nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Is there a way to limit macro access/visibility in macro list to specific users with scriptrunner?

Stefan Salzl

Hi community,

We are testing a new add-on that provides macros in confluence. Unfortunately it cannot be limited to either users or spaces. So all user could use this macro. As this macro provides data from a 3rd party it should be possible to limit who could create those macros in pages/choose the macro in the macro chooser.

Is there any possibility to hide the macro buttons in the macros dialog (when I click "add macro" and show the full list) ?

thanks in advance.

Best
Stefan

Accepted answers

Radek Dostál

Not as far as I know. Why does the macro show any 3rd party data though? That sounds rather weird to me.

Nic Brough -Adaptavist-

Scriptrunner can't do this because there's no function in Confluence that does this. Unless a macro app codes for "only allow in certain spaces", there's no way to do it.

All comments

Radek Dostál

Not as far as I know. Why does the macro show any 3rd party data though? That sounds rather weird to me.

Nic Brough -Adaptavist-

Scriptrunner can't do this because there's no function in Confluence that does this. Unless a macro app codes for "only allow in certain spaces", there's no way to do it.

Stefan Salzl

Any (kinda) connector makro shows data from another system even if it´s only the jira-macro in confluence (which shows eg. issue data from jira).

In this case it´s really another software where the macro communicates via API.

IMHO permisssion or at least read/edit config should be possible within the addon-config and there should not be a need for this question here =S

Thanks for your time and question anyways.

Best
Stefan

Radek Dostál

Well, jira issue macro (provided that it's the native one based off Application Links) will respect the user's permissions. If they can see any issues, then that means they can log in to jira and browse them. So, not really a leak.

Unauthorized user which doesn't have access to those issues won't see them.

You still haven't told us what macros / 3rd party app it is, so hard to tell.

Either way, if a macro contains hardcoded credentials in the background to authenticate to some remote app, then it's a bad macro and you should tell the vendor your use case so they can implement either restrictions, or support per-user data.

Macros are supposed to be generic, ask for parameters. No macro should just show some magical content from somewhere without respecting the user's permissions, and this is respected both within Confluence content as well as Application Links. This really sounds more like a vendor's oversight, not a Confluence one.