>

Please note, following above steps will not remove the current permissions from the database. Please remove the Space anonymous access manually or by using database query before removing the anonymous permission section. Below is the query to find Spaces which has anonymous access

select * from spacepermissions where PERMUSERNAME IS NULL AND PERMGROUPNAME IS NULL AND  NOT PERMTYPE = 'LIMITEDUSECONFLUENCE'

• LIMITEDUSECONFLUENCE is the global permission for Jira ServiceDesk users in Confluence