Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-7073

Link to restricted pages that don't reveal page space/title - make tinyURLs give 'Page Not Found' if user lacks View permission

    XMLWordPrintable

Details

    • We collect Confluence feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

    Description

      At present, users cannot create links to pages without revealing the page title. If a user wishes to link to a restricted page, they must reveal it's existence. If users wish to maintain private pages as completely secret, the only current workaround is never to link to those pages.

      However, they can use the page's tiny link with a harmless alias to create a completely secret link. For example "The finance team should check out this page" is generic enough to be publicly viewable without compromising security. To implement this, page behaviour for hidden pages should duplicate nonexistent pages:

      1) TinyURL should check page permissions for a user when the TinyURL is accessed and go to 'Page Not Accessible' if 'View' permission is not granted.

      2) Replace TinyURL 'Page Not Found' error with "Page Not Accessible". Current message is "The page you were trying to reach does not exist. You may want to try a search, or browse the site to find the page you were looking for." This should be updated for anonymous viewers:

      "Page Not Accessible
      The page either does not exist, or you must be logged in to view it. You can [login or sign-up for an account here]. Alternatively, you can browse the site for other public pages."

      For logged-in users without View access, the page should state that they may need further permissions:

      "Page Not Accessible
      The page either does not exist, or you do not have permission to view it. If you believe this page exists and you should have permission to access it, please [contact your administrator]. Alternatively, you can browse the site for another page."

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              david.soul@atlassian.com David Soul [Atlassian]
              Votes:
              3 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: