nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Diagramly doesn't reflect remove attachment permissions of current user.

Rostislav Simon1

Diagramly allows to delete diagram including diargram attachment by clicking on remove diagram toolbar button for user who is not allowed to remove attachments. Would be great if that button just removes macro but keeps diagrams attachment.

Impact of current implementation is that user can intentionaly or just by accident click remove toolbar button and diagram is lost without possibility to recover.

Accepted answers

Boris Jockov _draw_io_

Version 2.6.1 has just been released with reworked security checks.

All comments

Boris Jockov _draw_io_

The issue is being investigated.

Boris Jockov _draw_io_

I tried deleting the diagram with user A on a page that is restricted to user B.

It resulted in an 'Access Denied' dialog. When page was refreshed, 'Edit' and 'Delete' icons were missing from the toolbar.

What were your reproduction steps for the issue?

And what is your configuration, Confluence version, plugin version, OS?

Rostislav Simon1

Confluence version 4.3.5

Diagramly plugin version 2.6.0

OS: Linux

Have you setuped permissions correctly

User B must have

for pages

add page -> allowed
remove page -> allowed

attachments

add attachment -> allowed
remove attachment -> restricted

Boris Jockov _draw_io_

Version 2.6.1 has just been released with reworked security checks.

Rostislav Simon1

Yes, it's resolved

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

addon-com.mxgraph.confluence.plugins.diagramly