Thanks for everyone's feedback and votes.

We've taken a look and we've decided that we won't be implementing this feature in the near future. When we next review permissions we will take another look at this request and other requests with the Permissions component.

Although we are not looking at this particular issue we do plan to take a look at higher voted issues and see how we can incorporate them into JIRA. Please note that votes is one of the determining factors that we use to plan our roadmaps, for a full description please read our blog post: https://answers.atlassian.com/questions/110373/how-does-the-jira-team-use-jira-atlassian-com

We hope you understand and appreciate our honesty on these requests.

Cheers,
Roy Krishna
roy @ atlassian dot com

any news for the workorund?

Also, the workaround doesn't work anymore with the new Jira 6.

Since the "Clone issue" allows users without the "Set Issues Security" to clone any issue with any level of security and have a new issue with that security level assigned to it (rather than the default) it really should be supported out of the box to be able to control who can clone issues independently of who can create issues.

Its nice that the Clone Plus plugin supports this, but I need it out of the box so that additional plugins which use the clone feature will respect the permission setting.

To remove the Clone Issue menu item in JIRA 4+, just add a Velocity Processed Message custom field and put it on the screens where you want the clone option removed for users. No server file edits needed. Set the field's Default Value to:

<script type="text/javascript">
{
  cloneMenuItem = document.getElementById('clone-issue');
 
// hide the Clone menu item
if (cloneMenuItem)

}
</script>

Since this is a Velocity processed field, you can get fancier about who is allowed to see Clone Issue w/ addn Velocity markup that makes the Javascript conditional based on the current user's group membership, project role, or whatever.

The clone plus plugin has customization options that support this use case. Some details are here - JCPP-25 and more will be available once 1.1.0 is officially released. There is a snapshot available with the support.

I've encountered the same situation as others. Our internal staff need to be able to clone issues into different projects, but we would prefer to remove it for customers to prevent potential problems.

As far as I can tell there is no way to do this currently.

The clone operation can be removed by commenting it out in the .../WEB-INF/classes/system-issueoperationss-plugin.xml. We do this so that it is replaced by Clone Plus Plugin actions. Some of the errors discussed above are avoided by giving users more field edit options. Also, with some customization, you can be more selective on when it is available. And don't forgot to vote for the Clone Plus Plugin .

The workaround posted by Felix does not work in JIRA 4.1 since the access to the operations panel has changed and is not longer reflected in vm files.
Therefore I vote for this feature request.

I have added the workaround posted by Felix and it works great. The clone issue operation is removed for customers and preserved for employees. But I want to do the same thing for the Clone and Move operation. It shows up even when a user does not have Move permission but that sounds like a known issue. So I'd like to remove it for customers, so I looked in the html source and don't see an id with clone and move like there is for the clone issue, and the code uses the id to remove the link. Is there a way to do this?
Thanks
Russ