-
Bug
-
Resolution: Cannot Reproduce
-
Low
-
1
-
Severity 2 - Major
-
Summary
When the browse project permission of a project is set to include 'Service Desk Customer - Portal Access', currently users with JSW application access (but have no access to the project due to not being a JSD customer) , is able to see tickets, boards, projects and filters of the said project. They do not have access to the project in question when clicking on the boards and projects but they are still able to see the projects and issues from suggestions.
Investigation Done
Browse project permission set to include 'Service Desk Customer - Portal Access'
No additional groups besides application access group for user
User is still able to see the project (AT1) being suggested despite not having access to it.
Steps to Replicate
Refer to the investigation steps above.
Expected Results
No projects, dashboard, filters or tickets should be return as suggestion
Current Results
Projects with Browse Project permission that includes 'Service Desk Customer - Portal Access' will return itself, tickets and dashboards under it as suggestion despite the user having no access to it.
Note : Can also potentially be due to side bar result caching with the creation of CONFCLOUD-65887 but have no way of verifying on our end.
- is related to
-
-
- Closed
-
[JSDCLOUD-8015] 'Service Desk Customer - Portal Access' in Browse Project permission causes side bar to display search suggestions to users with no access to said suggestions
Hi vchin, ktarasiuk@atlassian.com - friendly reminder that the SLA due date on this ticket is 9 days away. Are we looking good to get this resolved by then?
Don't hesitate to reach out if there is anything security can help with.
Closing, because the functionality works as expected.
The only replication steps we could find, involved using a user account with administrator privileges (through the "jira-software-users" group, the user belongs to). Such users have access to administer the projects, which are therefore shown in the search results.
Make sure you intend for the group to have administrator access, if not, removing it should fix the problem. You can check by going to Users management -> Groups and checking each group that the user is in.