Thanks for the quick fix. Verified on our side with 9.96.5: same Confluence Cloud site backup, one space imported with rights enabled and no post-processing afterwards. The result is 17 XWikiGlobalRights objects on the space's WebPreferences, where 9.96.3 produced none, and our rights check reports no page below that space that is readable by everyone. So the spaceId fallback does what it should.
One part of my original report is still in the code, and I would like to ask how you want to handle it. ConfluenceInputFilterStream#sendSpaceRights still returns before the inherited home page rights are sent:
Collection<Object> spacePermissions = spaceProperties.getList(ConfluenceXMLPackage.KEY_SPACE_PERMISSIONS);
if (spacePermissions.isEmpty()) {
return;
}
…
if (inheritedRights != null) {
for (ConfluenceRight confluenceRight : inheritedRights) {
sendInheritedPageRight(homePageProperties, proxyFilter, confluenceRight);
}
}
With the spaceId fix this is far less visible, because the permission list is now filled for every space that has any space permission at all. What remains is the case of a space with no space permission but a view restriction on its home page: the restriction is dropped silently, and since Confluence inherits restrictions downwards, everything below that home page becomes readable. I did not hit that case in our own backup — every space there has at least one permission — so I have no reproduction to offer beyond the code path itself.
Would you like me to open a separate issue for this, or do you prefer to keep it here?
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.