Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-4935

"Browse Project" permission for "Current Reporter" grants users to see projects they are not permitted to.

    XMLWordPrintable

Details

    Description

      When i add the "Current Reporter" to the "Browse Project" Permission of one project. This project instantly becomes visible to ALL users(via the project table portlet), if they have any kind of permission to see this project or not.

      So all users can see this project, but can't see any issues within it. Thats not very good, as we want to keep our customers strictly seperated from one another and we have a lot of projects. That would be very confusing if you see lots of projects in your dashboard, but only one or two of them are relevant to you and the rest is empty.

      Attachments

        Issue Links

          has a regression in

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-34389 Regression - "Browse Project" permission for "Reporter" grants users to see projects they are not permitted to.

          • High - High priority issues
          • Long Term Backlog
          is related to

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-8950 "Current Assignee" on Browse Permission creates security hole

          • High - High priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-12051 Adding group selector permission makes project name visible to everyone

          • Medium - Medium priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-14941 Users without permissions can browse projects that they do not have perms to if custom field-user picker

          • Medium - Medium priority issues
          • Closed

          Suggestion - JRASERVER-4927 Suppress Error Message, when user has no right to browse project

          • Closed

          Suggestion - JRASERVER-14424 Separate permissions for issue filtering and project display

          • Gathering Interest
          was cloned as

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-34389 Regression - "Browse Project" permission for "Reporter" grants users to see projects they are not permitted to.

          • High - High priority issues
          • Long Term Backlog

          Activity

            People

              mark@atlassian.com MarkC
              bb13e57032de Gerd Gueldenast
              Votes:
              1 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 8h
                  8h
                  Remaining:
                  Time Spent - 5h Remaining Estimate - 3h
                  3h
                  Logged:
                  Time Spent - 5h Remaining Estimate - 3h
                  5h