Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-8950

"Current Assignee" on Browse Permission creates security hole

    XMLWordPrintable

Details

    Description

      Adding "Current Assignee" to the Browse permission for a project lets any user of the system see that project (they can't necessarily view issues or create issues, but they can see the project).

      Attachments

        Issue Links

          duplicates

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-11881 Setting Browse Projects to anything but a group makes projects visible to jira-users

          • Medium - Medium priority issues
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-11881 Setting Browse Projects to anything but a group makes projects visible to jira-users

          • Medium - Medium priority issues
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-8942 Granting User Custom Field "Browse" permission has no effect

          • Medium - Medium priority issues
          • Closed

          Suggestion - JRASERVER-14424 Separate permissions for issue filtering and project display

          • Gathering Interest
          is superseded by

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-43923 Current Assignee on Browse Projects Permission displayed Projects to All Users

          • Low - Low priority issues
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-4935 "Browse Project" permission for "Current Reporter" grants users to see projects they are not permitted to.

          • Medium - Medium priority issues
          • Closed
          was cloned as

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-36141 "Current Assignee" on Browse Permission creates security hole

          • Medium - Medium priority issues
          • Closed
          resolves

          PS-73349 Loading...

          Activity

            People

              mark@atlassian.com MarkC
              f2dc2c6450e1 Erik S
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 7h
                  7h
                  Remaining:
                  Time Spent - 2h Remaining Estimate - 5h
                  5h
                  Logged:
                  Time Spent - 2h Remaining Estimate - 5h
                  2h