Reporting user group usage for page level restrictions?

[ITops123]

We have a lot of defunct user groups in our Confluence instance and it's time to do some spring cleaning.

I know that some of the user groups are being used to set page-level restrictions. But we have about 15,000 pages in our Confluence instance and I need an efficient way to determine which user groups are currently being used to set page-level restrictions, and what those pages are. Otherwise, I run the risk of opening up a sensitive page because I removed the user group.

Question: How can I create a report (either the reporting plugin or a SQL query) to answer my question?

[Remo Siegwart · Accepted solution]

As far as I know, it is not possible to query permission with the reporting plugin. In your case I would create a user macro. The following code would loop through all spaces and list all pages with page level restrictions set to a group:

## @noparams

#set ( $containerManagerClass = $content.class.forName('com.atlassian.spring.container.ContainerManager') )
#set ( $getInstanceMethod = $containerManagerClass.getDeclaredMethod('getInstance',null) )
#set ( $containerManager = $getInstanceMethod.invoke(null,null) )
#set ( $pageManager = $containerManager.containerContext.getComponent('pageManager') )

All pages with page level restrictions set to a group:

#set( $allSpaces = $spaceManager.getAllSpaces() )
#foreach($space in $allSpaces)
<h3>$space.name</h3>
  <table class="confluenceTable">
    <tr>
      <th class="confluenceTh">Page</th>
      <th class="confluenceTh">Group Permission</th>
    </tr>
    #set( $allPagesInSpace = $pageManager.getPages($space, true) )
    #foreach($page in $allPagesInSpace)
      #if($page.hasContentPermissions())
        #set( $permissions = $page.getPermissions() )
        <tr>
          <td class="confluenceTd">#contentLink2($page false false)</td>
          <td class="confluenceTd">
            <ul>
              #foreach($permission in $permissions)
                #if($permission.isGroupPermission())
                  <li><em>$permission.type</em> to <strong>$permission.groupName</strong></li>
                #end
              #end
            </ul>
          </td>
        </tr>
      #end
    #end
  </table>
#end

Not sure how this report performs with 15'000 pages, but hope this helps.

[ITops123]

Both very helpful, thank you. I'll see if we can run this during a maintenance window and will report back.

[ITops123]

UPDATE: This worked really well and performed better than expected. Thanks!

[Sandro Herrmann [Communardo]]

To find the pages with group pagerestrictions you can write a user macro. This macro should iterate over all spaces and there pages. If there are page group restrictions at a page an output will be generated. I have prepared this for you.

But WARNING, this usermacro isn't the fastest one and will definitely slow down you system because it iterates over all pages in your big confluence instance. Use this macro only for this usecase and not as a public macro.

## @noparams
 
## DO NOT USE THIS MACRO ON A LOT OF PAGES BECAUSE OF PERFORMANCE ISSUES. IT DEFINITELY WILL SLOW DOWN YOU SYSTEM!!!!!
 
#set($containerManagerClass=$action.class.forName('com.atlassian.spring.container.ContainerManager'))
#set($getInstanceMethod=$containerManagerClass.getDeclaredMethod('getInstance',null))
#set($containerManager=$getInstanceMethod.invoke(null,null))
#set($containerContext=$containerManager.containerContext)
   
## the pageManager gives you access to the pages
#set($pageManager =$containerContext.getComponent('pageManager')) 
 
## the spaceManager gives you access to the spaces
#set($spaceManager =$containerContext.getComponent('spaceManager')) 

## the contentPermissionManager gives you access to the page permissions
#set($contentPermissionManager=$containerContext.getComponent('contentPermissionManager')) 
  

##over all spaces (WARNING THIS COULD TAKE SOME TIME ON BIG CF INSTANCES )
#foreach( $space in $spaceManager.getAllSpaces() )   
 
    <b>Searching for group page restrictions in space "$space.name"<b>
  
    ##over each page in the current space ( WARNING THIS COULD TAKE SOME TIME ON BIG CF INSTANCES)
    #foreach( $page in $pageManager.getPages( $space, true) )   
 

        <ul>
            ##iterate over all view contentpermissionssets 
            #foreach( $contentPermissionSet in $contentPermissionManager.getContentPermissionSets($page,"View") )
      
                #foreach( $contentPermission in $contentPermissionSet )   
          
                    ##is the current permission a user permission
                    #if($contentPermission.isGroupPermission() )
              
                        ##if yes print the name
                            <li>Found "VIEW" page restriction on page "$page.title" for group "$contentPermission.groupName"</li>
                    #end
  
                #end
            #end
        </ul>
 

        <ul>
  
        ##iterate over all view contentpermissionssets 
        #foreach( $contentPermissionSet in $contentPermissionManager.getContentPermissionSets($page,"Edit") )
      
            #foreach( $contentPermission in $contentPermissionSet )   
          
                ##is the current permission a user permission
                #if($contentPermission.isGroupPermission() )
              
                    ##if yes print the name
                    <li>Found "EDIT" page restriction on page "$page.title" for group "$contentPermission.groupName"</li>
                #end
            #end
        #end
        </ul>


    #end
 
#end

Testet with my Confluence 3.5.13