Diagramly doesn't reflect remove attachment permissions of current user.

[Rostislav Simonik]

Diagramly allows to delete diagram including diargram attachment by clicking on remove diagram toolbar button for user who is not allowed to remove attachments. Would be great if that button just removes macro but keeps diagrams attachment.

Impact of current implementation is that user can intentionaly or just by accident click remove toolbar button and diagram is lost without possibility to recover.

[Boris · Accepted solution]

Version 2.6.1 has just been released with reworked security checks.

[Rostislav Simonik]

Yes, it's resolved

[Rostislav Simonik]

Confluence version 4.3.5

Diagramly plugin version 2.6.0

OS: Linux

Have you setuped permissions correctly

User B must have

for pages

• add page -> allowed
• remove page -> allowed

attachments

• add attachment -> allowed
• remove attachment -> restricted

[Boris]

I tried deleting the diagram with user A on a page that is restricted to user B.

It resulted in an 'Access Denied' dialog. When page was refreshed, 'Edit' and 'Delete' icons were missing from the toolbar.

What were your reproduction steps for the issue?

And what is your configuration, Confluence version, plugin version, OS?

[Boris]

The issue is being investigated.