OneView for Confluence

OneView gives teams a single, consistent viewer for all major attachment types directly inside Confluence pages. Instead of downloading files or switching to external tools, readers preview PDFs, images, media, code, structured data, Office documents and CSV tables in one unified workspace.

The app does one job: show the files attached to this page. It has no settings, no administration page and nothing to configure. v3.0.0 removed the file policy page along with everything it configured — blocked extensions, media-type filtering, size ceilings, the watermark and the audit toggle — because those controls hid files without protecting them, and worked against the point of the app.

OneView ships as a single, fully-featured edition. There is no Community/Enterprise split and no Marketplace licensing gate; nothing in the app reads context.license. Every install gets every feature.

The viewer lists every current attachment on the page — including ones already inserted into the page body.

An earlier version excluded embedded files, on the theory that Confluence already previews them so a second viewer would be redundant. That was wrong in a way that mattered: audit logging and integrity verification only apply to a file opened through the macro. A reader who opened an embedded PDF via Confluence’s own inline preview bypassed both, silently. Hiding embedded files undermined the exact guarantees the app exists to provide.

A file is recognised as embedded by checking both Confluence body formats, because they reference attachments differently: atlas_doc_format (modern editor) carries a Media Services id on media/mediaInline nodes, while storage (classic editor) carries ri:filename on <ri:attachment>. A match on either the media file id or the file name counts.

Referenced is not the same as displayed. Ordering keys on whether the page actually renders the file’s content, never on whether it merely references it — so a PDF attached as a chip, or shown only as a first-page thumbnail, stays in its normal type group. Errors are deliberately biased toward the main list: a file wrongly left out of the collapsed group merely appears where everything used to appear; a file wrongly put in it gets buried when the macro is the only way to read it.

Fail-open by design. If no page body can be read, every attachment is flagged as not-embedded rather than guessed — a transient API failure loses the badge, never a file.

Who this is forAnyone who can read the page. Inserting the macro needs page-edit rights; nothing here needs an administrator.

OneView adds one Confluence macro — Page Attachments Content Viewer — and has no settings of any kind. Insert it on a page and it lists that page’s attachments.

1. Add the macro to a page

   Open the page in the editor, type / (or use the insert-elements + button), search for Page Attachments Content Viewer, and place it where you want the viewer to appear. Publish or update the page.

   If more than one environment of the app is installed on your site — development and staging, say — the picker shows near-duplicate entries. The label under the inserted macro node tells you which one you actually placed.

2. Browse the files

   The macro is a two-pane layout: a file list on the left, the active preview on the right. Files are grouped by type — PDF, Documents, Presentations, Spreadsheets, Images, Video, Audio, Markdown, Code & Text, Data, CSV, Other — and counted per group.

   Search files… filters by name as you type, the sort dropdown reorders by name or size, and Load More appears when the page has more attachments than the first page of results.

3. Open a file

   Click any file to load it. The viewer header shows the format, media type and size, plus any relevant badges — including “Also embedded in page” when the page already displays that file inline.

   Files the viewer cannot render are never hidden: the card names the format and, where re-saving genuinely helps, the modern format to re-save as. Spreadsheets say plainly that there is no spreadsheet renderer in this release and that a CSV export of one sheet does preview.

4. Verify a file’s integrity

   With a file selected, click Verify Integrity. OneView computes a SHA-256 digest server-side and displays it under the viewer header — useful as evidence of custody in regulated environments. This works for every listed file, including ones also embedded in the page body.

5. Pin a file, if the page should open on one document

   Select the file and click Pin File. The macro switches to pinned mode for every reader of that page and hides the file browser; Unpin restores normal browsing.

   Pinning changes what every viewer of the page sees, so it requires page-edit rights.

6. Download, when you need the file itself

   Use the page’s own attachment list. That is not a workaround — it is the correct route. Confluence checks your permission on the attachment at the moment you download it, which a link inside the macro could not do.

   Nothing about your access changes as a result: the macro has always read attachments as you, never with elevated app permissions, so no file was ever reachable through it that you could not already open in Confluence.

No write scopes are requested for Confluence content. OneView never creates, edits or deletes pages, attachments or comments. The scope set has shrunk over the last three releases rather than grown: read:user:confluence and read:confluence-user were briefly added while chasing the site-administrator check behind the admin policy page, and removing that page removed their only caller. The app now reads attachments and page bodies, and nothing about people. v3.0.0 requests no new permission, so no existing installation needs administrator re-consent.

No end-user identity is ever stored. The audit event writer explicitly nulls accountId, userId, userEmail and ipAddress before persisting. This is enforced in code, not policy, and is covered by an automated test. The legacy app-policy:v1 record written by v2.5.0–v2.7.0 is no longer read by anything; it is left in place rather than deleted, because deleting customer data on upgrade is a worse default than ignoring it.

• Spreadsheets (.xls, .xlsx, .xlsm, .ods) are not rendered inline. A CSV export of a single sheet does preview.
• Office templates (.potx, .dotx) are deliberately not previewed — they generally hold layouts with no content, so a preview would be blank.
• The macro is view-only. It offers no download or open-in-new-tab action for any format; downloads go through the page’s own attachment list.
• There is no administration page and no configurable policy. Inline text preview is capped at a fixed 5 MB.
• Attachment version comparison and diff view are not available.
• Annotation storage — bookmarks, highlights, comments — is not implemented.

Version history for OneView for Confluence. The most recent release is listed first.

1. v3.0.0 August 17, 2026 Current

   One job, done plainly: show the files attached to this page.

   • The file policy administration page has been removed, along with everything it configured — blocked extensions, blocked media types, the maximum attachment size, the watermark and the audit-trail toggle. Three reasons, and the first is the honest one: (1) it never worked — its size fields rejected every whole number, so the browser refused to save the values the page itself had loaded, and behind that the site-administrator check relied on a permission the app had never asked Confluence for, so it turned away genuine site administrators; (2) its main controls hid files without protecting them — a blocked .exe or an oversized attachment stayed exactly where it was, one click away in the page’s own attachment list; (3) it worked against the point of the app, which exists to show what is attached to the page.
   • What changes for you. If a file on one of your pages was being withheld by the blocklist or the size limit, it will now appear in the list — the intended result. Nothing new becomes reachable: the macro has always read attachments as you, with your own Confluence permissions, and every file it now lists was already visible in the page’s own attachment list.
   • Nothing to reconfigure, and no permission prompt. Any settings previously stored are simply ignored. This release requests no new permissions — two were dropped — so no administrator needs to approve anything.
   • The watermark is gone with the page that configured it. It was a diagonal overlay drawn on the preview: a visual marker of provenance, never a protection mechanism, and impossible to switch on once the settings page went away.
   • Files that cannot be previewed are still explained, never hidden. The viewer names the format and, where one exists, the modern format to re-save as. Very large text files say how much they exceed the inline limit instead of rendering blank.
   • Slightly faster to open — the macro no longer reads a settings record on every load.
2. v2.7.0 August 17, 2026

   The file policy page is findable, and the app signs its own surfaces.

   • A Configure link on Manage apps. The policy page previously had exactly one entry point: the very bottom of Confluence administration’s left sidebar, inside an Apps section that is collapsed by default. Admins who went to Manage apps first — which is most of them — found nothing at all and reasonably concluded the app had no settings.
   • The app mark now appears on its own surfaces. Confluence supplies page chrome but nothing that says which app you are looking at, so a settings page reached from a sidebar of a dozen unrelated entries was unlabelled, and the macro read as part of the page body rather than as an app.
   • Superseded by v3.0.0, which removed the policy page entirely. The app mark stayed.
3. v2.6.0 August 17, 2026

   The viewer stops handing out files, and the formats that showed a blank panel show something true instead.

   • Download and open-in-new-tab links are gone. The macro is view-only. Those links pointed at content already loaded into the reader’s browser, which means nothing re-checked their permission at the moment they used one, and nothing was written to the audit trail. Downloads now happen where they always should have: the page’s own attachment list, where Confluence re-authorizes every request. No one loses access — OneView has always read attachments as the signed-in user.
   • Fixed: Excel files showed an empty white panel. The check that recognises XML documents used a substring match, and every Office Open XML media type contains “xml” inside “openxmlformats” — so .xlsx was treated as an XML document and, with no text to display, drew an empty box with no error. .potx and .dotx did the same. All three now get a card that names the format.
   • Fixed: .xls files were given advice that could not work. The viewer told readers to re-save as .xlsx — which lands on exactly the same “not previewed” card, because the gap is the renderer, not the format. Formats where re-saving genuinely helps still say so; spreadsheets and templates now get honest, separate explanations.
   • Fixed: text files Confluence had mislabelled showed nothing. The server decided whether a file was text from its media type while the viewer chose its renderer mainly from the file name — and for ordinary text Confluence very often stores application/octet-stream, so .yml, .properties, .toml and .log files were fetched and then rendered as an empty panel.
   • Fixed: TypeScript files opened in a video player. Most MIME tables map .ts to video/mp2t. A text or code file extension now outranks a generic media-type family.
   • Fixed: a .ppt could reach the PowerPoint renderer and produce a raw parser error — the deck renderer tried to open an OLE binary as a ZIP archive. Legacy formats are identified by extension first.
   • PowerPoint failures are explained rather than left as debug output. When a slide or a single shape cannot be drawn, the deck carries a short notice naming what was left out and confirming the rest is unaffected.
   • Files that cannot be previewed are no longer downloaded. The bytes fed nothing but the removed download link.
4. v2.5.0 August 17, 2026

   Watermarking can finally be switched on, and the audit log stops burying its own evidence.

   • A file policy page in Confluence administration — watermark text, the direct download toggle, the audit-trail toggle, size ceilings and the blocked extension/media-type lists, site-wide and site-admin only. This closed a real gap rather than adding polish: watermarking had been advertised since v2.0.0 but defaulted to off with no way for any customer to turn it on. (Both the page and the watermark were removed in v3.0.0 — see above.)
   • The audit log no longer records its own polling. An open macro re-checks for new attachments every three minutes, and each check was written to the page’s audit trail. With 500 events retained per page, routine polling steadily evicted the pin, integrity-check and policy-change records the log exists to keep.
   • Stored policy is validated when it is read, not only when it is written. A policy value that reached storage without passing the sanitizer could previously break attachment listing for an entire installation.
   • Blocked files are acknowledged instead of vanishing. When admin policy withheld a file, the list said how many were hidden — never naming the file or the rule.
   • Presentations and spreadsheets get their own groups in the file list, instead of sharing one “Documents” heading with Word files.
   • CSV previews count honestly. The row limit now means 200 data rows rather than 199 plus a header, the header is a real sticky table header, and the truncation note appears only when rows were actually dropped.
   • Slideshow and macro-enabled Office files now render. .ppsx, .pptm, .ppsm and .docm were previously turned away even though they are the same ZIP-of-XML package as .pptx/.docx. Macros are never executed.
   • Legacy Office files explain themselves. A .ppt, .doc or .xls used to produce a generic “Preview not available”, with the format shown as the implementation word “Fallback”.
   • Accessibility: the file search field has a proper accessible name, and the open file is marked with aria-current rather than relying on colour alone.
   • New app icon, redrawn for the 24–32px the macro picker actually renders it at.
   • Removed two unused resolvers. getAttachmentText duplicated getAttachmentViewData under a second rate-limit bucket; getEditionInfo returned data already present on getAppPolicy.
5. v2.4.1 August 10, 2026

   Dependency security pass, and a release gate so it stays that way.

   • DOMPurify upgraded to 3.4.13 (from 3.4.12), closing advisory GHSA-55q2-fjhq-7xh7 — a sanitizer bypass in which removing a hook during IN_PLACE processing can leave a detached subtree executable. DOMPurify sits directly in the path that renders untrusted .docx files, so it is not somewhere to carry a known advisory. The flaw was not exploitable here — it requires IN_PLACE mode with registered hooks, and OneView uses neither, passing a string in and a string out against a strict tag and attribute allow-list. It was upgraded regardless.
   • Two further advisories cleared: fast-uri (high severity), reachable transitively through the Forge API package, and nanoid (high severity) in the build toolchain, which never ships in the deployed app.
   • A release gate now enforces this. npm run audit checks the production dependency trees of both the resolver and the Custom UI in a single command and exits non-zero on any advisory. It runs as the first step of npm run preflight — audit, then the full test suite, then the production build — so a release cannot be cut on a vulnerable tree.
   • A documented security incident response plan was added, setting out severity classification against the CVSS-tiered fix deadlines, the 24-hour notification obligation, six-hourly progress updates, and customer notification within 72 hours.
   • No functional changes. No settings, permissions or macro changes are required, and nothing a reader can see or do has changed.
6. v2.4.0 August 4, 2026

   The viewer no longer opens onto a copy of something you just scrolled past.

   • Images the page displays inline are no longer opened by default. OneView now opens on the first file whose content a reader cannot already see. Previously a page with an inline banner image would often open showing that same image again.
   • A new “Already shown on this page” section collects those images at the bottom of the file list, collapsed, with a count. It expands on one click, and opens automatically when it is the only section or when a file inside it is being viewed.
   • Only genuinely visible content is treated this way. A file attached to a page as a chip — the card showing a file name and a thumbnail — is referenced by the page but not displayed by it, so PDFs, slide decks and documents attached that way stay in their normal type groups.
   • The viewer header now explains the duplicate instead of merely noting it: opening a file through OneView is what writes the audit entry and enables the SHA-256 integrity check. Confluence’s own inline preview does neither.
   • Nothing is hidden. Every attachment remains listed and selectable — this release changes what is in front, not what is available. Pinned macros are unaffected.
7. v2.3.0 July 30, 2026

   PowerPoint charts and SmartArt now render; dependency security hardening.

   • The hand-written slide renderer was replaced with a maintained, visually regression-tested library. Charts and SmartArt now render, and fidelity improved across text, tables, bullets, images and gradients.
   • Fixed an intermittent multi-second freeze when moving between slides, caused by a resize feedback loop between the renderer and the Confluence iframe.
   • Resolved a high-severity vulnerability in a transitive dependency (brace-expansion, reachable via the Forge API package), and migrated app storage to the current Forge KVS API in the same change.
   • No known vulnerabilities remain in the app’s production dependencies as of this release.
8. v2.2.0 – 2.2.2 July 30, 2026

   PowerPoint attachments render as real slides rather than extracted text.

   • PPTX previews gained real slide geometry: positioned text with correct size and styling, background colours, embedded images, grouped shapes and theme colours.
   • Added tables, bullet and numbered lists, vertical text alignment, autofit scaling, shape borders and gradient fills.
   • Fixed a defect where most slides rendered blank because placeholders inheriting their position from the slide layout were skipped.
9. v2.1.0 July 30, 2026

   Every attachment is viewable through OneView, including files embedded in the page.

   • Files inserted directly into the page body were previously excluded. That removed OneView’s compliance features — audit logging and integrity verification — from exactly the files most likely to be read, since those apply only to a file opened through the macro.
   • Embedded files are now listed and flagged with an “Also on page” tag rather than hidden.
   • Reliability fix: the underlying check now uses Confluence’s current v2 REST API. The previous implementation depended on an endpoint some sites have retired, which had silently disabled the check on those sites.
10. v2.0.0 July 23, 2026

    Compliance and security release.

    • Integrity verification — one-click SHA-256 digest of any attachment, computed server-side and shown in the viewer header.
    • Compliance digest — an aggregated, non-identifying summary of recent activity for the current page, available to space administrators.
    • Watermarking — a configurable diagonal overlay rendered over every preview. (Removed in v3.0.0; it had no way to be switched on until v2.5.0 and no protective effect once it was.)
    • Custom blocklists and larger limits: inline text preview to 20 MB, attachment size to 5 GB, audit retention to 500 events per page.
    • Hardening: every resolver validates its inputs against a strict allow-list, per-endpoint rate limiting was added, and the audit writer explicitly drops all user-identifying fields before anything is stored.
    • OneView ships as a single, fully-featured edition — every install receives every feature, with no licensing gate.
11. v1.0.1 July 21, 2026

    Presentation and documentation refinements.

    • Improved information hierarchy, workspace framing and attachment-browsing states in the viewer.
    • Clearer end-user documentation.
12. v1.0.0 July 19, 2026

    Initial release.

    • Attachment discovery and listing for the current Confluence page, with pagination, filtering and sorting.
    • Inline viewer support for PDF, images, audio and video, Markdown, code and text, JSON, XML, YAML, TOML, and CSV table preview.
    • Ability to pin one attachment to a macro instance so a page highlights a primary document.
    • Policy-driven controls: maximum inline text size, maximum attachment size, download toggle, blocked extensions, blocked MIME prefixes and an optional watermark label.
    • Server-side filtering of disallowed file types before any content reaches the browser.