An issue can be linked to by ID even if link and browse permissions are absent

2017-08-21T20:53:41
ID ATLASSIAN:JRASERVER-65821
Type atlassian
Reporter bmcelveen
Modified 2020-03-12T02:00:43

Description

h3. Problem Definition:

If you remove the Link Issues Permission and Browse Projects Permission a user can still create a link if they use the issue key.

h3. Steps to Reproduce

Create a Project Role and remove the "Browse Projects" and "Link Issues" permissions from that role in a target-project.

Create a link using the Issue ID

This will prevent a user from seeing the link on the main issue page, however, the link still shows as being created in the Activity Tab.