Permission to create a ticket

Nicolas Leboeuf

Hello,

i'm trying to set up Jira to see if it fits our needs.

I need to give a limited access to a group of people. I've created the role, assigned a user, and tried to give the right permissions.

One of the permissions i want is to "Create a ticket". But when i tick "Create a ticket" in the role page, i don't get the button as a user.

After testing, i've found that i need to tick "Transition any issue" under "Work on [project] issues".

That doesn't make any sense for me, but it is what happens.

Is it normal ? Is it a bug in the role system ?

 

Thanks.

Nic Brough -Adaptavist-

Yes, this is not a bug, but a result of evolutionary pressures.

Originally, Jira controlled "create issue" by having a simple "create issue" permission.  A transition could be done by anyone who could see and update the issue.  But there was a problem - if you could get the right tokens and work out the url, you could transition an issue that you didn't actually have any other permission for.

This is obviously a security hole, but working out how to do it was such a monumental pain, no-one bothered.  But then we got the remote APIs, and it became a LOT easier to do bad things.

So, to save admins having to put a condition on every single transition, Atlassian added the "transition issue" permission. 

This solved the problem, but, "create issue" is a transition, so it protects that as well.

So that's why you have to do it this way! 

Personally, I don't think it's properly fixed - I'd like a snippet of code that excludes the "create" transition, then it would actually make perfect sense, and would not have tripped you up!