Configuration
After installing HTML for Confluence, navigate to the HTML for Confluence Configuration screen:
Log in with the System Administrator's global permission.
Click the settings (gear) icon, then select Manage apps.
Either search for HTML for Confluence or scroll to Bob Swift Configuration, and click HTML to view app configuration.
Older Confluence versions
Click the settings (gear) icon, then select Settings > Atlassian Marketplace on the sidebar.
Scroll to Bob Swift Configuration and click HTML to view the configuration page.
The following configuration tabs are available:
Global Configuration
Use the toggles to enable or disable the Global Configuration settings.
Parameter | Default | Description |
|---|---|---|
Disable secure processing | Off | Allows the XSLT macro to use all XSLT features, including substituting XML entity references with their actual values. Available since 5.1.0. |
Restrict URL access | Off | Restricts access to remote locations through the Location parameters in the Html-bobswift and XSLT macros to URLs that conform to the Confluence Whitelist, if whitelisting is enabled. Available since 5.3.0. Known issue (Confluence 8.7+): if this option is disabled and the Confluence whitelist is enabled, URL content cannot be accessed. Enable |
Allow JavaScript | On | Controls whether JavaScript can be used in HTML for Confluence macros. Disable this to prevent users from adding JavaScript. Available since 5.4.0. You can also control JavaScript per-page using Macro Security for Confluence. See Macro Security Configuration and the Macro Security section below. |
Blacklist domains | Off | Blocks macro requests to a set of domains. Disabled by default for backward compatibility; if enabled, requests to a blacklisted site show an error instead. Available since 5.6.0. If this option is disabled, access to all domains is permitted. <expand title="Default blacklisted domains">
</expand> |
Blacklist domain values | Pre-defined set of domains | Comma-separated list of domains to blacklist. Only enabled if Blacklist domains is on. You can add to, edit, or remove from the pre-defined list. Available since 5.8.0. If Blacklist domains is enabled and this field is left blank, the pre-defined list above is used instead. |
Apply restrictions through Macro Security for Confluence
Since 5.7.0, the macro name changed from HTML to Html-bobswift. If you use Macro Security for Confluence to restrict macros, you now need entries for both names, since existing pages may still use the old name while new content uses the new one.
Already configured (no action needed)
Existing pages using the HTML macro name with Macro Security continue to work as-is. Their existing entries are:
html = *ANY
html.allowJavascript = *ANY
html.profile.* = *ANY
xslt = *ANY
xslt.profile.* = *ANY
Action required: add entries for Html-bobswift
For any new HTML content, add these entries in Macro Security for Confluence Configuration > Secured macros:
html-bobswift = *ANY
html-bobswift.allowJavascript = *ANY
html-bobswift.profile.* = *ANY
If these entries are missing, users see the error: "Security restricted macro with parameter 'profile' is not allowed. An edit restriction is required that matches the macro authorization list."
Profiles
Profiles are a shared set of parameters (URL, credentials, headers) for accessing external content. Available since 5.7.0. Use profiles to:
Keep authentication details hidden from page viewers and editors, visible only to Confluence administrators.
Reuse a shared URL configuration across multiple macros instead of repeating it.
Reduce page edits when a base URL changes, since macros reference the profile rather than a hard-coded URL.
Enter the base URL in the profile. Enter only the raw URL (the part after the domain, including any query string) in the macro's Location of HTML data or Location of XML data field. For example, for http://www.contoso.com/articles/recent.aspx, the raw URL is /articles/recent.aspx.
On this page, you can click the edit icon to edit a profile, or the remove icon to delete one. Click Add Profile to create a new one:
Parameter | Description |
|---|---|
Profile name | Name shown in the Profile field in macro editors. Must be unique, or it overwrites the existing profile of the same name. |
Profile type | URL (default), GitLab, or GitHub. |
URL | The base URL of the remote location. If Profile type is GitLab or GitHub, a default URL is pre-filled and editable. |
User | Username to access the URL, if required. |
Password | Password to access the URL, if required. Use either User/Password or Access token, not both. |
Access token | An access or API token for the connected application or service, used instead of User/Password. |
URL parameters | Extra query string parameters to append to the URL. |
Request headers | Auto-populated name/value pairs based on the profile's settings (for example, GitHub requires Authorization: token $accessToken). Add more pairs, comma-separated, if needed. |
Click Save profile to create the profile.
The Help us improve the product parameter was removed. We do not collect or transmit private user data or personally identifiable information. Refer to the Appfire Trust Center for EULA and other policies.