Uploaded image for project: 'Jira Align'
  1. Jira Align
  2. JIRAALIGN-3788

ForecastMainPage: User without permission to edit Epics can update an Epic's forecast values

    XMLWordPrintable

Details

    • 1
    • Severity 3 - Minor
    • No

    Description

      Issue Summary

      User is able to update Epic forecast values from ForecastMainPage view even though their System Role disables editing Epics and hides the Forecast tab.

      Steps to Reproduce

      1. Add userA as a Portfolio Member for Epic1's parent portfolio.
      2. For userA's System Role, enable Portfolio > Manage > Epics, but disable all sub-toggles (Add,.... Forecast Tab...etc).
      3. Log in as userA, open Epic1 and note neither the Save button nor Forecast tab are available.
      4. Navigate to ForecastMainPage view and locate Epic1.
      5. Modify Epic1's Capacity Planning value and click the blue arrow to apply.
      6. Login as user with all Epic permissions. View Epic1's Forecast tab and note estimate has been updated.

      Expected Results

      UserA should not be able to update an Epic's Forecast values from ForecastMainPage when Role permissions prohibit them from editing / saving Epics.

      Actual Results

      UserA is able to update an Epic's Forecast values from the ForecastMainPage despite lacking the permission to Save epics.

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

      Attachments

        Issue Links

          Activity

            People

              4f593be5d819 Anna Eshlin De Kassal (Inactive)
              1a93744f1bf8 Brandon Harris
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Backbone Issue Sync