Anonymous users only have permission to view BUT somehow they can edit

[Devin Martinolich]

I have followed the docs for confluence on enabling anonymous user access to spaces of which entailed setting the global permission and then setting the space permission. The space permission ONLY has View checked and all others unchecked however when browsing the page anonymously i have an edit option and it allows me to edit and save those changes.

It does note that any changes will be flagged as an anonymous user when editing the page but them being able to actually edit is not a good scenario.

This is the Space permissions themselves.

This is the Global permissions

These are the default space permissions found under global permissions in admin settings.

 

[Devin Martinolich · Accepted solution]

I think i might have found the answer but i dont like the solution.

When i first installed and setup confluence i created my first space and set the demo content to that space. This was just to see some of the default stuff that i could do. Since then i have made many different spaces by hand.

While looking for a solution to this problem i came across this: https://community.atlassian.com/t5/Confluence-questions/Anonymous-users-can-still-see-quot-Create-quot-Button/qaq-p/318234

The solution is to delete that space however this space is now filled with content and would be a nightmare to rebuild from scratch. Also... I see a create button at the top of all spaces where an anonymous user can create a space...

I believe this to be the case since I have verified all other spaces permissions against this effected page and the settings are the same. The other spaces cannot be edited but this one can.

[Nic Brough -Adaptavist-]

I think you've found the answer too!

There is a much less painful option than "manually copy all the content".  Create a new space (with the right permissions) and then move each top-level page from the first space into the new one, taking all the child pages with it.  I'm hoping you haven't got loads at the top-level of course.

The permissions for the old space will stay with it, the pages do not have permissions themselves (well, restrictions, but they don't use "anonymous")

[Devin Martinolich]

That did the trick. I created a new space with a different name, moved the top level page and its children to the new space and then deleted the original. Tested and both the "Create" button and the "edit" button is now gone from all public spaces.

[Nic Brough -Adaptavist-]

Could you show us a screenshot of the space permissions?  (not the entire page, just the groups and anonymous sections, and obscure most of the group names if you need to)

[Devin Martinolich]

Updated the original post with images.