Uploaded image for project: 'Jira Service Management Data Center'
  1. Jira Service Management Data Center
  2. JSDSERVER-6429

When the 'Any logged in user' permission is added to 'Browse Project' permission in a Service Desk project, customer will automatically receive notifications when mentioned in an internal comment.

XMLWordPrintable

      Issue Summary

      When the 'Any logged in user' permission is added to 'Browse Project' permission in a Service Desk project, customer will automatically receive notifications when mentioned in an internal comment.

      Steps to Reproduce

      Test Case1: 

      1. Create a Service Desk project.
      2. Head to project settings > Permission Scheme.
      3. Add the 'Application Access' > 'Any logged in user' permission in the 'Browse Project' permission 
      4. Head to an issue, then, mention a customer in the ticket.

      Test Case 2:

      1.  The customer creates the following ticket “SD Test 1”   
      2. Head to project settings > Permission Scheme.
      3. Add "Reporter" to the 'Browse Project' permission 
      4. The Agent add an Internal Comment and mentioned The customer in the internal comment 

      Expected Results

      Customer will not be receiving any notifications when an internal comment is added.

      Actual Results

      Customer receives notification when an internal comment is added.

      Workaround

      For Test Case1: 

      Remove the 'Any logged in user' permission in the 'Browse Project' permission of project,

      For Test Case2: 

      As a workaround for this, you can use "Service project customer - portal access" and remove the Reporter from Browse permission, then the notification won't be sent when the reporter is mentioned in the internal comment.

       

          Form Name

            [JSDSERVER-6429] When the 'Any logged in user' permission is added to 'Browse Project' permission in a Service Desk project, customer will automatically receive notifications when mentioned in an internal comment.

            Alex Cooksey added a comment -

            Hey a50e972304de!

            Sorry I missed your initial comment. JSM 5.4.10 has just been released - this fix should now be available for you now.

            Thanks for your feedback and interest in this issue, please get in touch if theres anything more we can support on.

            Alex

            Alex Cooksey added a comment - Hey a50e972304de ! Sorry I missed your initial comment. JSM 5.4.10 has just been released - this fix should now be available for you now. Thanks for your feedback and interest in this issue, please get in touch if theres anything more we can support on. Alex

            Kevin Dekan added a comment -

            Any news on the release date for 5.4.10?

            Kevin Dekan added a comment - Any news on the release date for 5.4.10?

            Kevin Dekan added a comment -

            @Atlassian are you aware that this is a serious information security issue? Internal comments are leaked to external parties, I would not dare to classify this as "minor".
             

            Kevin Dekan added a comment - @Atlassian are you aware that this is a serious information security issue? Internal comments are leaked to external parties, I would not dare to classify this as "minor".  

            Kevin Dekan added a comment -

            Dear Atlassian,

            I think it is irresponsible to leave a bug unresolved for nearly four years. 

            I think you should raise the priority for this bug and start working on a solution, because this is a serious risk for us and any other company in the EU - have you heard of GDPR?

             

            Thanks!

            Kevin Dekan added a comment - Dear Atlassian, I think it is irresponsible to leave a bug unresolved for nearly four years.  I think you should raise the priority for this bug and start working on a solution, because this is a serious risk for us and any other company in the EU - have you heard of GDPR?   Thanks!

              jxu2@atlassian.com Sam Xu
              pkamarudin@atlassian.com Putri Nur Dayana Kamarudin (Inactive)
              Affected customers:
              4 This affects my team
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: