Using Parameter Restrictions

Some macros support Parameter Restrictions, offering a means to apply more granular restrictions. The Macro Security Managed Macros page details which macros support Parameter Restrictions and the parameters that are available.

For instance, the SQL macro supports the following Parameter Restrictions in addition to the "sql =" Use Restriction.

sql.datasource
sql.limit
sql.disableAntiXss
sql.querytimeout

You would need to look at the SQL macro's documentation to understand what each of these parameters accomplishes, but the syntax within the properties file is similar to what is shown above under Use Restrictions.

There are some special caveats about Parameter Restrictions:

A Parameter Restriction only applies when the user tries to change the parameter value to something different than the default.
If a Parameter Restriction is defined for the limit parameter (available on the SQL, SQL File and SQL Query macros), it is only put into effect if the user provides a parameter value that is greater than the Limit Rows Processed setting that an administrator sets in the SQL add-on's configuration.

Parameters that are "By Value"

Of the above Parameter Restrictions, per the Macro Security Managed Macros page, only the "sql.datasource" parameter is noted as "(by value)". This means that you can add ".*" to the end of the parameter to have it apply to all names (of datasources, in this example) or you can add entries for one or more specific datasource names.

Parameter Restriction	What It Means...
sql.datasource.* = confluence-administrators	Only members of the confluence-administrators group can use the SQL macro with its datasource parameter set to datasources of any name.
sql.datasource.exampledb = confluence-administrators sql.datasource.hr = hr-managers	Only members of the confluence-administrators group can use the SQL macro with its datasource parameter set to "exampledb" and only members of the hr-managers group can use the SQL macro with its datasource parameter set to "hr."

On this page:

How Parameter Restrictions Work with Use Restrictions

The Parameter Restrictions are applied "on top" of the Use Restriction for that macro. In other words, an "edit" page restriction must match (only) whatever userids and/or group names are referenced in both the Use Restriction condition and the Parameter Restriction.

The following table provides some examples of correct and incorrect combinations: