How to disable page preview on permission request?

sameoldmadness August 31, 2015

I've created a page with restricted access.

When someone requests permissions to this page, I revieve an email with a preview of this page.

The page has restricted access for a reason — it contains sensitive data. It's highliy undesirable to leak that data into email account.

I consider this a security issue.

2 answers

0 votes
Justice McCullum September 30, 2015

Hi Roman, first of all thanks for the feedback mate. smile 
Would you mind creating a feature request ticket so we can have others voting on and discussing this issue? https://jira.atlassian.com/secure/CreateIssue!default.jspa 

0 votes
Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
August 31, 2015

That's not a security issue, you have the right to see the page already.

sameoldmadness August 31, 2015

My confluence account, not the gmail one. If I trust Atlassian, that does not mean I trust Google.

Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
August 31, 2015

If you don't trust google for your email, that's fine. You'll need to use an email address you do trust instead. It's not Confluence's fault that you have chosen an email you don't trust.

Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
August 31, 2015

Sorry, I should also have said that if you must do this because you've got insecure email accounts, you will need to hack the core code that builds the email.

sameoldmadness August 31, 2015

No, that is not fine, because the data is already shared with third party. Without my explicit permission, as far as I can see. The trust issue is not the only one, it's also about expectations. I may intentionally use that mailbox for insensitive data only so I could read it in public places.

Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
August 31, 2015

Ok, so it's not fine. So stop using insecure email accounts - if you believed them to be insecure, then you shouldn't have used them in the first place.

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events