createpage-entervariables.action? is forbidden in version 9.2.3

[Roman Joss]

We are on the way to update Confluence from version 8.5.19 to 9.2.3. 
Here we encountered a problem with a user macro that dynamically assembles a URL to create a new Confluence page using a URL.

We call the following URL: 

https://<base-url>/pages/createpage-entervariables.action?templateId=1110016002&spaceKey=SYST&newSpaceKey=SYST&title=NewPage_111&fromPageId=1113784608

Message:
Your request could not be processed because a required security token was not present in the request. You may need to re-submit the form or reload the page.

Status Code: 403 Forbidden

With version 8.5.19 there is no problem, the new page is created 
With version 9.2.3 we get th above error-message.

Question

Is there a security-configuration to enable the create-page-action?
createpage-entervariables.action

Thanks for hints, ideas and suggestions to activate the 'createpage-entervariables.action?'
Roman

[Stephen Deutsch · Accepted solution]

Hi @Roman Joss

I tried, and it seems that Confluence has neutered user macros in Confluence 9.0 and greater, greatly limiting access to system variables. Normally, you could generate a token fairly easily, but now the only way I can see (without adding something to the startup configuration) is to get it from the frontend, as you mentioned in your comment. This is what I came up with based on what you submitted so far, perhaps it can help:

## @noparams

#set ( $pagecreateUrl = "/confluence/pages/createpage-entervariables.action?templateId=1110016002&spaceKey=SYST&newSpaceKey=SYST&title=NewPage_111&fromPageId=1113784608" )
#set ( $paramBreite = "200px" )
#set ( $paramButtonName = "Create Template" )

<a class="create-page-link" href="$pagecreateUrl">
<button class="aui-button aui-button-primary" style="width:$paramBreite">$paramButtonName</button></a>

<script>
for (createLink of jQuery('.create-page-link')) {
  createLink.href += ('&atl_token=' + AJS.Meta.get('atl-token'));
}
</script>

[Roman Joss]

Hi @Stephen Deutsch 

This is great! It works perfectly, thank you very much! You saved me and our switch to Confluence 9.2.x. !

Next year we want to go to the cloud, and until then we have to find solutions for the user macros. This is one of them which we use very often.
Have you ever seen anything about how such functionality could be provided in the cloud? Do you know how this could be implemented in the cloud or would we have to develop it ourselves as an addon?
Thank you again.

[Stephen Deutsch]

Well, I'm not sure if you need extra customization, but there is a "Create from Template" macro which does something similar to what your current user macro does.

However,

1. it's not as customizable (button width, color, page location, etc.)
2. you would have to migrate all your existing user macros to this macro, which could be a lot of work.

What you could do is to develop an addon using Forge with a macro with the same name as the user macro, and you might be able to migrate it automatically. With UI Kit, it is not difficult to create such a button, not much more difficult than creating a user macro. However, I have not yet researched if it is possible to find/generate an atl_token from Forge for the link.

[Roman Joss]

Hi @Stephen Deutsch 

I've just recognised your post from 2017 where you explained how to get the atl_token in a usermacro.
https://community.atlassian.com/forums/Confluence-questions/User-Macro-Add-parameter-value-to-AddLabel/qaq-p/665943

As of my search, I have to enhance the url with the atl_token. 
I'm trying to put your tip in my usermacro, but I'm not familiar with jQuery. Please, can you help me to enhance the created url with the atl_token as you mentioned in your post?

jQuery("#atlassian-token").attr("content")

Currently I use the following code to show a Button to create new Pages with defined label at the defined page:

<a href="$pagecreateUrl">
<button class="aui-button aui-button-primary" style="width:$paramBreite">$paramButtomName</button></a>

Do I have to replace the buttom?

Many thanks.
Regards, 
Roman