Issue Summary

Suppose a user send a request access to a certain page. Approving the request revokes access privileges of all others except the requester. This happens if the page is affected by CONFSERVER-32712 .

Two underlying problems

• Requesting access to a restricted page is enabled even though it only has inherited restriction.
• Approving the request revokes other's privilege to view the page

Environment

Confirmed in Confluence 7.0.2 but would be replicated in the newer version as well.

Steps to Reproduce

1. Add SMTP server for Confluence
2. Login as admin, an administrator user
3. Add user1 and user2
4. Remove them from confluence-users
5. Grant "Use Confluence" permission individually to them
6. Create pages with such tree structure

     RootPage
       ├── pageA
       └── pageB
   

7. In space permission,
   • Restrict view access for RootPage only to user1, user2
   • Restrict view access for PageB only to user1
8. Add page C below page B

     RootPage
       ├── pageA
       └── pageB
           └── pageC
   

9. Move page C to below page A

     RootPage
       ├── pageA
           └── pageC
       └── pageB
   

10. Login to user2 and visit pageC

Expected Results

user2 can see pageC.
Otherwise user2 cannot send request access even the page is affected by CONFSERVER-32712 .

Actual Results

• user2 cannot see pageC and the access request screen is enabled. Request can be sent as
  
• Approving request will make PageC be only visible to user2
  

Notes

The potential problem of this issue is CONFSERVER-32712, so resolving the bug will also resolve this.

Workaround

Don't send access request to any page that is affected by CONFSERVER-32712