The Admin's tale - Hidden Treasures

[#1]

Once upon a time... no, to be honest, regularly, the admin is asked how to hide content from curious people, from people that should not know anything or just from any people, hide from all, hide from a group, just show to a group, etc.

The first answer to these questions is, that this is not exactly the meaning of collaboration. But you have to deal with the real world: people want to have their hidden treasures or, sometimes, they need to have their hidden treasures. And of course, with Confluence it is possible to have hidden treasures on various levels.

General space permissions

In general, a space or confluence admin grants permissions for the whole space, this means one single permission grants automatically every page in the space:

 

But, what if a single page needs other permissions than all the others? Then it's time for page restrictions:

First Hidden Treasure: A whole page

 If you want to hide the whole page from some people, you can do that with page restrictions. There are two types of page restrictions:

• Hide the page (and all subpages)
• Restrict editing the page (but not the subpages)

Here, I just want to talk about hiding the page. Prohibit editing is another topic for another talk another day.

In reverse, hiding a page from users means: allow viewing the page to all the other users (and only to them). And this is the way, hiding with page restrictions works.

If you want to hide a page, just click on the small lock icon above the page title:

In the following form, select "Viewing and editing restricted":

and add the users who should be able to view (and edit) the page.

When a page has viewing page restrictions, the lock icon turns red:

You can set restrictions also in the "..." - menue of the page.

I'm sure, I've set page restrictions, but don't know where...

If nobody should know about your memory gap, you have to look at every single page and search for the red lock. Might be very time-consuming...

If you have confidence in your admin (and you should, admins are a very trustworthy species), ask him. Space admins are able to get a list containing every single restricted page of a space (Space Tools -> Permissions -> Restricted Pages). 

If you want to hide really really super top secret treasures, e.g. the recipe of your most powerful magic potion and no one, absolutely no one should see that, don't write it down in Confluence. You can't hide anything from your admin. That is why we are so trustworthy :-)

I want to grant a page to a user that is not grantee of the space

This is not possible. With page restrictions, you can't give a user the permission to view the page, if he is not also able to view the space. 

Second Hidden Treasure: Parts of a page

Hiding parts of a page is tricky. Your options depend on some conditions:

• Do you have Confluence Cloud or Confluence Server?
• If you have your own Confluence: Is your admin willing to install a free plugin?

First Option: DIV

If you have Confluence Cloud, the only thing you can do is using the div-macro:

• Add a DIV to your page
• Edit that div. Add style: display:none !important 
• Put your treasures into that div

On the page, it looks like that:

But be aware: This kind of hiding is very very weak. If you look at the sourcecode of this page you'll see:

Another thing is, that your hidden treasure can be found with Confluence's search function, so over all, it rather looks like that:

You don't have any other solution in Cloud at the moment, as far as I know. But with a self hosted instance of Confluence, there is another option:

Second Option: Hide with plugin Visibility

The plugin "Visibility" is available at the market place. You have to "purchase" a license from ServiceRocket, but this license is for free. Otherwise I wouldn't describe it in that form here. This should be no hidden advertising fairytale. But I like the plugin and we use it a lot in our environment.

If your admin installed that plugin, you get several macros for hiding and showing parts of your page:

• show-if
• hide-if
• show-to
• hide-from

With these macros, you are able to show (or hide) content to (from)

• dedicated users
• all authenticated users
• anonymous users
• user groups
• users who have a special permission in a space
• if a label is set on the page
• show / hide content if the page is in scope of another page, e.g. children of

We use these macros e.g. for showing different content for different groups of users on the same page. 

But also here: be aware: Security is better than the div-macro. Hidden Treasures are not visible in the source of the page. But: Hidden Treasures can be found with the search function of Confluence by anyone, who is able to see the page! The whole text is indexed. And the whole page is visible via the Page Source or Storage Format:

This is no real security! Just hiding! Be careful with sensible data! 

So, the map then looks rather like that:

You know, there is a treasure, but you need some more knowledge about the treasure to find it...

Third Hidden Treasure: PDF-Export

At last, another question, the admin's people ask from time to time:

I want to export a page to pdf, but the export should not contain a special part of the page. Do I have to delete that content before export?

No, you don't have to delete anything. Just do the following:

• Put a div-macro on your page
• Edit the div: Enter the class: "NoPrint"
• Put your no-print-content into that div

So it looks like that:

Then you have to ask your space admin to edit the pdf stylesheet for you. If he is not willing, give him a piece of cake and hope for the best ;-)

If the cake is eaten and the admin is willing to edit the pdf stylesheet (Space tools -> Look and Feel -> PDF Stylesheet) add that to the stylesheet:

.NoPrint {display: none ; }

and save it. 

That's it. From now on, everything that is in that NoPrint-Div is not exported to pdf.

Conclusion

Be aware that the one and only secure option for hidden treasures in Confluence is using page restrictions. All the other hiding things leave backdoors to the content that are not too hard to find. But if your treasures are not top secret or sensible data, you can use these hiding mechanisms to create different content for different audiences on your pages. 

And if your treasures aren't discovered yet, they all lived secretly ever after.

[Davin Studer]

The way you can get around people being able to edit a page and see the hidden content or it being index via the search engine is to put that content into its own page with page restrictions. The put a page include macro inside the visibility macro matching the page restrictions on the page to be included. That way the content will show for only certain people on that page plus it is hidden from search and page edits.

[Thomas Schlegel]

Nice idea, thank you, Davin!

[Katya Godneva]

Thanks for the article, it is great!

Can you tell the exact name of the plagin Visibility?

That's exactly what we need.
Can't see it on the Market for some reason.

[Thomas Schlegel]

Thank you :-)

Here is the Link to Visibility: 

https://marketplace.atlassian.com/plugins/net.customware.confluence.plugin.visibility/server/overview

[Shawn Wilson]

Similar to the DIV macro: you can insert an Excerpt macro, put your secret text in it, and check the "Hide Excerpted Content" box.

It still won't protect the hidden text from a search, but maybe it will work in Cloud.

[EtienneD]

Hi Thomas,

Thanks for your valuable posts !

unfortunately, the visibility plugin isn't free anymore :-(

kindly yours,

Etienne

[Andrey Ilin]

And there is no div-macro anymore...