Can I set default global restrictions for Team Calendars?

[James Carrington]

I want to set a global 'default' restriction on Team Calendars so that clients (who sit in a user group called "clients") cannot see (or edit) any calendars unless they are explicitly granted viewing (or editing) permissions.

Example: All calendars have restrict viewing from 'clients' user group. // I then select a specific calendar, grant 'view' access to a specific user by user name.

Please help! :o

Thanks, :)

[Jason Caragan · Accepted solution]

Hi James,

Afraid this isn't possible just yet, but we do have a request for its implementation. Feel free to add your vote and set a watch on the issue to be notified of any updates.

[Martin Moser]

This is not only an embarrassing oversight in the design of the plugin, it is an extreme security risk for all companies using Confluence and Team Calendars professionally. Pay for something that was free before and get a security risk for your money.

Are there any known workarounds for this? :-(

[Martin Moser]

FWIW, we decided to patch the plugin in the sense that we restrict creation of new calendars to a small group of users, making sure in this way that all calendars are actually created with a minimum of relevant restrictions to avoid the risk of exposing internal information involuntarily. All other users receive an error message when trying to create a calendar along with information on who to turn to.

[RP Administrator]

Hi Martin,

You mentioned a patch was applied to the plugin. Would you mind sharing what was done? I am very interested in the same restrictions for my environment.

Thanks

[carolyn french]

Late to the conversation, but would love to learn how you restricted new calendar creation too @Martin Moser

[Martin Sander]

It was not actually a patch to the plugin itself, but a plugin of its own (as Team Calendars is closed source even to paying customers). Using the servlet filter module [1], we just filter the urls that are used to create team calendars (post to /plugins/calendar/importsubcalendar.action, and put to /rest/calendar-services/1.0/calendar/subcalendars.json), and return an error page that the client side javascript of team calendars can interpret to display a "you are not allowed to create team calendars" message to the user. If users want a calendar, they have to write an email to a group which is excluded from above logic. Does that help? [1] https://developer.atlassian.com/confdev/confluence-plugin-guide/confluence-plugin-module-types/servlet-filter-module

[carolyn french]

I'm not very technical :( Do you have any code for the plugin that I can use?

[Martin Sander]

We might check if we can open source this, but as we are working for a company that makes money selling software, me might not get the permission to do so.

[carolyn french]

Ok, fair enough, I totally understand if you're not able to.

[James Carrington]

Thanks! :)

[James Carrington]

Hi there. The URL for the request does not appear to be working could you please check it? Thank you.

[Jason Caragan]

Doh, thanks James. Link fixed.

[James Carrington]

Hi there. The URL for the request does not appear to be working could you please check it? Thank you.