Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-42626

Sensitive information displayed in anonymous REST API calls

XMLWordPrintable

      Expected behavior

      Block sensitive information from being displayed on anonymous REST API calls in JIRA.

      Actual behavior

      • Users' full-name are displayed when running the calls below: 
        /user/picker?query=<username>
/groupuserpicker?query=ali&showAvatar
      • Default fields and custom fields are displayed when running the call below: 
        /jql/autocompletedata

      Workaround

      There's no current method for working around this within JIRA itself. The only solution would be to setup IP filtering on affected calls.

              ohernandez@atlassian.com Oswaldo Hernandez (Inactive)
              jpalharini Joao Palharini (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

                Created:
                Updated:
                Resolved: