Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-25420

User is allowed to Share a Team even without Manage Shared Teams permission

      Issue Summary

      This is reproducible on Data Center: yes

      Steps to Reproduce

      1. Create a Team in Advanced Roadmaps
      2. Without the Manage Shared Teams, see you'll have permission to Share the Team you just created
      3. Once the Team is shared, you won't be able to edit it (without the permission)

      Expected Results

      Users without the Manage Shared Teams shouldn't be able to share a Team, as they'll become unable to edit it immediately after sharing.

      Actual Results

      The user is allowed to share a Team and immediately looses edit access to it.

      Workaround

      There's no workaround available.

      If Admins don't want any user to be able to share Teams, this custom CSS snippet can be added to the Announcement Banner to hide the Share option — though be mindful this is an unsupported customization and provided as-is: Admins should test, modify and implement at their own risk and evaluation.
      Please refer to How to customize Jira with JavaScript and CSS to learn more on the caveats and risks of applying such customizations to Jira.

      <script>
      // JavaScript workaround for JSWSERVER-25420
      // Use with discretion - this is provided AS IS by Atlassian Support
      // This may break without warning with any minor Jira upgrade
      
      // Confirm we're viewing a plan
      if (document.URL.indexOf('PortfolioPlanView') >= 0) {
      
          // Wait for the document to load so our "content" node will be available
          jQuery(document).on('ready', function () {
              const content = document.getElementById('content');
      
              // Create an observer
              const observer = new MutationObserver(mutations => {
                  for (let mutation of mutations) {
                      // Iterate through all nodes added during this mutation
                      for (let node of mutation.addedNodes) {
                          // Fail fast: confirm the node is an element
                          if (!(node instanceof HTMLElement))
                              continue;
      
                          // Fail fast: confirm this is a (legacy) Atlaskit dropdown menu
                          if (!node.matches('div[class^="Droplist__Content-"]'))
                              continue;
      
                          // Skip to the menu container that's the parent of the options
                          const menu = node.querySelector('div[role="menu"] div[role="menu"]');
                          if (!menu)
                              continue;
      
                          for (let menuItem of menu.children) {
                              // Skip to the option's label
                              let menuLabel = menuItem.querySelector('span[class^="ItemParts__ContentWrapper"]');
                              if (!menuLabel)
                                  continue;
      
                              // Check if the label is "Share"
                              if (menuLabel.textContent === 'Share') {
                                  // Remove that option
                                  menuItem.remove();
                                  return;
                              }
                          }
                      }
                  }
              });
      
              // Start the observer
              observer.observe(content, {childList: true, subtree: true});
          });
      }
      </script>
      

      If you suspect other functionalities have been compromised in Jira (i.e. missing UI elements or pages not rendering properly), clear the Announcement Banner as one of the first troubleshooting steps.
       

          Form Name

            [JSWSERVER-25420] User is allowed to Share a Team even without Manage Shared Teams permission

            There are no comments yet on this issue.

              Unassigned Unassigned
              rmartinez3@atlassian.com Rodrigo Martinez
              Affected customers:
              9 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated: