Can I set default global restrictions for Team Calendars?
Asked by James Carrington:

I want to set a global 'default' restriction on Team Calendars so that clients (who sit in a user group called "clients") cannot see (or edit) any calendars unless they are explicitly granted viewing (or editing) permissions.

Example: All calendars have restrict viewing from 'clients' user group. // I then select a specific calendar, grant 'view' access to a specific user by user name.

Please help! :o

Thanks, :)


Answers:
author: Jason Caragan
body: Hi James,

Afraid this isn't possible just yet, but we do have a [request](https://jira.atlassian.com/browse/TEAMCAL-536) for its implementation. Feel free to add your vote and set a watch on the issue to be notified of any updates.


author: Martin Moser
body: This is not only an embarrassing oversight in the design of the plugin, it is an extreme security risk for all companies using Confluence and Team Calendars professionally. Pay for something that was free before and get a security risk for your money.

Are there any known workarounds for this? :-(

comments: author: Martin Moser
body: FWIW, we decided to patch the plugin in the sense that we restrict creation of new calendars to a small group of users, making sure in this way that all calendars are actually created with a minimum of relevant restrictions to avoid the risk of exposing internal information involuntarily. All other users receive an error message when trying to create a calendar along with information on who to turn to.


author: RP Administrator
body: Hi Martin,

You mentioned a patch was applied to the plugin. Would you mind sharing what was done? I am very interested in the same restrictions for my environment.

Thanks


author: carolyn french
body: Late to the conversation, but would love to learn how you restricted new calendar creation too @Martin Moser


author: Martin Sander
body: It was not actually a patch to the plugin itself, but a plugin of its own (as Team Calendars is closed source even to paying customers). Using the servlet filter module \[1\], we just filter the urls that are used to create team calendars (post to /plugins/calendar/importsubcalendar.action, and put to /rest/calendar-services/1.0/calendar/subcalendars.json), and return an error page that the client side javascript of team calendars can interpret to display a "you are not allowed to create team calendars" message to the user.If users want a calendar, they have to write an email to a group which is excluded from above logic.Does that help?\[1\] <https://developer.atlassian.com/confdev/confluence-plugin-guide/confluence-plugin-module-types/servlet-filter-module>


author: carolyn french
body: I'm not very technical :(Do you have any code for the plugin that I can use?


author: Martin Sander
body: We might check if we can open source this, but as we are working for a company that makes money selling software, me might not get the permission to do so.


author: carolyn french
body: Ok, fair enough, I totally understand if you're not able to.


author: James Carrington
body: Thanks! :)


author: James Carrington
body: Hi there. The URL for the request does not appear to be working could you please check it? Thank you.


author: Jason Caragan
body: Doh, thanks James. Link fixed.


author: James Carrington
body: Hi there. The URL for the request does not appear to be working could you please check it? Thank you.


Tags: cloud

permission

restriction