Uploaded image for project: 'Jira Platform Cloud'
  1. Jira Platform Cloud
  2. JRACLOUD-42609

Assignee permission check during IssueService validateUpdate uses the JIRA authentication context user not the supplied user

XMLWordPrintable

      NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report.

      If the JiraAuthenticationContext is null (as it is for services) the IssueService validateUpdate fails on the assignee permission check, despite the api being given a user.

      public UpdateValidationResult validateUpdate(ApplicationUser user, Long issueId, IssueInputParameters issueInputParameters)
      

      When a NULL JAC context is present, when updating an issue, with no ASSIGNEE property present, the errors variable in the above method contain:

      Errors: {}
      Error Messages: [You do not have permission to assign issues.]
      

      If the 'user' above is set as the JiraAuthenticationContext user, then no such error occurs.

      During validateAndUpdateIssueFromFields() >

      public void validateParams(OperationContext operationContext, ErrorCollection errorCollectionToAddTo, I18nHelper i18n, Issue issue, FieldScreenRenderLayoutItem fieldScreenRenderLayoutItem)
      

      This method doesn't get the 'user' that was supplied through the issueservice validate method, which is a bug, the validateParams() method has:

                  // The user must have 'assign' permission - as otherwise 'automatic' should be chosen, or the field should not
                  // be presented at all
                  if (!hasPermission(issue, Permissions.ASSIGN_ISSUE))
                  {
                      errorCollectionToAddTo.addErrorMessage(i18n.getText("assign.error.no.permission"), Reason.FORBIDDEN);
                      return;
                  }
      

      which leads to:

      permissionManager.hasPermission(permissionId, issue, getAuthenticationContext().getUser());
      

      Therefore services need to hack the JiraAuthenticationContext user to be the same user being supplied through the issueservice API in order to stop validation errors, which should not be the case, it should use the user supplied through the issueservice validate method.

              Unassigned Unassigned
              cd3cc7134331 Andy Brook
              Votes:
              11 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: