After setting a project as a Read-Only project, user will be able to execute Workflow Transition that the user or the issue has met.
This is reproduceable in JIRA 3.13.5, JIRA 4.0, JIRA 4.0.2, JIRA 4.1, JIRA 4.1.1. Here are the steps to reproduce this and as an example, the "Only Assignee will be able to execute this transition" Permission Condition is used:
- create a new project
- create a new workflow that has Transition's Condition:"Only Assignee will be able to execute this transition". Or used the default JIRA workflow called "jira".
- create an issue in the project and assigned it to a user
- create a new Permission Scheme that only has "Browse Project" permission is granted to users. Other permissions are empty.
- associate the project with the new Permission Scheme created in step 4.
- login as the user that has issue assigned to him. The user are be able to execute the transition that has "Only Assignee will be able to execute this transition". If the project using the Default JIRA workflow called jira, the Assignee will be able see "Start Progress" or "Stop Progress".
This problem still occurred even if no user is associated with any Project Roles in the project.
Bug
Low (View bug fix roadmap)
JRASERVER-32601 Edit permission should also apply to workflow transitions