Issue Summary

      Plugin Data Storage does not display data

      Steps to Reproduce

      1. Install and set-up Confluence 7.4.5 or newer
      2. Access Plugin Data Storage page via /plugins/servlet/active-objects/tables/list

      Expected Results

      Actual Results

      All plugins name as unknown, table column as '$i.table' and rows as '$i.rows'

      Workaround

      Perform these steps to restore the functionality in Confluence:

      Up to Confluence 8.9:

      1. Edit <confluence-install-dir>/confluence/WEB-INF/classes/velocity.properties
      2. Replace the full line containing com.atlassian.activeobjects from the introspector.restrict.packages section with: 
        introspector.allow.classes = \
           com.atlassian.activeobjects.admin.tables.TablesController$TableInformation, \
           com.atlassian.activeobjects.backup.PluginInformationFactory$AvailablePluginInformation
        
        introspector.restrict.packages = \
           com.atlassian.activeobjects.ao, \
           com.atlassian.activeobjects.config, \
           com.atlassian.activeobjects.internal, \
           com.atlassian.activeobjects.osgi, \
           com.atlassian.activeobjects.plugin, \
           com.atlassian.activeobjects.servlet, \
           com.atlassian.activeobjects.spring, \
           com.atlassian.activeobjects.util, \
           com.atlassian.activeobjects.backup
      3. Restart Confluence.

      For Confluence 9.0 onward:

      1. Edit <confluence-install-dir>/confluence/WEB-INF/classes/velocity.properties
      2. Add the following properties to the end of the file:
        introspector.proper.allowlist.enable=true
        introspector.proper.allowlist.debug.enable=true
        
        introspector.allow.classes = \ 
          com.atlassian.activeobjects.admin.tables.TablesController$TableInformation, \  
          com.atlassian.activeobjects.backup.PluginInformationFactory$AvailablePluginInformation
        
        introspector.restrict.packages = \
           com.atlassian.activeobjects.ao, \
           com.atlassian.activeobjects.config, \
           com.atlassian.activeobjects.internal, \
           com.atlassian.activeobjects.osgi, \
           com.atlassian.activeobjects.plugin, \
           com.atlassian.activeobjects.servlet, \
           com.atlassian.activeobjects.spring, \
           com.atlassian.activeobjects.util, \
           com.atlassian.activeobjects.backup
      3. Restart Confluence.

      Bear in mind that these changes were made in order to limit potential template injection vulnerabilities (CONFSERVER-59898), so there are some security implications to this workaround. You might consider making this change, getting the data you need from the page, and then reverting it and restarting Confluence again.

            [CONFSERVER-66530] Plugin Data Storage does not display data

            Robin Powell added a comment - - edited

            We are testing Confluence DC 9.2.3 and finding the same issue as 95717ed31e6a - the tables are listed, but the Plugin column is always Unknown.

            I would just like to add that this is incredibly frustrating. The list in your Knowledge Base is neither complete (more than half of the AO_* tables that we have are not on that list at all) nor accurate (at least one of the things listed - the table locations for ThemeBuilder - is wrong) In the case of ThemeBuilder, their support team doesn't know where their tables are either, making it very difficult to verify how many users are actually using the product. The workaround here does group the tables that we have in some way, but when the entire left column is <Unknown> I can't even begin to guess what these are actually grouped by, and as I said earlier, cross-checking against the recently updated list in your knowledgebase gets me fewer than 1/3 of the answers I need. Surely somewhere someone has a complete list?

            Robin Powell added a comment - - edited We are testing Confluence DC 9.2.3 and finding the same issue as 95717ed31e6a - the tables are listed, but the Plugin column is always Unknown. I would just like to add that this is incredibly frustrating. The list in your Knowledge Base is neither complete (more than half of the AO_* tables that we have are not on that list at all) nor accurate (at least one of the things listed - the table locations for ThemeBuilder - is wrong) In the case of ThemeBuilder, their support team doesn't know where their tables are either, making it very difficult to verify how many users are actually using the product. The workaround here does group the tables that we have in some way, but when the entire left column is <Unknown> I can't even begin to guess what these are actually grouped by, and as I said earlier, cross-checking against the recently updated list in your knowledgebase gets me fewer than 1/3 of the answers I need. Surely somewhere someone has a complete list?

            Thank you for providing a workaround for Confluence 9.0 onward.

            I tested it on a Confluence 9.2.1 dev instance and it is partly working: tables and rows are visible, but the Plugin column is always <unknown>.
            This is not very useful without plugin names.

            Fabrizio Catalucci added a comment - Thank you for providing a workaround for Confluence 9.0 onward. I tested it on a Confluence 9.2.1 dev instance and it is partly working: tables and rows are visible, but the  Plugin column is always <unknown> . This is not very useful without plugin names.

            Also Confluence 9.2 is affected.

            Fabrizio Catalucci added a comment - Also Confluence 9.2 is affected.

            This issue is how old now? 2,5 years? And the fix is in the comments and already deployed in Jira. That is a 2 minute job. Okay, plus regression, which takes a bit of time.

            Gabriel Ruprecht added a comment - This issue is how old now? 2,5 years? And the fix is in the comments and already deployed in Jira. That is a 2 minute job. Okay, plus regression, which takes a bit of time.

            It will be good!

            Gonchik Tsymzhitov added a comment - It will be good!

            Adam Hagen added a comment -

            Jira has a fixed issue for the same issue: https://jira.atlassian.com/browse/JRASERVER-71733

            I took a look at the velocity.properties in a fixed Jira version and compared it to what's in the Confluence version. The Jira velocity.properties has the following entries in the 'introspector.allow.classes' section:

            introspector.allow.classes =com.atlassian.activeobjects.admin.tables.TablesController$TableInformation,\
            com.atlassian.activeobjects.backup.PluginInformationFactory$AvailablePluginInformation,\
            com.atlassian.activeobjects.backup.PluginInformationFactory$NotAvailablePluginInformation,\
            com.atlassian.activeobjects.spi.PluginInformation 

            I added those lines to the velocity.properties file in Confluence and restarted the service. I'm now able to access the Access Plugin Data Storage page.

            Adam Hagen added a comment - Jira has a fixed issue for the same issue: https://jira.atlassian.com/browse/JRASERVER-71733 I took a look at the velocity.properties in a fixed Jira version and compared it to what's in the Confluence version. The Jira velocity.properties has the following entries in the 'introspector.allow.classes' section: introspector.allow.classes =com.atlassian.activeobjects.admin.tables.TablesController$TableInformation,\ com.atlassian.activeobjects.backup.PluginInformationFactory$AvailablePluginInformation,\ com.atlassian.activeobjects.backup.PluginInformationFactory$NotAvailablePluginInformation,\ com.atlassian.activeobjects.spi.PluginInformation I added those lines to the velocity.properties file in Confluence and restarted the service. I'm now able to access the Access Plugin Data Storage page.

              a9c75a56733b Manonmani Muthukrishnan
              mduong@atlassian.com MichaelD
              Affected customers:
              35 This affects my team
              Watchers:
              33 Start watching this issue

                Created:
                Updated: