Description
Some macros support Parameter Restrictionsparameter restrictions, offering a means to apply more granular restrictions. The Macro Security Managed Macros page details which macros support Parameter Restrictions parameter restrictions and the parameters that are available.
For instance, the SQL macro supports the following Parameter Restrictions parameter restrictions in addition to the "sql =" Use Restrictionuse restriction.
- sql.datasource
- sql.limit
- sql.disableAntiXss
- sql.querytimeout
The SQL macro's documentation explains what each of these parameters accomplishes, but the syntax entry within the properties file Macro Security app configuration screen is similar to what is described on the Using Use Restrictions page.
There are some special caveats about Parameter Restrictionsparameter restrictions:
- A
- parameter restriction only applies when the user tries to change the parameter value to something different than the default.
- If a
- parameter restriction is defined for the limit parameter (available on the SQL, SQL File and SQL Query macros),
- it is only put into effect if the user provides a parameter value that is greater than the Limit Rows Processed setting that an administrator sets in the SQL
Parameters that are "By Value"
Some of the Parameter Restrictions parameter restrictions documented on the Macro Security Managed Macros page are noted as being "(by value)". This allows even more specificity about how the Parameter Restriction parameter restriction is to be applied.
For the SQL macro, only the datasource parameter is "by value." This means that you can add ".*" to the end of the parameter to have it apply to all names (of datasources, in this example) or you can add entries for one or more specific datasource names.
| Parameter Restriction |
|---|
| Meaning | |
|---|---|
sql.datasource.* = confluence-administrators | Only members of the confluence-administrators group can use the SQL macro with its datasource parameter set to datasources of any name. |
sql.datasource.exampledb = confluence-administrators | Only members of the confluence-administrators group can use the SQL macro with its datasource parameter set to "exampledb" and only members of the hr-managers group can use the SQL macro with its datasource parameter set to "hr." |
How Parameter Restrictions Work with Use Restrictions
The Parameter Restrictions are applied "on top" of the Use Restriction use restriction for that macro. In other words, unless the Trusted Spaces approach for macro security is being used, an "edit" page restriction must match (only) whatever userids and/or group names are referenced in both the Use Restriction use restriction condition and the Parameter Restrictionparameter restriction.
The following table provides some examples of correct and incorrect combinations. In these examples, assume that userid "bswift" is not a member of any of the named groups.
| columnTypes | I,S,S,E |
|---|---|
| columnAttributes | ,width: 200px,, |
| App Configuration | "edit" Page Restriction(s) on page using the SQL macro | Result (  =Valid,  =Invalid) |
|---|
|
|
- confluence-administrators
|
sql = *ANY
sql.limit = confluence-administrators
|
| because |
| the user " |
| bob" is not listed in the |
| configuration entry for SQL nor is that user a member of the confluence-administrators group |
sql.datasource.exampledb =
| . | |
|
|
sql.datasource.hr = hr-managers
|
|
sql-query = *ANYsql-query.datasource.* = confluence-administratorssql-query.datasource.hr = hr-managerssql-query.datasource.finance = finance-managers- confluence-administrators
- hr-managers
- finance-managers
The 1st edit restriction must be present if a datasource other than "hr" and "finance" is used. The 2nd edit restriction must be present if the "hr" datasource is used. The 3rd edit restriction must be present if the finance" datasource is used. You could have all of these edit restrictions in place as well.
This example shows how to give access to all datasources to confluence-administrators and also give specific datasource access to different groups.
sql = confluence-administrators, trusted-users-sql
sql.limit = confluence-administrators
- confluence-administrators
- trusted-users-sql
sql = confluence-administrators, space:DEMO
The 1st edit restriction must be present if the "exampledb" datasource is used. The 2nd edit restriction must be present if the "hr" datasource is used. You could have both of these edit restrictions in place as well. |
Note too that the Use Restriction (sql = *ANY in this example) must be one of the following in order to support the 2 sql.datasource Parameter Restrictions listed:
- sql = *ANY
- sql = confluece-administrators, hr-managers
sql = confluence-administrators, space:DEMO
| If page is in the DEMO space:
| |
sql = confluence-administrators, space:DEMO
If page is in the DEMO space:
- bswift
 | If page is not in the DEMO space: confluence-administrators | |
sql = confluence-administrators, space:DEMO
If page is not in the DEMO space:
- no "edit" page restrictions
OR - bswift
because confluence-administrators is not referenced in "edit" page restrictions
