Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-25420

User is allowed to Share a Team even without Manage Shared Teams permission

      Issue Summary

      This is reproducible on Data Center: yes

      Steps to Reproduce

      1. Create a Team in Advanced Roadmaps
      2. Without the Manage Shared Teams, see you'll have permission to Share the Team you just created
      3. Once the Team is shared, you won't be able to edit it (without the permission)

      Expected Results

      Users without the Manage Shared Teams shouldn't be able to share a Team, as they'll become unable to edit it immediately after sharing.

      Actual Results

      The user is allowed to share a Team and immediately looses edit access to it.

      Workaround

      There's no workaround available.

      If Admins don't want any user to be able to share Teams, this custom CSS snippet can be added to the Announcement Banner to hide the Share option — though be mindful this is an unsupported customization and provided as-is: Admins should test, modify and implement at their own risk and evaluation.
      Please refer to How to customize Jira with JavaScript and CSS to learn more on the caveats and risks of applying such customizations to Jira.

      <script>
      // JavaScript workaround for JSWSERVER-25420
      // Use with discretion - this is provided AS IS by Atlassian Support
      // This may break without warning with any minor Jira upgrade
      
      // Confirm we're viewing a plan
      if (document.URL.indexOf('PortfolioPlanView') >= 0) {
      
          // Wait for the document to load so our "content" node will be available
          jQuery(document).on('ready', function () {
              const content = document.getElementById('content');
      
              // Create an observer
              const observer = new MutationObserver(mutations => {
                  for (let mutation of mutations) {
                      // Iterate through all nodes added during this mutation
                      for (let node of mutation.addedNodes) {
                          // Fail fast: confirm the node is an element
                          if (!(node instanceof HTMLElement))
                              continue;
      
                          // Fail fast: confirm this is a (legacy) Atlaskit dropdown menu
                          if (!node.matches('div[class^="Droplist__Content-"]'))
                              continue;
      
                          // Skip to the menu container that's the parent of the options
                          const menu = node.querySelector('div[role="menu"] div[role="menu"]');
                          if (!menu)
                              continue;
      
                          for (let menuItem of menu.children) {
                              // Skip to the option's label
                              let menuLabel = menuItem.querySelector('span[class^="ItemParts__ContentWrapper"]');
                              if (!menuLabel)
                                  continue;
      
                              // Check if the label is "Share"
                              if (menuLabel.textContent === 'Share') {
                                  // Remove that option
                                  menuItem.remove();
                                  return;
                              }
                          }
                      }
                  }
              });
      
              // Start the observer
              observer.observe(content, {childList: true, subtree: true});
          });
      }
      </script>
      

      If you suspect other functionalities have been compromised in Jira (i.e. missing UI elements or pages not rendering properly), clear the Announcement Banner as one of the first troubleshooting steps.
       

            [JSWSERVER-25420] User is allowed to Share a Team even without Manage Shared Teams permission

            Rajshri made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 962173 ]
            Marc Dacanay made changes -
            Labels New: ril
            Marc Dacanay made changes -
            Remote Link New: This issue links to "Internal ticket (Web Link)" [ 956703 ]
            Jeff Curry made changes -
            Description Original: h3. Issue Summary

            This is reproducible on Data Center: yes
            h3. Steps to Reproduce
             # Create a Team in Advanced Roadmaps
             # Without the Manage Shared Teams, see you'll have permission to Share the Team you just created
             # Once the Team is shared, you won't be able to edit it (without the permission)

            h3. Expected Results

            Users without the Manage Shared Teams shouldn't be able to share a Team, as they'll become unable to edit it immediately after sharing.
            h3. Actual Results

            The user is allowed to share a Team and immediately looses edit access to it.
            h3. Workaround

            There's no workaround available.

            If Admins don't want _any user_ to be able to share Teams, this custom CSS snippet can be added to the Announcement Banner to hide the Share option — though be mindful this is an _unsupported customization_ and provided {_}as-is{_}: Admins should test, modify and implement at their own risk and evaluation.
            Please refer to [How to customize Jira with JavaScript and CSS|https://confluence.atlassian.com/pages/viewpage.action?pageId=1178874962] to learn more on the caveats and risks of applying such customizations to Jira.
            {code:html}
            <!-- Custom CSS to hide the "Share" option from Advanced Roadmaps Teams page (JSWSERVER-25420) -->
            <style>
            div[data-name="ManualPlans"] div[data-role="droplistContent"] div[role="menu"] div[role="menu"] span[role="menuitem"]:last-child {
              display: none !important;
            }
            </style>

            <!-- Custom CSS to hide the Announcement Banner completely -->
            <style>
            #announcement-banner { display: none; }
            </style>
            {code}
            If you suspect other functionalities have been compromised in Jira (i.e. missing UI elements or pages not rendering properly), clear the Announcement Banner as one of the first troubleshooting steps.
             
            New: h3. Issue Summary

            This is reproducible on Data Center: yes
            h3. Steps to Reproduce
             # Create a Team in Advanced Roadmaps
             # Without the Manage Shared Teams, see you'll have permission to Share the Team you just created
             # Once the Team is shared, you won't be able to edit it (without the permission)

            h3. Expected Results

            Users without the Manage Shared Teams shouldn't be able to share a Team, as they'll become unable to edit it immediately after sharing.
            h3. Actual Results

            The user is allowed to share a Team and immediately looses edit access to it.
            h3. Workaround

            There's no workaround available.

            If Admins don't want _any user_ to be able to share Teams, this custom CSS snippet can be added to the Announcement Banner to hide the Share option — though be mindful this is an _unsupported customization_ and provided {_}as-is{_}: Admins should test, modify and implement at their own risk and evaluation.
            Please refer to [How to customize Jira with JavaScript and CSS|https://confluence.atlassian.com/pages/viewpage.action?pageId=1178874962] to learn more on the caveats and risks of applying such customizations to Jira.
            {code:html}
            <script>
            // JavaScript workaround for JSWSERVER-25420
            // Use with discretion - this is provided AS IS by Atlassian Support
            // This may break without warning with any minor Jira upgrade

            // Confirm we're viewing a plan
            if (document.URL.indexOf('PortfolioPlanView') >= 0) {

                // Wait for the document to load so our "content" node will be available
                jQuery(document).on('ready', function () {
                    const content = document.getElementById('content');

                    // Create an observer
                    const observer = new MutationObserver(mutations => {
                        for (let mutation of mutations) {
                            // Iterate through all nodes added during this mutation
                            for (let node of mutation.addedNodes) {
                                // Fail fast: confirm the node is an element
                                if (!(node instanceof HTMLElement))
                                    continue;

                                // Fail fast: confirm this is a (legacy) Atlaskit dropdown menu
                                if (!node.matches('div[class^="Droplist__Content-"]'))
                                    continue;

                                // Skip to the menu container that's the parent of the options
                                const menu = node.querySelector('div[role="menu"] div[role="menu"]');
                                if (!menu)
                                    continue;

                                for (let menuItem of menu.children) {
                                    // Skip to the option's label
                                    let menuLabel = menuItem.querySelector('span[class^="ItemParts__ContentWrapper"]');
                                    if (!menuLabel)
                                        continue;

                                    // Check if the label is "Share"
                                    if (menuLabel.textContent === 'Share') {
                                        // Remove that option
                                        menuItem.remove();
                                        return;
                                    }
                                }
                            }
                        }
                    });

                    // Start the observer
                    observer.observe(content, {childList: true, subtree: true});
                });
            }
            </script>
            {code}
            If you suspect other functionalities have been compromised in Jira (i.e. missing UI elements or pages not rendering properly), clear the Announcement Banner as one of the first troubleshooting steps.
             
            SET Analytics Bot made changes -
            Support reference count Original: 1 New: 2
            SET Analytics Bot made changes -
            UIS Original: 1 New: 0
            Roman Kolosovskiy (Inactive) made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 860152 ]
            Mihir Talsania made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 852245 ]
            Daniel Rauf made changes -
            Status Original: Needs Triage [ 10030 ] New: Gathering Impact [ 12072 ]
            SET Analytics Bot made changes -
            UIS New: 1

              Unassigned Unassigned
              rmartinez3@atlassian.com Rodrigo Martinez
              Affected customers:
              9 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated: