Uploaded image for project: 'Jira Service Management Data Center'
  1. Jira Service Management Data Center
  2. JSDSERVER-2167

Internal comments should only be viewable by specific users from JIRA

      Issue Sumary
      When an SD project is set to viewable by anonymous via project permission, internal comments are also viewable.

      Steps to Reproduce

      1. Create a Service Desk project.
      2. Create an issue in the project.
      3. Add an internal comment into the project.
      4. Add group "Anyone" to the project's Browse issue permission.
      5. Access the Search issue page and find issues within that project.
      6. View the issue you created.

      Expected Result
      JIRA would allow users veiw issue showing all unhidden comments but hide internal comments similar to restricted comments in JIRA.

      Actual Result
      Anonymous user sees all comments in the issue.

            [JSDSERVER-2167] Internal comments should only be viewable by specific users from JIRA

            I need to grant read-only access to large team members. They shouldn't have the option to see the internal comments.

            Vineeth Elattuvalappil added a comment - I need to grant read-only access to large team members. They shouldn't have the option to see the internal comments.

            I have a user I want to grant read-only access to an issue and public comments (not internal comments). Is this possible?

            Erick Molina added a comment - I have a user I want to grant read-only access to an issue and public comments (not internal comments). Is this possible?

            I am using JIRA with Crowd in the back and SSO enabled. I am collecting tickets from external users but they cannot signup to JIRA because self signup does not support Crowd and SSO at the same time so I have to allow anonymous access on my project. I've enabled anonymous acccess and now everybody can see internal comments.

            Well done Atlassian for this bad design. Your tools cannot work with your tools. Fantastic. 

            Emre Toptancı [OBSS] added a comment - I am using JIRA with Crowd in the back and SSO enabled. I am collecting tickets from external users but they cannot signup to JIRA because self signup does not support Crowd and SSO at the same time so I have to allow anonymous access on my project. I've enabled anonymous acccess and now everybody can see internal comments. Well done Atlassian for this bad design. Your tools cannot work with your tools. Fantastic. 

            I agree with Vincent. The role and permission definitions are certainly not clear. It would be helpful to have a more in-depth explanation of what a permission allows. It would seem that the 'collaborator' is implied in many cases. Where is the clear definition of Collaborator along with which roles allow which types of access? This is very confusing.

            Cheers,
            Tanya

            Tanya L Christensen added a comment - I agree with Vincent. The role and permission definitions are certainly not clear. It would be helpful to have a more in-depth explanation of what a permission allows. It would seem that the 'collaborator' is implied in many cases. Where is the clear definition of Collaborator along with which roles allow which types of access? This is very confusing. Cheers, Tanya

            Hello,

            We also have a need, where the users must also see the JIRA projet (without JSD), but JSD assumes they are "collaborators", so they can see internal comments...
            => in our humble opinion, "internal" should mean SD collaborators + SD team roles, not just anyone with the "browse project" permission

            Regards
            Vincent

            Vincent Kopa (Ovyka) added a comment - Hello, We also have a need, where the users must also see the JIRA projet (without JSD), but JSD assumes they are "collaborators", so they can see internal comments... => in our humble opinion, "internal" should mean SD collaborators + SD team roles, not just anyone with the "browse project" permission Regards Vincent

            DJ Broerse added a comment -

            Hi Nguyen Nam Chuong,

            In my opinion this is strange behaviour. Anonymous users gets more privileges/functionality than Customers.
            An internal comment is only visible to Agents and Collaborators and an anonymous user is an unknown user which has view permission to view public comments not internal comments. Internal comments are ONLY visible to agents en collaborators.

            https://jira.atlassian.com/browse/JSD-2171 is not a solution for us because in our use case anoymous users must have view rigths to issue of other customers.
            In https://support.atlassian.com/servicedesk/customer/portal/3/SDS-6785 I've described our Use Case.

            It is for us very important to remove this strange behaviour and I hope you reconsider your decission.

            DJ Broerse added a comment - Hi Nguyen Nam Chuong, In my opinion this is strange behaviour. Anonymous users gets more privileges/functionality than Customers. An internal comment is only visible to Agents and Collaborators and an anonymous user is an unknown user which has view permission to view public comments not internal comments. Internal comments are ONLY visible to agents en collaborators. https://jira.atlassian.com/browse/JSD-2171 is not a solution for us because in our use case anoymous users must have view rigths to issue of other customers. In https://support.atlassian.com/servicedesk/customer/portal/3/SDS-6785 I've described our Use Case. It is for us very important to remove this strange behaviour and I hope you reconsider your decission.

            Nga Lai (Inactive) added a comment - cc mmcmahon

            Hi ijimoh, this works as design because JSD currently considers anonymous user as collaborator. But JSD-2171 can fullfill your demand. Please follow it instead.

            Chuong Nam Nguyen (Inactive) added a comment - - edited Hi ijimoh , this works as design because JSD currently considers anonymous user as collaborator. But JSD-2171 can fullfill your demand. Please follow it instead.

              Unassigned Unassigned
              ijimoh Ismael Olusula Jimoh (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              13 Start watching this issue

                Created:
                Updated:
                Resolved: