Lucene search

K
atlassianBb13e57032deJRASERVER-34389
HistoryAug 20, 2013 - 2:11 a.m.

Regression - "Browse Project" permission for "Reporter" grants users to see projects they are not permitted to.

2013-08-2002:11:56
bb13e57032de
jira.atlassian.com
24

{panel:bgColor=#e7f4fa}
NOTE: This bug report is for JIRA Server. Using JIRA Cloud? [See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-34389].
{panel}
Regression of JRA-4935

When i add the “Reporter” to the “Browse Project” Permission of one project. This project instantly becomes visible to ALL users(via the project table portlet), if they have any kind of permission to see this project or not.

So all users can see this project, but can’t see any issues within it. Thats not very good, as we want to keep our customers strictly seperated from one another and we have a lot of projects. That would be very confusing if you see lots of projects in your dashboard, but only one or two of them are relevant to you and the rest is empty.

Workaround to restrict issue view to Reporter and Browse Project to only a specific group of users:
If a Project is only relevant to one or several groups

Add the related groups to the Role(Users) and remove unrelated groups that shouldn’t see the project.

Set Create and Browse permissions for Role(Users). (Remove ‘Reporter’ from Browse Project permission)

Use Issue level security to restrict viewing to Reporter

Result: only users in the Role(Users) see the project and Browse only it’s own Reported issues.
Step by step instructions to set Security Level at [How to limit user to only browse issues assigned to or reported by them|https://confluence.atlassian.com/display/CLOUDKB/How+to+limit+user+to+only+browse+issues+assigned+to+or+reported+by+them]

Affected configurations

Vulners
Node
atlassianjira_data_centerRange5.2.2
OR
atlassianjira_data_centerRange6.1-OD-04
OR
atlassianjira_data_centerRange6.1.2
OR
atlassianjira_data_centerRange6.4.12
OR
atlassianjira_data_centerRange6.5-OD-08
OR
atlassianjira_data_centerRange7.0.5
OR
atlassianjira_data_centerRange7.1.9
OR
atlassianjira_data_centerRange7.3.2
OR
atlassianjira_data_centerRange7.3.3
OR
atlassianjira_data_centerRange7.4.1
OR
atlassianjira_data_centerRange8.2.3
OR
atlassianjira_data_centerRange8.5.3
OR
atlassianjira_data_centerRange8.11.1
OR
atlassianjira_data_centerRange8.17.0
OR
atlassianjira_data_centerRange8.19.0