Issues restricted by security level are shown in jql results

Question

An issue security scheme is created for my project. In the project there are project roles: Project role 1 and Project role 2.

The following security levels are created in the issue security scheme:

Level 1 - Project role 1

Level 2 - Project role 2

A user "User 1" has project role "Project role 1" , a user "User 2" has project role "Project role 2".

User 1 has created an issue (TEST-1), a security level of TEST-1 is set to Level 1. If User 2 tries to view TEST-1 using url link to TEST-1, he cant open it.  That is correct.

But if User 2  selects TEST-1 using jql search he can see the issue in the result list. He still can not open this issue, but if he knows field names he can specify columns and get the data!

Is this a bug? Or such behaviour of the issue security is normal?

John Funk · Answer

Glad that is it is working in a later version.

Ekaterina_6s2cbs · Answer

@John Funk @Nic Brough -Adaptavist- , this seems to be reproducible only in Jira version 7. Yesterday I tried to reproduce this in Jira Server v8.17.1 and jql search works correctly - it returns only non-restricted issues.

In Jira v7 it was a simple jql "project = TEST" and issue type = task (not sub task).

I'm sorry for disturbing you, this seems to be a bug in old versions of Jira, in Jira v8 this works correctly.

Nic Brough -Adaptavist- · Answer

You're right in that this shouldn't work like this - if you're not at the security level, you should not see the issue anywhere.

I too want to ask for the info @John Funk asked for, but could you also tell us the issue types?  I'd like to rule out dubious practice with sub-tasks that can be set up to break security in the way you describe...