Uploaded image for project: 'Jira Align'
  1. Jira Align
  2. JIRAALIGN-5016

It's possible to access and modify objectives with direct url link despite user not having access to them otherwise due to team/portfolio membership



    • 1
    • Severity 2 - Major
    • No


      Issue Summary

      Objectives that the user doesn't have access to due to their team/portfolio membership, can still be accessed and modified via direct URL link to Objectives grid with the details panel.

      This behaviour is inconsistent from other work items, for example when trying to access Features directly that we don't have access too, we get a message saying that we don't have permissions or item doesn't exist.

      There's no such message for Objectives and users can freely modify them.

      Steps to Reproduce

      1. Log in as a non-admin user, have system role permissions on for Objectives (Portfolio, Program, Team, Solution levels) including save/modify
      2. Assign this user to a Portfolio team
        1. This Portfolio should have NO objectives created in it
      3. Check the Objectives grid without any filters to make sure the user can't see any objectives that we are going to try to access in step 4
      4. Pick an objective ID for an objective that the user can't access
      5. Go to <yourJAsite>/MilestoneGrid?FirstTime=True&Inf=1&MilestoneID=<yourObjectiveID>
      6. Observe that the objective details panel opened and can be modified

      Expected Results

      Since the user can't access the objectives through Objective grid or global search, it's expected they'll get an error when trying to access it by URL, just like they would for other work items like Features or Stories.

      Actual Results

      Objectives that the user can't usually access, can be accessed and modified via direct link.


      Currently, there is no known workaround for this behavior. A workaround will be added here when available.


        Issue Links



              dfuller@atlassian.com Don Fuller
              c7f2a2ebc58e Kirill Duplyakin
              2 Vote for this issue
              3 Start watching this issue



                Backbone Issue Sync