Confiforms: Add users to page restrictions for secure file storage pages

[its moi]

I have a form, with file upload fields. In this form, approvers are selected in dedicated user fields. It was easy to add these as record owners by IFTTT when creating the record (thanks to the good answer on my previous question @Alex Medved _ConfiForms_)

Now I also need to add these approvers to the view restrictions of the page where uploaded files are stored securely. As these pages are created automatically when going for this option in form definition, I do not know how to reference on this. 

I also thought of having another IFTTT that created a page for the files, but I am not sure if that is really necessary. Any help? THX 

[Alex Medved _ConfiForms_ · Accepted solution]

You cannot do that dynamically, but you can setup the form to have additional admins (could be a security group) - parameter in ConfiForms Form Definition macro

And these users will have access to the "secure" pages holding attachments for the form

[its moi]

Thanks @Alex Medved _ConfiForms_ , for clearing this up. As the additional owners / page viewers are changing with every record, I needed to have it dynamically. 

I have done this now using an IFTTT which creates a new page with each record, another IFTTT which moves attachments there and a third IFTTT which adds the page restrictions for selected users. 

[Alex Medved _ConfiForms_]

Yes, with this approach you have the full control

[Amir]

But if user doesn't have "Restrictions" permission on that space, your third IFTTT rule didn't work! How could we solve that problem?

[Alex Medved _ConfiForms_]

Well, think about it - if you dont have access then you cannot grant it to yourself

(otherwise it would be just crazy)

[Amir]

There isn't any way that confiforms do IFTTT jobs as another user or as admin?

[Alex Medved _ConfiForms_]

Again, think if it would be possible to do that? What harm you can do with something like that? 

Opening the door to do something with higher privilege by the user with lower privilege

But of course you can set up a WebService request to use API and set it up to use a service account that has enough permissions.

But again, who will guarantee that no one else will use that configured "web service request" to do their "own attack"

Alex

[Amir]

So If I use create page with IFTTT, I should permit all users to edit restriction and this option (in picture) would be useless. Because If users didn't have restriction permissions, this option wouldn't work and If users had rights, so they can change it again!!

[Amir]

Sorry, I reply on a wrong field.

@Alex Medved _ConfiForms_ 

[Alex Medved _ConfiForms_]

The original conversation is about completely different thing... And, honestly, I dont quite understand your question and the screenshot

The marked parameter tells ConfiForms not to add current user into the editors - which allows you to set up the forms in a way that they could create pages on form submit but restrict edits to such page (we have some use cases where the page MUST stay as-is (as it was created) after submit and that is the option that helps to implement this requirement)

[Amir]

I want exactly what you said. Could you please send the page of confiforms documentations that shows how could I implement this use case?

Thanks

[Alex Medved _ConfiForms_]

On the screenshot you have provided you have exactly the configuration you are looking for - disabling the current user of being the editor of the created page and restricting editing to "confluence-administrators" security group only

[Amir]

Thanks but it didn't work because of the reason I mentioned. If I permit users to change restriction in space permission page, So they could add themselves as an editor of a page and if they haven't permission of restriction, the IFTTT macro didn't work.

[Alex Medved _ConfiForms_]

User cannot add himself as an editor if they have no edit permissions on the page. I dont quite follow what you say about space permissions...

Users must be given permissions to create pages in the space if you want them to use your form that creates pages and must have "add/delete" restrictions

[Amir]

Yes, user cannot add himself as an editor if they have no edit permissions on the page. But I really think that the checkbox I showed in screenshot didn't work. Because I test everything many times but it didn't work and always creator (who submit the form) added as editor and has edit permission of created page. Could you please test it yourself? thanks again

[Alex Medved _ConfiForms_]

Hi,

Sorry... you are right - this option just stopped working, as Confluence adds current user inside the APIs we use (after we call these APIs)

if (this.currentAuthenticatedUser != null && this.isUserLockedOut(permissions, this.currentAuthenticatedUser)) {
  permissions.add(ContentPermission.createUserPermission(contentPermissionType, this.currentAuthenticatedUser));
}

Will be looking into ways to get this fixed asap

Alex

[Amir]

Thank you. It would be great, if you could add an option in IFTTTs to perform some tasks by admin users and this option be showed only to system administrators.

I want to employ this scenario: users fill the form and add attachments and submit the form, then confiform create a page which users must not have permission to edit the page. But when user remove/add attachments or delete the record, these tasks should be done with editor privileges. Because attachments should be added/deleted on page and the page also should be deleted after deleting record. Also adding label or rename/move page, etc..., all need edit permission.

Thanks again for your responses.

[Alex Medved _ConfiForms_]

We will fix the bug in the upcoming 2.19.1, but I cannot promise any "privileged actions" to be implemented. 

I suggest to look into APIs that Confluence provides and set ConfiForms to use them through a "privileged user you set up". But this approach, as noted earlier is not a safe thing to do, as it could be used by others in their forms.

The things you listed should be possible to do by the user himself when the page gets created

Alex

[Amir]

Hi again. I think this issue hadn't fixed in version 2.19.1. Am I right?

[Alex Medved _ConfiForms_]

It was fixed in 2.19.1 and works as designed. 

Here is a demo http://recordit.co/w6oUkrcZ61

Alex

[Amir]

Yes, You're right. Thanks again

Now I should find a way to move attachments, rename page, add labels, delete page on deleting record and other works on page as an admin user in the IFTTT created page...