-
Bug
-
Resolution: Fixed
-
Highest
-
7.11.1
-
3
-
Severity 2 - Major
-
41
-
Issue Summary
Confluence times out when performing permission checks for a page with lots of attachments macros.
Improve the performance of searchGroupedByName method.
Steps to Reproduce
- Add a page with several attachment macros referencing attachments on current page and other pages.
- Publish page
- View page.
Expected Results
The page loads within a resemble time.
Actual Results
Page eventually times out with error.
The below thread dump captures the time spent loading the page:
"http-nio-8090-exec-2" #226 daemon prio=5 os_prio=0 cpu=1205421.88ms elapsed=180041.76s tid=0x000000003e65c000 nid=0xb90 runnable [0x00000000560ce000] java.lang.Thread.State: RUNNABLE at org.hibernate.type.AbstractStandardBasicType.isEqual(AbstractStandardBasicType.java:198) at org.hibernate.type.AbstractStandardBasicType.isSame(AbstractStandardBasicType.java:186) ... at com.atlassian.crowd.embedded.hibernate2.GroupingHibernateSearch.doInHibernate(GroupingHibernateSearch.java:61) ... at com.atlassian.crowd.directory.AbstractInternalDirectory.searchGroupRelationshipsGroupedByName(AbstractInternalDirectory.java:890) at com.atlassian.crowd.directory.DbCachingRemoteDirectory.searchGroupRelationshipsGroupedByName(DbCachingRemoteDirectory.java:1154) at com.atlassian.crowd.manager.directory.RemoteDirectorySearcher.searchDirectGroupRelationshipsGroupedByName(RemoteDirectorySearcher.java:97) at com.atlassian.crowd.manager.directory.RemoteDirectorySearcher.lambda$nestedGroupsProvider$3(RemoteDirectorySearcher.java:220) at com.atlassian.crowd.manager.directory.RemoteDirectorySearcher$$Lambda$1764/0x000000080240a840.getDirectlyRelatedGroups(Unknown Source) at com.atlassian.crowd.manager.directory.nestedgroups.NestedGroupsProviderImpl.getDirectlyRelatedGroups(NestedGroupsProviderImpl.java:26) at com.atlassian.crowd.manager.directory.nestedgroups.NestedGroupsIterator.fetchRelatedGroups(NestedGroupsIterator.java:40) at com.atlassian.crowd.manager.directory.nestedgroups.NestedGroupsIterator.fetchNextIfNeeded(NestedGroupsIterator.java:65) at com.atlassian.crowd.manager.directory.nestedgroups.NestedGroupsIterator.hasNext(NestedGroupsIterator.java:50) at com.atlassian.crowd.manager.directory.nestedgroups.NestedGroupsIterator.anyMatch(NestedGroupsIterator.java:82) at com.atlassian.crowd.manager.directory.RemoteDirectorySearcher.isUserNestedGroupMember(RemoteDirectorySearcher.java:135) at com.atlassian.crowd.manager.directory.DirectoryManagerGeneric.isUserNestedGroupMember(DirectoryManagerGeneric.java:807) at com.atlassian.crowd.manager.application.ApplicationServiceGeneric$3.fallibleCheckForEntity(ApplicationServiceGeneric.java:1050) at com.atlassian.crowd.manager.application.ApplicationServiceGeneric$DirectoryPredicate.apply(ApplicationServiceGeneric.java:1015) at com.atlassian.crowd.manager.application.ApplicationServiceGeneric$DirectoryPredicate.apply(ApplicationServiceGeneric.java:1011) ... at com.atlassian.crowd.manager.application.ApplicationServiceGeneric.isUserNestedGroupMember(ApplicationServiceGeneric.java:1528) at com.atlassian.crowd.embedded.core.CrowdServiceImpl.isUserMemberOfGroup(CrowdServiceImpl.java:230) ... at com.atlassian.confluence.security.ContentPermission.isPermitted(ContentPermission.java:150) at com.atlassian.confluence.security.ContentPermissionSet.isPermitted(ContentPermissionSet.java:76) at com.atlassian.confluence.core.DefaultContentPermissionManager.hasInheritedContentLevelViewPermissions(DefaultContentPermissionManager.java:247) at com.atlassian.confluence.core.DefaultContentPermissionManager.hasContentLevelPermission(DefaultContentPermissionManager.java:174) ... at com.atlassian.confluence.security.delegate.PagePermissionsDelegate.hasContentLevelViewPermission(PagePermissionsDelegate.java:123) at com.atlassian.confluence.security.delegate.PagePermissionsDelegate.canView(PagePermissionsDelegate.java:20) at com.atlassian.confluence.security.delegate.PagePermissionsDelegate.canView(PagePermissionsDelegate.java:13) at com.atlassian.confluence.security.delegate.TargetToLatestVersionDecorator.canView(TargetToLatestVersionDecorator.java:24) at com.atlassian.confluence.security.delegate.SharedAccessInterceptor$$Lambda$3158/0x000000080309f040.test(Unknown Source) at com.atlassian.confluence.security.delegate.SharedAccessInterceptor.checkAccess(SharedAccessInterceptor.java:87) at com.atlassian.confluence.security.delegate.SharedAccessInterceptor.canView(SharedAccessInterceptor.java:25) at com.atlassian.confluence.security.Permission$1.checkAgainst(Permission.java:17) at com.atlassian.confluence.security.DefaultPermissionManager.hasPermissionNoExemptions(DefaultPermissionManager.java:100) at com.atlassian.confluence.security.delegate.AttachmentPermissionsDelegate.canCreate(AttachmentPermissionsDelegate.java:120) at com.atlassian.confluence.security.DefaultPermissionManager.hasCreatePermission(DefaultPermissionManager.java:115) ...
Notes
Fastpermissions didn't help in this instance.
Workaround
Currently there is no known workaround for this behavior. A workaround will be added here when available
- is related to
-
CONFSERVER-58733 Loading a page with links to multiple attachments from the same source page makes Confluence to check for permissions on every link instead of just once
- Gathering Impact