A generic user can see a project he doesn't have permission for

[shachar]

Hi guys,

I've been messing around with Jira for a while now, but don't seem to find a solution for this strange behaviour:

I have created a project where only certain people can access it and perform various actions, but it's still visible on the project selection screen and even let's a generic user who doesn't have any special permissions to go inside the project (he can't see any issues, so that's a good thing).

In the meantime, I've created another project, but that one the same user cannot see on the list. That's the exact effect I wish to apply for the first project but can't seem to point to why it doesn't happen: both projects have pretty much the same permissions.

I'm posting a screenshot of the permission scheme:

this user is not a member of any of the groups shown above. Can you please help? :(

[Alexey Matveev · Accepted solution]

Hello,

I guess, the user can see the project because you have a user custom field attached to the Browse Issues permission. Try to remove it and I guess the user will not be able to see the project.

[shachar]

If I remove the "user custom field value" from the "browse project permission" he's not able to view it :) But that's not optimal, please see my comment below!

[shachar]

The custom field (Direct Manager) is essential to one of the sub-tasks in the project.

the direct manager field is automatically being populated with the value of another user-picker field (so the direct manager's user varies upon the selection), and the direct manager gets an e-mail notification that he's being assigned with the issue.

If I decline the "user custom field value" for "Browse project" permission scheme, he won't get any e-mails (this permission is necessary).

I don't mind him (the chosen direct manager AKA "user custom field value") to view the project, unless it's about any other user who's not involved in the project.

Any ideas?

Thanks!

[Alexey Matveev]

I gave you the reason, why Jira works like this. If you need this field, then you can not do anything. Just kindly make sure that I am right. You can remove the field and check. Then add the field back.

[shachar]

Sounds odd but ok, thank you :)