-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Low
-
None
-
Affects Version/s: 9.12.15, 10.3.7, 10.7.1
-
Component/s: AgileBoard
-
9.12
-
1
-
Severity 3 - Minor
Issue Summary
Only a Jira administrator user or a Board admin is allowed to configure Jira software Boards including deleting a board. We do show the "Delete" board button as greyed out if the logged in user is not a Board admin or Jira admin user.
However, a non-board/jira-admin user is able to click through the greyed out "Delete" button which eventually fails but should ideally not even show up or the user should not be allowed to click through the "Delete" button.
Steps to Reproduce
- Create a Non-admin Jira user
- Create a Scrum board by a jira admin user
- Log in as the Non-admin Jira user and Navigate through Boards > Choose a specific Board > Board (dropdown on the top-right) > Configure > Board (top-right) > Click the greyed out Delete
Expected Results
As the logged in user is neither the Board admin nor a Jira admin user, the greyed out "Delete" button should not be clickable or not appear without the required permission in the first place
Actual Results
The logged-in non-admin user is able to click through the "Delete" button. Even though eventually the delete action fails with the error message: "only the owner of the board or an administrator can modify the configuration"
Workaround
- We can hide the "Delete" button for all users (including Jira admins) from the specific Board Configuration (ie., Boards > Choose a specific Board > Board (dropdown on the top-right) > Configure > Board (top-right)):
<script>
// Function to hide the "Delete" button
function hideDeleteButton() {
// Use a mutation observer to watch for changes in the DOM
const observer = new MutationObserver(() => {
// Target the "Delete" button using its class
const deleteButton = document.querySelector('.js-view-action-delete');
if (deleteButton) {
// Hide the button
deleteButton.style.display = 'none';
// Once the button is hidden, stop observing
observer.disconnect();
}
});
// Start observing the document body for changes
observer.observe(document.body, { childList: true, subtree: true });
}
// Call the function to hide the button
hideDeleteButton();
</script>
If applied, the above would hide the "Delete" button from the individual Boards > Configure > Board dropdown. However, a Jira admin can still delete a board from the Boards > View all boards > the three dots ... menu on the right side of each board.
- A Jira admin will see the "Delete" button in the View all boards list
- A Board admin (non-Jira admin) user will only see the "Delete" button on boards when the user is the Board admin
- is related to
-
JSWSERVER-15237 Delete Option Appears When Right Clicking Issue In Agile Board Without Permissions
-
- Gathering Impact
-