Best way to embed permissions-restricted content?

[Philip Colmer]

On our current wiki, we have some pages (not many) where the page has some of the content set only to display if the user is logged in and can therefore prove they should see the secret stuff :-)

I've tried to do this in Confluence by creating a page with restricted access then, on a public page, I have the public text and also the Include Page macro that references the secure page.

This works reasonably well. If I'm logged in, the secure content is displayed as part of the normal page's content. If I'm logged out, however, Confluence displays the normal content as required but where the secure page would appear, it displays "Unable to render {include} The included page could not be found".

Now, our current wiki doesn't actually need the sub-page approach - everything is actually on the one page, but I took this approach because I couldn't find a better way of doing it within the page.

Is there a better way?

Thanks.

[Arjen Breur]

This user macro "wraps" the default Insert Page macro and only shows it if the current user has permission to view that page. It does not show anything if the user doesn't.

## Macro title: Include Restricted Page
## Date created: 01/11/2018
## Macro has a body: N

## @param space:title=Space|type=spacekey|desc=Space where the page excerpt is found
## @param page:title=Page|type=confluence-content|required=true|desc=Page where the excerpt is found
## Check for valid space key, otherwise use current
#set($spacekey= $paramspace)
#if (!$spacekey)
 #set ($spacekey=$space.key)
#end
#set($m1 = "{include:")
#set($m2 = "}")
#set($macro = "${m1}${spacekey}:${parampage}${m2}")

#if ($permissionHelper.canViewPage($action.remoteUser, $spacekey, $parampage))
 $action.getHelper().renderConfluenceMacro($macro)
#end

[Daniel Borcherding]

Hello Phillip,

Have you tried the Excerpt Include Macro.

https://confluence.atlassian.com/display/DOC/Excerpt+Include+Macro

This is a bit lighter weight that the full page include. You should be able to create a single restricted page that contains multiple excerpts. On your public page you can include these excerpts just as you had done with the include macro. I think the differece is going to be that you won't get the glaring error messages you see with include macro.

[Philip Colmer]

Thanks for the suggestion of the Excerpt Include macro. Unfortunately that reports "The page Sub-page access test does not exist."

[Geert Graat]

Anybody found a workaround for the "page does not exist" when the excerpt is on a page that is restricted for the user? I basically want the same thing as with the children macro, which simply does not display the page in case it is restricted.

[jing_hwa_cheok]

Hi Philip,

How about this free CustomWare Visibility Plugin https://marketplace.atlassian.com/plugins/net.customware.confluence.plugin.visibility? This plugin will allow you to hide content in the pages including link based on user's name,groups or space access.

[Philip Colmer]

Thanks for this suggestion. I'm a bit worried about the warning text, though:

"They do effectively block the content when the page is viewed directly, but the whole page text is indexed and will show up unrendered in page summaries, as well as being visible by viewing the page source from the Page Info view."

I'm a bit concerned that the text is still discoverable which is, I think, why I was initially trying to use sub-pages with permissions.

[jing_hwa_cheok]

Hi Philip,

You might want to have a look at this Arsenale Lockpoint plugin here https://marketplace.atlassian.com/plugins/com.arsenale.plugins.lockpoint . This plugin will allow you to lock can lock attachments while making changes, enabling exclusive editing of document in the Confluence .

Hope this helps.

Kind Regards,
Jing Hwa

[Philip Colmer]

That isn't quite what I'm trying to achieve, unfortunately.

I essentially want to present slightly different versions of a single page, depending on whether or not the anonymous/logged-in user has permission to see secure content on that page. If they don't, my preference would be for the secure content to be invisible.