-
Suggestion
-
Resolution: Low Engagement
-
None
In JSD adding a new Request Type, lets call it "Make a Complaint" automatically adds the new Request Type into the Auto-search on Request Forms list, with Search KB set to Yes and Restrict to Articles with Labels unpopulated - thus unrestricted.
This means that if you have already locked down all your existing Request Types you've just punched a massive hole in your Confluence KB and opened up EVERYTHING to your customers.
This is a very dangerous default behavior and needs to be fixed please!
- links to
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[JSDSERVER-5657] Default behavior of Confluence KB search is insecure and opens all KB data up to customers
@sraj2 thanks for replying. Steps as follows:
You have Service Desk project with a portal which you have configured to link to a KB:
You have some request types that are restricted by label:
But now someone goes and adds a new request type and doesn't realise that it will be automatically added to list of request types here AND the label restriction will be unpopulated therefore unrestricted. Without knowing it they have opened up everything in the linked Confluence space to the portal users. This is a dangerous default behavior that needs to be fixed please!!
james.holt can you please provide step by step instruction to reproduce this issue?
Hello,
Thank you for submitting this suggestion. We appreciate you taking the time to share your ideas for improving our products, as many features and functions come from valued customers such as yourself.
Atlassian is committed to enhancing the security and compliance of our Data Center products, with an emphasis on sustainable scalability and improving the product experience for both administrators and end-users. We periodically review older suggestions to ensure we're focusing on the most relevant feedback. This suggestion has had very low engagement over the past four years, with no new watchers, votes, or comments. As a result, we're closing it for now.
We understand that this suggestion might still be important to you. If you'd like to provide additional context or information about why it remains relevant, please contact our Technical Support team for assistance. We'll be happy to review your feedback.
You can read more about our approach to highly voted suggestions here and how we prioritize what to implement here.
To learn more about our recent investments in Jira Service Management Data Center, please check our public roadmap and our dashboards, which contain recently resolved issues, current work, and future plans.
Kind regards,
Jira Service Management Data Center