Page restrictions keep reenabling themselves

[Victoria Grigson]

Hello,

We have been using Confluence for a year or so. Today we keep finding pages whose restrictions are set to 'Anyone can view, some can edit'. The Confluence admin or the creator of the page can change the setting to 'Anyone in Confluence can edit', but then when someone else edits the page, the restriction 'Anyone can view, some can edit' reasserts itself.

On one occasion I was editing a page at the same time as my colleague, my colleague clicked to publish his changes (without notifying watchers) and when he did so, I was thrown out and the page's permissions were restricted to 'Anyone can view, some can edit'.

The only intentional change that we've made was to install Jira Service Management a few days ago. We haven't changed any other page or space settings.

This is, obviously, a serious impediment - it's rendered Confluence unusable. Is this a known bug? Do we need to go back and review some settings after the installation of Jira SM?

[Daryn Cash · Accepted solution]

I filed a support request with Atlassian for this issue in my workspace and they told me it was a third party app 'Comala Document Management for Confluence Cloud' which updated and caused this permissions error.


Comala has rolled back the update that caused this issue according to their site:https://wiki.comalatech.com/display/CDMC/Release+Notes

Sadly the fix that Atlassian proposed on behalf of Comala was to manually check restricted pages and manually fix them.

If you're using Comala in Confluence you could reach out to them to see if this was the cause of your issue and if they have a better fix - that's what Atlassian support recommended for me.

This post was very helpful for me - I hope this info is helpful for you! Thank you! 

[Victoria Grigson]

Aha! We do have Comala installed, so that must be the issue. Thank you!

[James Conway · Accepted solution]

Hello @Victoria Grigson, @Daryn Cash  

It sounds like you have been affected by an issue with the Comala Document Management family of apps. Impacted apps include Comala Document Management, Comala Document Control, and Comala Document Approval. 

On Tuesday, November 16th our team released an update to each of these apps. The update produced an unintentional side effect that may affect permission settings on your Confluence pages. Please note that after 18:00 GMT, we performed a roll-back to our previous version, so teams using the app after that time should not be affected.

How to determine if your Confluence instance was affected:

• Confirm if any pages were accessed by your team members between 9:30 GMT and 17:00 GMT on 16 November 2021
• If pages were accessed, review them to see if their view/edit permission settings have changed

What to do if you believe your instance has been affected or have questions:

• Re-apply any permission that have been changed
• Reach out to our support team at https://support.comalatech.com if further assistance would be helpful

On behalf of Comalatech, please accept our sincere apologies for any inconvenience this issue has caused. Please do not hesitate to reach out if we can provide more information.

Sincerely,

James Conway

[Victoria Grigson]

Hi James,

Thank you for acknowledging this - it's a shockingly bad bug to roll out, as it's made the whole of Confluence effectively unusable.

What do you mean by 'accessed'? Were page permissions corrupted only on editing the pages, or would viewing a page have caused a change too?

We don't use the Comala products that we have installed, so will be uninstalling them immediately.

Thanks,
Victoria

[Darryl Lee]

Even though Atlassian doesn't keep an audit log of Page Restriction changes (grrrr, CONFCLOUD-34501), surely the Comala apps should have some log of what pages they screwed up the restrictions on? It seems like it would be good customer service/public relations if they can't FIX the problems they caused, they could at least provide the list of pages they modified so users know what they'll have to fix themselves. :-/

[James Conway]

Hello @Victoria Grigson @Darryl Lee 

In certain cases a page view would cause the restrictions to be changed. 

We have communicated the situation to Atlassian. You and any other potentially affected community members can contact us at https://support.comalatech.com and we will look at your specific case.

Once again, please accept our apologies for this incident, we will do all we can to support you and your teams.

Sincerely

James

[Darryl Lee]

Glad to see you're on it. Thanks @James Conway 

[Victoria Grigson]

Hi James,

Thanks for your reply. I've submitted a support request (SUPPORT-12485) to ask you to find out which of our pages have been affected. I'm concerned that if even viewing the pages could have changed the settings, we might find out that something has been restricted at a time when neither of our admins are available to change the permissions (we're a small team).

Thanks,
Victoria

[Darryl Lee]

Page Restrictions are inherited. So perhaps that there is a Parent page somewhere in your hierarchy that has the 'Anyone can view, some can edit' restriction?

https://support.atlassian.com/confluence-cloud/docs/add-or-remove-page-restrictions/

[Victoria Grigson]

Thanks for your reply. I've checked a couple of the parent pages and they're not restricted - and never (should!) have been - almost all our pages have always been set to 'Anyone can view and edit' (and the exceptions, of which there are a single-digit number, have restricted viewing not just restricted editing).

[Darryl Lee]

*Sigh* if only there was auditing for permissions changes. (CONFCLOUD-34501).

This might be a situation where you have to loop in Support to see if they can poke around under the covers (maybe turn on debugging?) to see what's going on.