Group Picker Should Not Listed All Groups

2012-09-12T15:37:12
ID ATLASSIAN:CONF-26600
Type atlassian
Reporter scahyadiputra
Modified 2017-02-17T05:46:30

Description

Confluence will display all groups registered on it when users access any group picker and put * value as its search parameter.

This is not a good implementation from security point of view as normal users would be able to see the whole groups. It would be better if group picker listed only the groups that the users are member of, which is how it is implemented in JIRA.