Issue Details (XML | Word | Printable)

Key: JRA-8950
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: Critical Critical
Assignee: Mark Chaimungkalanont [Atlassian]
Reporter: Erik S
Votes: 0
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
JIRA

"Current Assignee" on Browse Permission creates security hole

Created: 05/Jan/06 07:13 PM   Updated: 10/Feb/08 05:09 PM
Component/s: Permissions Security
Affects Version/s: 3.4.2
Fix Version/s: 3.5

Time Tracking:
Original Estimate: 7 hours
Original Estimate - 7 hours
Remaining Estimate: 5 hours
Time Spent - 2 hours Remaining Estimate - 5 hours
Time Spent: 2 hours
Time Spent - 2 hours Remaining Estimate - 5 hours

File Attachments: 1. File CurrentAssigneeHasAssignablePermission.class (3 kB)

Issue Links:
Duplicate
Reference

Participants: =Neal Applebaum, David Feldman, Dylan Etkin [Atlassian], Erik S and Mark Chaimungkalanont [Atlassian]
Since last comment: 2 years, 30 weeks, 4 days ago
Resolution Date: 12/Jan/06 05:04 PM
Labels:


 Description  « Hide
Adding "Current Assignee" to the Browse permission for a project lets any user of the system see that project (they can't necessarily view issues or create issues, but they can see the project).

 All   Comments   Work Log   Change History      Sort Order: Ascending order - Click to sort in descending order
Mark Chaimungkalanont [Atlassian] added a comment - 05/Jan/06 10:55 PM
This is a similar problem to JRA-4935 I believe.

Erik S added a comment - 06/Jan/06 09:38 AM
Yes it is a similar problem.
Our desired behaviour is that if the "Current Assignee" is used in the Browse premission then a user can see a project if there is an issue currently assigned to them in that project. However, if they don't have any issues assigned to them then they don't see the project in any project list. (Of course, if a particular user has access via another Browse permission then they would see the project regardless)

=Neal Applebaum added a comment - 06/Jan/06 10:33 AM
What if the only issues that are assigned to someone are all closed? Would you still want that user to be able to browse the project? I would think they would be able to, based on what you described above.

Erik S added a comment - 06/Jan/06 11:10 PM
Yes, I'd want them to still be able to see the project even if all the issues assigned to them were closed.

Mark Chaimungkalanont [Atlassian] added a comment - 08/Jan/06 09:32 PM
Erik,

The problem here is perfomance. To implement this feature properly, we need an efficient way to determine whether the user has issues assigned to them or not. Performing a search for each permission check will cause the system to slow down significantly,especially since permission checks are performed constantly.

A workaround that we gave the users for JRA-4935 was to have a special permission where projects were only visible if the user also had the "create issue" permission. We can do a similar thing here and display the project if and only if the user has the Assignable permission.

That way only users who could have issues assigned to them will be able to see the project, even if they do not have issues assigned to them at the moment. Will this be acceptable for now?

Cheers,

Mark C


Erik S added a comment - 09/Jan/06 01:05 PM
Mark,

Yes, that would be an acceptable solution for now.

Thanks,
Erik


Mark Chaimungkalanont [Atlassian] added a comment - 09/Jan/06 04:59 PM
Erik,

You will need to copy the file CurrentAssigneeHasAssignablePermission to the path \com\atlassian\jira\security\type in your JIRA install and add the lines below to your permission-types.xml and restart JIRA.

<type id="assigneeassignable" enterprise="true">
    <class>com.atlassian.jira.security.type.CurrentAssigneeHasAssignablePermission</class>
</type>

You can now choose a "special" permission type that will hide the projects if you don't have ASSIGNABLE permission.

Let us know how you go with this.

Cheers

Mark C


Erik S added a comment - 12/Jan/06 09:12 AM
Mark,

Thanks for the quick turnaround on this one. I'm eager to get this into our system, but I'm swamped right now. I'll let you know how it works for us, when I get a chance to plug it in to our system.

Thanks again.
Erik


Mark Chaimungkalanont [Atlassian] added a comment - 12/Jan/06 05:03 PM
Erik,

That's no worries, I'll resolve this issue for now (we're trying to clear out 3.5 issues). I've tested it locally and it seems to work as stated fine. Feel free to reopen the issue if you have problems with it once you get a chance to patch it.

Cheers,

Mark C


Erik S added a comment - 15/Jan/06 08:09 PM
When I view the "Add Permisson" screen, the new permission shows up, but the name is listed as

admin.permission.types.current.assignee.has.assignable.perm

It would be nice if that was cleaned up.


Erik S added a comment - 15/Jan/06 08:15 PM
Would "Current User Has Assignable Permisson" be a more accurate name for this?

Also, I've checked it out on our system and functionally it works as we need it to. Thanks again for the quick turnaround.


Mark Chaimungkalanont [Atlassian] added a comment - 15/Jan/06 09:22 PM
Erik,

Apologies for the oversight! The actual title should be "Assignee (show only projects with assignable permission)". The process is slightly complicated if you want to change this in your installtion. You'll need to unzip the jar language_default.jar, find the file JiraWebActionSupport.properties and add the line below to it.

admin.permission.types.current.assignee.has.assignable.perm = Assignee (show only projects with assignable permission)

You should then rezip the JAR and replace the old language_default.jar with the new one. The somewhat complex process is to due the fact that JIRA can be internaltionalised into other languages.

The name is unimportant other than for administrative purposes, so if you don't want to go through the trouble of uodating the properties file, you don't have to. It will be fixed in JIRA 3.5

Cheers,

Mark C


David Feldman added a comment - 10/Mar/06 09:16 AM
I'm interested in both the "current user has assignable" and "current user has create issue" permissions, but I'm concerned about maintenance. We're running 3.5.1 Enterprise, and it seems we have to uncomment these permissions from the permission-types.xml file. When we upgrade, won't we have to do that again?

Forgetting the current implementation, what I'd like to see as a customer is a General Configuration setting called "Advanced Permissions" or something. If we set that to on, then these more granular permissions become available. Then, when we upgrade, the configuration setting follows us.

Please advise if I am correct in that upgrading means changing the .xml file again.

Thanks.


Dylan Etkin [Atlassian] added a comment - 13/Mar/06 05:51 PM
Hi David,
You are correct, you will need to uncomment out these options in the xml file every time you upgrade. I think the idea of "Advanced Permissions" is certainly broader than this issue and if you would like I think the best thing to do is open a new feature request to deal with the idea.

Thanks,
Dylan