Hide links to attachments from a page the user has no access to

[Jessica Weissman]

We have a page where certain files links should be shown only to some users, because other users should not see them.  I have attached those files to a page where the permissions are properly limited.

I thought that would hide links to those attachments  from users who had no permission to see the files.  Instead, the link is there but nothing happens if the user with no permissions clicks on it.

I tried using a page excerpt instead, but that showed a message to the no-permissions user about how they had no permissions to the attachment.

Is there another way to achieve the goal, that is, hiding the links entirely from users who don't have permission to view the attachments?

[AnnWorley · Accepted solution]

The support engineer who worked with Jessica pointed us to Hide page links when the user lacks permission to view the page One of our developers commented:

We have considered this request and would not be looking at implement this feature.

As the comments suggest above, hiding the link in total would go against most of the use cases we see with Confluence. We do agree that there maybe a use case for it, however that would be the minority.

At this stage if the user lacks permission to the page, the link is rendered in red, and the user won't be able to click on it.

So it looks like the behavior Jessica is seeing is expected, if undesirable.

[James McLean]

It is also in direct contradiction to the actual behavior of the Children Display macro.  How can Confluence developers actually implement behavior in one of the most basic macros, and then claim that this is "against most use cases" in a very slightly different case?

[AnnWorley]

Hi Jessica,

I understand you have some attachments on a page that is locked down with permissions so that some users cannot view the page.

On another page you are linking to the attachments and would like the attachment links to be visible only to the users who can view the page the files are attached to.

It is my understanding that what you are trying to do is possible in Confluence 6.7.x Permissions and restrictions:

Links to attachments are also affected. If the visitor doesn't have permission to view the page the attachment lives on, the link won't be rendered.

Please review the permissions on the page the files are attached to, and test whether a user who cannot see the source page can see the links on the other page.

If it doesn't work as expected, please let me know what version of Confluence you are using so I may take a closer look.

Thanks,

Ann

[Jessica Weissman]

Hi, Ann.

That's the way I thought it would work, but when I am an anonymous user (with permissions to view the page with the links, but no permission to view the page that holds the attachments), the links are rendered but go nowhere.

Something that MIGHT be relevant is that I edited the links to point to different attachments than they originally pointed to.  I'll go try making some fresh links to attachments on the forbidden page.

Server/Data Center v. 6.3.1

-  Jessica

[Jessica Weissman]

Yes, I rechecked and re-did the links.  They show but as dead text for people with no permissions to view.  

[AnnWorley]

Thanks for narrowing down the issue. So that we can gather more information privately I opened a support request on your behalf. You should see an email from our support portal soon.

[Jessica Weissman]

Thanks.  I'll be glad to answer any questions or send HTML grabs or whatever.