Disable Anonymous Access to Page History

[Zach Mitchell]

Does anyone know of a way to disable anonymous access to page history?

We are having an issue where google will index the old page versions and not the most current version. So we are looking for a way to both redirect anonymous clicks on a link that includes "?pageid=" to the current version of the page. And not allow them to look at the page history unless authenticated.

Anyone know where we could begin or have any idea's what we can do to address this issue with google?

We are running Confluence Version 6.4.3.

Thanks!

[Zach Mitchell · Accepted solution]

I found what i was looking for here is the velocity api reference that allows you to grab the variable that i was looking for.

 Here is my finished Macro which I put at the end of the content panel in themebuilder.

## @noparams
<script>
if($content.version != $content.getLatestVersion().version) {
   $("head").append('<meta name="robots" content="noindex" />');
   $('#action-messages').css('margin-bottom','20px');
   $('#action-messages').append('<div id="not-current-version" class="aui-message warning" tabindex="0" style="margin-top: 0px; padding: 10px 40px 10px 60px;"></div>');
   $('#not-current-version').append("<p><strong>The is not the <a href=\"$content.getLatestVersion().getUrlPath()\">most current version</a> of this page. This is version $content.version/$content.getLatestVersion().version.</strong> <a href=\"/pages/viewpreviousversions.action?pageId=$content.id\">View Page History</a></p>");
   if($content.version != $content.getLatestVersion().version && $action.isAnonymousUser() == true) {
      window.location.replace("$content.getLatestVersion().getUrlPath()");
   }
}
</script>

Also i added this bit of code to the custom HTML of the site to make sure that crawlers stop indexing the old version of pages. You could add the above redirect to this area to, if you wish to stop all anonymous access to those pages.

$(document).ready(function(){
   <!-- Robots/Crawlers -->
   if (window.location.href.indexOf("viewpreviousversions.action") > -1 || window.location.href.indexOf("diffpagesbyversion.action") > -1 || window.location.href.indexOf("viewpageattachments.action") > -1 || window.location.href.indexOf("viewinfo.action") > -1) {
      $("head").append('<meta name="robots" content="noindex, nofollow, noydir, noodp, noarchive, nocache" />');
   }
}

[Shannon S]

Hi Zach,

We have an article for this with a workaround since it's not possible to disable within the UI, you will need to edit the source files directly:

• How do I prevent anonymous users from using page history?

As far as redirection goes, there are a few add-ons listed in this discussion that could help you with that.

Regards,

Shannon

[Zach Mitchell]

Thanks, I try not to edit the files directly and have not found that when i look into solutions like that they work. Most of my experiences editing the decorators directly ends in no changes at all. This is what i have cooked up for now.

Create a user macro to put an alert at the top of the page and use JavaScript to include a meta robots noindex to stop google from indexing the old version pages. I then apply this to all users because google is being an issue :D.

The user macro looks specifically for the Attachments dropdown because it only exists on the most current page. 

## @noparams
<script>
if($('#action-menu-primary').length) {
     if($('a.action-view-attachments').length < 1 ) {
        $("head").append('<meta name="robots" content="noindex" />');
         $('#action-messages').css('margin-bottom','20px');
         $('#action-messages').append('<div id="not-current-version" class="aui-message warning" tabindex="0" style="margin-top: 0px; padding: 10px 40px 10px 60px;"></div>');
         $('#not-current-version').append("<p><strong>The is not the most current version of this page.</strong> <a href=\"/pages/viewpreviousversions.action?pageId=$content.id\">View Page History</a></p>");
     }
}
</script>

I applied this macro to the content panel in ThemeBuilder but you could just add it to the footer of each space and it will have the same affect.

If you know of a variable to get the pageId of the most recent version of the page that would be helpful as then with anonymous users i could force a redirect.

Let me know if you think there is a more sophisticated way to do this. Or a way to improve it.

[Shannon S]

Hi Zach,

Unfortunately, I'm not personally familiar with building User Macros, but many of our members are so they will be able to assist you in that. 

I've also tagged the vendor for ThemeBuilder so they may come across this issue and be of assistance.

Regards,

Shannon

[Zach Mitchell]

Thanks for for the responses Shannon, The option of just limiting the anonymous users access to page history is not the issue. It is more that Google indexes the old versions and seems not to update the search results for the new pages. Most of the Google searches have the pageId= URL which is to a particular version of the page. Thus limiting access to the page history page would not be optimal. Creating the macro helps an end user get to the right place and i have written in a robots no index so they stop indexing the out-of-date pages.

The only option that would be better is if there was a way to get the most recent version pageId of that page and the force a redirect to anonymous users. I know there is a variable of $current.id but is there a variable for $parent.id or something that can pull the most recent published version of that page?

Zach

[Shannon S]

Hi Zach,

I understand your predicament.

I'm not aware of the variable itself, as I do not tend to delve into creating User Macros or add-ons myself, but I found on another post that this might work for you:

$content.getParent().getIdAsString()

Otherwise, you might be able to use a redirection add-on such as the one I am linking here.

I also wanted to bring your attention to this feature request, where you can explain your use case and vote on it. You can see that it's mentioned that Google is very aggressive about what it indexes, such as page history:

• CONFSERVER-8749

Kind regards,

Shannon

[Zach Mitchell]

Those do not appear to work. $content, $content.id and $content.getIdAsString() does. But it appears getParent() no longer functions. Let me know if you come across anything else or how to create or list the options.

[Zach Mitchell]

I found what i was looking for here is the velocity api reference that allows you to grab the variable that i was looking for.

 Here is my finished Macro which I put at the end of the content panel in themebuilder.

## @noparams
<script>
if($content.version != $content.getLatestVersion().version) {
 $("head").append('<meta name="robots" content="noindex" />');
 $('#action-messages').css('margin-bottom','20px');
 $('#action-messages').append('<div id="not-current-version" class="aui-message warning" tabindex="0" style="margin-top: 0px; padding: 10px 40px 10px 60px;"></div>');
 $('#not-current-version').append("<p><strong>The is not the <a href=\"$content.getLatestVersion().getUrlPath()\">most current version</a> of this page. This is version $content.version/$content.getLatestVersion().version.</strong> <a href=\"/pages/viewpreviousversions.action?pageId=$content.id\">View Page History</a></p>");
 if($content.version != $content.getLatestVersion().version && $action.isAnonymousUser() == true) {
 window.location.replace("$content.getLatestVersion().getUrlPath()");
 }
}
</script>

[Shannon S]

Hi Zach,

Thank you for letting us know the User Macro that you wrote which worked for you in the end. Please feel free to add it as another answer below Suggest an Answer and I can accept it as the answer to this question.

Regards,

Shannon

[Sam]

Hi @Shannon S

Does this solution still works for Confluence server 5.9.9

https://confluence.atlassian.com/confkb/how-do-i-prevent-anonymous-users-from-using-page-history-317196367.html ?

Sam

[Andy]

This isn't exactly what you're after, but if you remove the sidebar's built in page tree, then anonymous users can't navigate to the pages.action page where they'd access the page history. Doesn't stop them going to the page directly if they know about it, but it does minimise the exposure.

If you still need a page tree on the side, adding the pagetree macro via the look and feel section will give you that without exposing the pages.action page. 

[Zach Mitchell]

Where what you said is correct from a conventional user. Google is the issue indexing the old pages. So from google people will naturally visit the page history pages. The best route i found is the macro, to inform the user that there is a more current version and to force bots to not cache/index the older pages.