Configure Macro Security

Once you have installed the Macro Security for Confluence add-on, it must be configured with a property file that identifies who can run each security-enabled macro. Each macro security enabled macro accepts specific parameters to controls its use. This safeguards your Confluence instance and data from misuse or performance issues caused by inexperienced users or inappropriate use.

Follow these steps to configure it:

1. Download the sample macro-security.properties file that is configured for moderate restrictions. This restricts most security-enabled macros so that only Administrators can execute them, but allows some others to be used by any user.

2. Review the file and ensure that the lines beginning with "sql-query.datasource.*", "run" and "run-now" are restricted to the confluence-administrators group as shown in the example configuration file to the right.

3. Save the file.
4. Create a Confluence page entitled Macro Security Configuration in a space accessible only to Administrators (or apply page-level restrictions so the page is accessible only to Administrators) and attach the file to it. Take note of the space key of the space. The space key appears in the URL of the page after you've saved, immediately after "display/". For instance, in the URL http://wiki.examplegear.com/display/admin/Macro Security Configuration, the space key is admin.
5. Go to Manage Add-ons administration screen, locate the Macro Security add-on and click its Configure button. This will take you to the Macro Security configuration screen.
6. In the Load Security Configuration section, supply the location of your macro-security.properties file, in the form of spacekey:pagetitle^filename such as admin:Macro Security Configuration^macro-security.properties and click Load.
7. Select the Enable button and click Save.

# See the documentation space - https://bobswift.atlassian.net/wiki/display/CMSP
# More specifically:
# - managed macros: https://bobswift.atlassian.net/wiki/display/CMSP/Macro+Security+Managed+Macros
#
# Macro security is enabled/disabled from the UPM configure link for Macro Security for Confluence
# Property setting are loaded from the same configuration screen.
#
# Property settings here can restrict use of some powerful macro capabilities to trusted users
#   while still allowing non-trusted users to view content created by using these macros
# - this is accomplished by requiring those pages using the restricted macros
#   are controlled by trusted users
#   - a page is controlled by having edit capabilities restricted to a group
#     that is identified as being trusted in the properties file
#   - a page is also considered to be controlled if it is in a permitted space
#
# Property file
# - The property file can be loaded from any file location on the Confluence server or from an attachment
#
# No specific configuration
# - Add-ons can implement their own rules if there is no specific configuration found
#   depending on what they are restricting
# - Standard/default is
#   - Configuration entry must be specified if the macro is restricted
#     - *ANY can be used to allow all use (run is an example where *ANY is a likely use)
#   - Some macros have additional, finer grained (parameter level) restrictions
#     - these MUST also have something specified, otherwise macro use is not authorized
#   - Some macros only restrict a specific parameter
#     - these generally do not have to be specifically configured for use
#
# Property keys and values are case sensitive
#
# Property values are a comma separated list of groups or space names
# - the page edit restriction must match one of the groups listed
# - no other users or groups can be permitted to edit the page
# - use *ANY to indicate no restriction
#

# SQL - https://bobswift.atlassian.net/wiki/display/SQL
sql = confluence-administrators
sql.datasource.* = confluence-administrators
sql.datasource.testDS = *ANY
sql.limit = confluence-administrators
sql.disableAntiXss = confluence-administrators
sql.querytimeout = confluence-administrators

sql-query = confluence-administrators
sql-query.datasource.* = confluence-administrators
sql-query.datasource.testDS = *ANY
sql-query.limit = confluence-administrators
sql-query.disableAntiXss = confluence-administrators
sql-query.querytimeout = confluence-administrators

# Live template support - https://bobswift.atlassian.net/wiki/display/CMSP/Live+Template+Support
sql-query&live-template.datasource.* = *global

# Script - https://bobswift.atlassian.net/wiki/display/SCRP
beanshell = confluence-administrators
groovy = confluence-administrators
gant = confluence-administrators
jython = confluence-administrators

# HTML - https://bobswift.atlassian.net/wiki/display/HTML
html = confluence-administrators
xslt = confluence-administrators

# Run CLI Actions - https://bobswift.atlassian.net/wiki/display/CCLI
cli = confluence-administrators
cli.profile.* = confluence-administrators
cli.product.* = confluence-administrators
cli.directory.* = confluence-administrators
cli.datasource.* = confluence-administrators

include-remote = confluence-administrators
include-remote.profile.* = confluence-administrators

# Cache - https://bobswift.atlassian.net/wiki/display/CACHE
cache = *ANY
future = *ANY
future.timeout = confluence-administrators

# Run - https://bobswift.atlassian.net/wiki/display/RUN
run = confluence-administrators
run-now = confluence-administrators
run.disableAntiXss = confluence-administrators

# Advanced Tables - https://bobswift.atlassian.net/wiki/display/TBL
csv.url.* = *ANY
csv.disableAntiXss = confluence-administrators
json-table.url.* = *ANY
json-table.disableAntiXss = confluence-administrators

# Excel - https://bobswift.atlassian.net/wiki/display/XL
excel.url.* = *ANY
excel.disableAntiXss = confluence-administrators

# Flash - https://bobswift.atlassian.net/wiki/display/FLASH
flash.url.* = confluence-administrators

# Markdown - https://bobswift.atlassian.net/wiki/display/MARKDOWN
markdown.allowHtml = confluence-administrators
markdown-attachment.allowHtml = confluence-administrators
markdown-url.allowHtml = confluence-administrators

# Code Pro - https://bobswift.atlassian.net/wiki/display/CODE
code-pro.url = *ANY
code-pro.profile.* = confluence-administrators

Macro Security Configuration page, after loading the macro-security.properties file:

Create Confluence page

Create a Confluence page that will eventually contain the macros needed to produce the chart.

1. Create a page named Sales By Product in a space accessible to the desired audience.
2. Click the Unrestricted button to open the Page Restrictions screen.
3. Click the Restrict editing radio button.
4. Start typing confluence-administrators in the text box and select that group name from the list of suggestions to apply an edit restriction to that group. This restriction is being added so that Macro Security managed macros can be used.
5. Click Save to close the Page Restrictions screen.
6. Click Save to save the new page.

Configure the Chart macro

Edit the Sales By Product page and do the following:

1. Insert the Chart macro.
2. Click the Chart macro container and click Edit so you can adjust its parameters as shown on the right.
   • The Type parameter indicates to display a pie chart.
   • The Width parameter indicates the width of the chart in pixels.
   • The Height parameter indicates the height of the chart in pixels.
   • The Display rendered data parameter indicates that a data table should be displayed after (below) the chart.
   • The Chart Title parameter provides a title for the chart.
   • The Content Orientation parameter indicates that the data will be derived from the data rows rather than the data columns. You will be defining the data in the next step when you configure the SQL Query macro.
3. Click Save to save your changes to the Chart macro's parameters.

Configure the SQL Query macro

This step uses the SQL Query macro, which is part of the SQL for Confluence (Pro Edition) add-on, to retrieve the data that will be displayed in the pie chart. To configure the SQL Query macro, do the following:

1. With the cursor positioned inside the Chart macro container, insert the SQL Query macro.
2. Adjust its parameters as shown on the right.
   • The Data source name parameter indicates to use the examplegeardb data source profile that you set up when installing the Examplegear database.
   • The Use database column labels parameter indicates to use the column names defined within the SELECT statement (e.g., Product, Revenue) rather than the columns names defined within the database table(s) themselves.
   • The Show error if there are no rows parameter indicates to show an error if no rows are returned in the resultset of the SQL query.
   • The Text to display when there are no rows parameter indicates the text of the error message to be displayed when no rows are returned in the resultset of the SQL query.
3. Click Save to save your changes to the SQL Query macro's parameters.

4. With the cursor positioned inside the SQL Query macro container, paste in these SQL statements:

   Code Block
   language sql theme DJango linenumbers true
   SELECT P.BaseProductName AS Product, ROUND(SUM(S.SubTotal)) As Revenue FROM Sales S INNER JOIN LineItems LI ON S.SalesID = LI.SalesID INNER JOIN Products P ON LI.ProductID = P.ProductID GROUP BY P.BaseProductName ORDER BY 2 DESC;

Sales By Product page, in Edit mode:

Save and test the page

Click Save to save the Sales by Product page. You should now see a page that appears as shown on the right. The pie chart is shown, with the data table appearing after it.

If you see an error such as "Error rendering macro 'sql-query' : com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException", then check the syntax of the SELECT statement within the SQL Query macro container.

If you see an error such as "Error rendering macro 'sql-query' : Unable to connect to database", then verify that the SQL Query macro's Data source name parameter is set to the correct value and that the examplegeardb data source profile was set up per the installation instructions.