Uploaded image for project: 'Jira Service Management Data Center'
  1. Jira Service Management Data Center
  2. JSDSERVER-6082

Opening an attachment linked using link notation (with pipeline) on Customer portal results in 403 Forbidden error

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Highest Highest
    • 3.16.2, 4.1.0
    • 3.15.1, 3.16.1
    • Customer Portal

      Summary

      Opening an attachment on Customer portal that was linked using link notation (with pipeline) results in 403 Forbidden error

      Steps to Reproduce

      As an agent:

      1. Log in as an agent and open a ticket
      2. Attach a file and refer to it in a comment using pipeline:
        [Example|^example.txt]

        The file gets attached:

      As a customer:

      1. Access the ticket via Customer portal
      2. Open the attached file

      Expected Results

      Customer on the portal is able to access the attachment.

      Actual Results

      Customer on the portal is not able to access the attachments as the 403 Forbidden error gets displayed:

      Workaround

      Avoid using pipeline notation for link by attaching the file using the following notation:

       [^example.txt] 

      Note

      – The file can be accessed through the agent view
      – This cannot be reproduced on some earlier versions (tested on Service Desk 3.11.1)

        1. screenshot-1.png
          screenshot-1.png
          7 kB
        2. screenshot-2.png
          screenshot-2.png
          17 kB

          Form Name

            [JSDSERVER-6082] Opening an attachment linked using link notation (with pipeline) on Customer portal results in 403 Forbidden error

            Hi,

            I want to share the workaround I have develop for this bug.

            I discovered that if the linked file is also linked in another comment without alias, the links with alias works.

            With that info, I have created a Script Runner Listener on comment creation and comment edition of Service Desk projects.

            If a public comment is created or edited, and that comment contains file links with alias, the script cretes a new comment only with the linked files, but this time without alias:

            import com.atlassian.jira.bc.issue.comment.property.CommentPropertyService
            import com.atlassian.jira.component.ComponentAccessor
            import com.atlassian.jira.event.issue.IssueEvent
            import com.atlassian.jira.issue.comments.Comment
            import groovy.json.JsonSlurper
            import java.util.regex.*
            
            final SD_PUBLIC_COMMENT = "sd.public.comment"
            
            def event = event as IssueEvent
            def user = event.getUser()
            def comment = event.getComment()
            def commentPropertyService = ComponentAccessor.getComponent(CommentPropertyService)
            
            def isInternal = { Comment c ->
              def commentProperty = commentPropertyService.getProperty(user, c.id, SD_PUBLIC_COMMENT)
              .getEntityProperty().getOrNull()
            
              if (commentProperty) {
                def props = new JsonSlurper().parseText(commentProperty.getValue())
                props['internal'].toBoolean()
              } else {
                null
              }
            }
            
            if (comment && !isInternal(comment)) {
              String txt = comment.getBody()
            
              def files = []
              Pattern filepat = Pattern.compile("\\[.*\\|\\^(.*)\\]")
              Matcher m = filepat.matcher(txt)
              while (m.find()) {
                files << "[^"+m.group(1)+"]"
              }
            
              if(files){
                def commentManager = ComponentAccessor.getCommentManager()
                commentManager.create(issue, comment.getAuthor(), files.join("\n"), false)
              }
            }

            This way, the original alias link works ok.

            I hope this may help.

            Regards.

            Manuel Jesús Morión Barea added a comment - - edited Hi, I want to share the workaround I have develop for this bug. I discovered that if the linked file is also linked in another comment without alias, the links with alias works. With that info, I have created a Script Runner Listener on comment creation and comment edition of Service Desk projects. If a public comment is created or edited, and that comment contains file links with alias, the script cretes a new comment only with the linked files, but this time without alias: import com.atlassian.jira.bc.issue.comment.property.CommentPropertyService import com.atlassian.jira.component.ComponentAccessor import com.atlassian.jira.event.issue.IssueEvent import com.atlassian.jira.issue.comments.Comment import groovy.json.JsonSlurper import java.util.regex.* final SD_PUBLIC_COMMENT = "sd. public .comment" def event = event as IssueEvent def user = event.getUser() def comment = event.getComment() def commentPropertyService = ComponentAccessor.getComponent(CommentPropertyService) def isInternal = { Comment c -> def commentProperty = commentPropertyService.getProperty(user, c.id, SD_PUBLIC_COMMENT) .getEntityProperty().getOrNull() if (commentProperty) { def props = new JsonSlurper().parseText(commentProperty.getValue()) props[ 'internal' ].toBoolean() } else { null } } if (comment && !isInternal(comment)) { String txt = comment.getBody() def files = [] Pattern filepat = Pattern.compile( "\\[.*\\|\\^(.*)\\]" ) Matcher m = filepat.matcher(txt) while (m.find()) { files << "[^" +m.group(1)+ "]" } if (files){ def commentManager = ComponentAccessor.getCommentManager() commentManager.create(issue, comment.getAuthor(), files.join( "\n" ), false ) } } This way, the original alias link works ok. I hope this may help. Regards.

            axxonadmin added a comment -

            LOL. 

            OMG They won't even fix the issue... 

            All the issues with or without mentioning pipeline were linked here.
            And now someone tell us that "you know, it's not your case" 

             

            axxonadmin added a comment - LOL.  OMG They won't even fix the issue...  All the issues with or without mentioning pipeline were linked here. And now someone tell us that "you know, it's not your case"   

            Drew Smith added a comment -

            This issue deals with the case where a pipeline is used for the attachment. 

            We have been working with Atlassian on a different situation where customer's get a 403 message but a pipeline is NOT used. The 403 occurs for some customers on some attachments. Atlassian has found what the new issue is and has created this issue for it, https://jira.atlassian.com/browse/JSDSERVER-6304

            Briefly the situation occurs when 

            • you have 50 or more customer facing comments
            • add a new comment with an attachment which is shared with the customer, the customer will get the 403 when they try to access the attachment

            The new issue has a workaround that can be done.

            Drew Smith added a comment - This issue deals with the case where a pipeline is used for the attachment.  We have been working with Atlassian on a different situation where customer's get a 403 message but a pipeline is NOT used. The 403 occurs for some customers on some attachments. Atlassian has found what the new issue is and has created this issue for it,  https://jira.atlassian.com/browse/JSDSERVER-6304 Briefly the situation occurs when  you have 50 or more customer facing comments add a new comment with an attachment which is shared with the customer, the customer will get the 403 when they try to access the attachment The new issue has a workaround that can be done.

            David added a comment - - edited

            Same here. Images are not shown in portal, even if permissions are correct. Throws 403

            David added a comment - - edited Same here. Images are not shown in portal, even if permissions are correct. Throws 403

            Just notice this happened today on our Jira Service Desk installation. We are running 3.16.1.

            Tom Ireland added a comment - Just notice this happened today on our Jira Service Desk installation. We are running 3.16.1.

            March almost passed by and we're still waiting for a release.

             

            axxonadmin added a comment - March almost passed by and we're still waiting for a release.  

            Dmitry Mironov added a comment - - edited

            Some images loaded correctly, some - failed with 403 error. JSD = 3.15.3

            Chrome dev console shows error:

            Failed to load resource: the server responded with a status of 403 ()

            Even for Agents and Jira Admins

            Dmitry Mironov added a comment - - edited Some images loaded correctly, some - failed with 403 error. JSD = 3.15.3 Chrome dev console shows error: Failed to load resource: the server responded with a status of 403 () Even for Agents and Jira Admins

            I am having a similar issue with 3.14.1.  A few of our customer-linked attachments give this error; most work fine.  They are accessible from the Agent view, but following the link in the customer view renders the 403 error.  Other attachments (or even another version of the same attachment) open just fine.

            Shanelle Boluyt added a comment - I am having a similar issue with 3.14.1.  A few of our customer-linked attachments give this error; most work fine.  They are accessible from the Agent view, but following the link in the customer view renders the 403 error.  Other attachments (or even another version of the same attachment) open just fine.

            axxonadmin added a comment -

            I just want to know when it will be "triaged" ?

            axxonadmin added a comment - I just want to know when it will be "triaged" ?

            axxonadmin added a comment -

            It's seems that for unknown reason even files in new tasks are being deteriorated.

            OMG I don't know how it's possible to ignore such a problem in service desk.

            axxonadmin added a comment - It's seems that for unknown reason even files in new tasks are being deteriorated. OMG I don't know how it's possible to ignore such a problem in service desk.

              amelnikau Aliaksei Melnikau (Inactive)
              mfilipan Marko Filipan
              Affected customers:
              19 This affects my team
              Watchers:
              26 Start watching this issue

                Created:
                Updated:
                Resolved: