Hello, I currently have the following problem: * All issues have a security level "internal & reporter" * The Mail handler creates new users on mail arrival * External questions are asked via JETI * When the external person answers by mail the comment cannot be created because of the security level (without the security level it works, even if the new user cannot see the issue) My questions are * Is there a way to allow the creation of comments regardless of security level? * Can I modify the security level, so that the comment is created? * Can I create the user when the mail is sent via JETI and add it to the security level (i.e. saving him in a custom field and allowing users in this field in the security level) * Is there any other solution to the problem? Hope someone can help... Thanks in advance Thomas

I resolved it with script runner this way: * add a new userselect field "allowed-user" to the security level * create a new user with the recipient email after sending the mail (post-function) * store this user in "allowed-user" (post-function)

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Comment on issue by mail which has security level

Thomas Heidenreich

Hello,

I currently have the following problem:

All issues have a security level "internal & reporter"
The Mail handler creates new users on mail arrival
External questions are asked via JETI
When the external person answers by mail the comment cannot be created because of the security level (without the security level it works, even if the new user cannot see the issue)

My questions are

Is there a way to allow the creation of comments regardless of security level?
Can I modify the security level, so that the comment is created?
Can I create the user when the mail is sent via JETI and add it to the security level (i.e. saving him in a custom field and allowing users in this field in the security level)
Is there any other solution to the problem?

Hope someone can help...

Thanks in advance
Thomas

Accepted answers

Thomas Heidenreich

I resolved it with script runner this way:

add a new userselect field "allowed-user" to the security level
create a new user with the recipient email after sending the mail (post-function)
store this user in "allowed-user" (post-function)

All comments

Nic Brough -Adaptavist-

This is where the problems that JETI and other plugins that bypass security kick in. Jira's security model is basically correct - a person who cannot see an issue should not be emailed about it. Because you are immediately leaking potentially sensitive information.

If you break this model with something like JETI, then you're asking for more security issues, including not allowing incoming email to update the issues.

So, to answer your questions

1. No. If you can't see it, you can't comment on it. That is correct.

2. No. As per 1.

3. Not without some code, but it is possible.

4. Yes. Dump the security scheme, as it's pretty clear you don't actually need it.

Thomas Heidenreich (//S)

Actually I do need the security and was wondering why I worked in the first place (without the security level).

The clean way (and what I am trying at the moment) would be 3.) Any tips to that? I would need it in a post-function - currently trying Script Runner...

(i) Most of my problems are not the code, but where to start - i.e. what packages to import

Thomas Heidenreich

No, not a new email handler - my soution would be:

add a new userselect field "allowed-user" to the security level
create a new user with the recipient email after sending the mail
store this user in "allowed-user"

Nic Brough -Adaptavist-

Mmm, option 3 would be a new "email handler" - one that can ignore the security. I don't know if the script runner can do email handlers. It's definitely the right place to start, but I've not done it myself. I don't think you need much in the way of imports though - the stuff I've got in the handler I wrote (outside the script runner) was mercifully short.

Tibor Hegyi [META-INF]

Just to put it right, this problem does not come from JETI "leaking security". It is a general security question that derives from the special needs. The best solution would be a custom mail handler. As JETI can throw events for all emails it sends, an event listener developed with script runner could also work well.

Nic Brough -Adaptavist-

Mmm, that's not quite right. JETI is leaking potentially secure information that the application normally prevents. It is of course possible for other plugins to create leaks, and the leaking can well be deliberate and by design. It's a minor quibble with language, but there's no denying that JETI (and others) enables leaking that the core application normally does not allow.

Tibor Hegyi [META-INF]

Nic, what I wrote was that Thomas' problem is not caused by the fact that Users can send protected issues to external people.

Thomas Heidenreich

To comment on that: I find it rather strange, that the plain JIRA mail handler allows commenting to issues which are not visible to the user when he is normally logged in.

Dinny

Tibor: We are having the same issues with this... Can you specify how we can make a workaround with a custom mail handler? (kinda new to this whole Jira admin thing)

Thomas Heidenreich

I resolved it with script runner this way:

add a new userselect field "allowed-user" to the security level
create a new user with the recipient email after sending the mail (post-function)
store this user in "allowed-user" (post-function)

Dinny

When i click on "Script Fields" under Script Runner it only says: There are currently no scripted fields in the System. Please create one by adding a new custom field.

If I click on that link, wich of the filed types should I choose?

Thomas Heidenreich

Sorry, I belive this is more complicated that you think. You have to use a regual userselect field and write a script which you attach to your workflow or via listener.

Dinny

No worries ^^

After a little while I got it to work, wasn't that hard at all

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

mail-handler

security

addon-com.metainf.jira.plugin.emailissue