Create issues button does not respect page edit permissions and restrictions

XMLWordPrintable

    • 1
    • Minor

      Issue Summary

      Users who do not have permission to edit a page, either based on space permissions or page restrictions, can still create a Jira issue using the "Create Issue" feature, thus creating a new version in the page history.

      Creating a new Jira issue will be expected to publish a new version, but if a user does not have edit permissions on a page, they shouldn't get the option to create a new issue.

      Steps to Reproduce

      1. In a Jira + Confluence site, create a new page, add some text. Publish the page.
      2. Add edit restrictions to only your user.
      3. Access that page as a different user, select the text, and you will see the Create Issue button pop-up. Select that button, and proceed with creating a Jira issue.
      4. Next, check the page history. You will see Confluence created a new page version under the second user's name. They should not have had permission to edit that page.

      Expected Results

      The Create Issue button shouldn't show for people who do not have page edit permissions.

      Actual Results

      Anyone with view permissions can create a new page version using the Create Issue button.

      Workaround

      Without removing view permissions, there is currently no known workaround for this behavior. However, a workaround will be added here when available.

            Assignee:
            Howard Ng
            Reporter:
            SMS (Inactive)
            Votes:
            8 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: