When a non-admin user attempts to perform a bulk delete of an object in Jira, a pop-up message is displayed. However, the same user has the ability to delete a single object or all objects of a particular type.
Steps to Reproduce
- Create a new Objectschema with a few objects.
- Login to Jira as a non-admin Schema manager user, and perform Bulk delete object
- Attached is the screen recording: BulkDelete.mp4
Expected Results
User should be able to perform bulk delete objects.
Actual Results
The permission error popped up with the error message:
In the atlassian-jira.log, can see the below error:
2024-01-17 11:06:37,038+0000 insight-InsightThreadGroup-worker-thread-2 ERROR Test [c.r.j.p.i.services.core.ObjectServiceImpl] Error auditing object bulk deletion
com.riadalabs.jira.plugins.insight.common.exception.PermissionInsightException: PermissionInsightException: User JIRAUSER10200 didn't have correct permission (admin).
at com.riadalabs.jira.plugins.insight.services.permission.DefaultInsightPermissionsChecker.checkPermission(DefaultInsightPermissionsChecker.java:98)
at com.riadalabs.jira.plugins.insight.services.permission.DefaultInsightPermissionsChecker.checkAdminPermission(DefaultInsightPermissionsChecker.java:281)
at com.riadalabs.jira.plugins.insight.services.progress.ProgressServiceBase.checkAdminPermission(ProgressServiceBase.java:596)
at com.riadalabs.jira.plugins.insight.services.progress.ProgressServiceBase.finishProgressOk(ProgressServiceBase.java:261)
at com.riadalabs.jira.plugins.insight.services.core.ObjectServiceImpl.runDeleteObjectsProcess(ObjectServiceImpl.java:1680)
at com.riadalabs.jira.plugins.insight.services.core.ObjectServiceImpl.lambda$deleteObjectsWithProgress$17(ObjectServiceImpl.java:1642)
at com.atlassian.sal.core.executor.ThreadLocalDelegateCallable.call(ThreadLocalDelegateCallable.java:38)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
Workaround
Grant Insight Administrator permission to the affected user to perform bulk delete.
Note: This may not be desirable, as it will expose all schemas to the user
Bug
Medium
Page Failed to load