Dashboard edit permissions

Question

Is there an reason why only the owner of the dashboard can edit the dashboard?

From a security standpoint it adds an additional 3 steps per dashboard to edit in the event that an user accidentally share a dashboard with the Global ("Everyone") setting.  An admin cannot just edit the dashboard to change it to a compliant share setting, without changing the owner, then find the dashboard, edit the permission, then change the owner back to the original owner.

Additionally would it be possible to add a GET, DELETE, POST /rest/api/2/dashboard/{id}/permissions/ endpoint where an admin can systematically perform the permission cleanup?

Thuan Nguyen_j1g46d · Answer

Hi @Robert Ikeoka

Here are some related tickets that you can watch & vote:

- Ability to Bulk Edit Shared Dashboards and Filters: https://jira.atlassian.com/browse/JRACLOUD-39724

- Allow JIRA Administrators to edit shared filters/dashboards owned by others: https://jira.atlassian.com/browse/JRACLOUD-60109

- Global Admin must able to edit the filters/dashboards permission without being the group: https://jira.atlassian.com/browse/JRACLOUD-73647

Thanks,
Thuan.

Richard Cross · Answer

Ha ha... true, but humans also get annoyed when they are forced to be the "single point of failure" for anything that is set up for shared use.

It seems an odd design to present Dashboards as something that can be shared... but then restrict administration as if they're merely "personal" screens.  I also note that the same level of security diligence is not in place for JIRA projects.

Nic Brough -Adaptavist- · Answer

Because humans get really annoyed when you mess with their stuff without talking to them first.