How to hide attachments for some people?

Question

We have conflicting requirements that:

* closed issues should be publicly available, so that everyone can see what is fixed
* sensitive data from customers should not be available.

The compromise that we found is that, when an issue is closed, its summary and description should be made public (after some manual check), but not comments and attachments. 
Now, we need to implement this :-)

Comments can be worked out, since there is a visibility field on them, but the visibility of attachments is the same as the issue they're on. (There are several long-outstanding improvement requests related to this: JRA-6185, JRA-3893, ...)

Here are a few workarounds we could think of:

* cloning each closed issue into a public project, removing comments and attachments
* forbidding the attachments, and using a protected FTP server to store them
* removing the attachments of an issue when it's closed
* adding a proxy in front of our public JIRA, so that the nasty bits are removed from the page
* ... ?

All of this seems rather clumsy... Would you have a better solution? Or what would you consider the less ugly one?

Thanks

MattS · Answer

JIRA doesn't do field level security that well so I would look at using a custom post function to copy the data you want to share somewhere else such as a field that is shared in a Confluence page

Vadim Rutkevich_4dwnfh · Answer

Samuel, you could try our add-on - Smart Attachments (https://marketplace.atlassian.com/plugins/com.stiltsoft.jira.smart-attachments). It allows you to delegate access to particular attachment categories for the appropriate user groups. So you can easily restrict access to attachment categories that will be hidden. You can find details at https://docs.stiltsoft.com/display/CATAT/Managing+Categories. Thanks.

Best Regards,

Vadim Rutkevich

Paul Clark _Redmoon Software_ · Answer

Hi, not sure if this will be appropriate for you but I have a plugin called Attachment Permissions (https://marketplace.atlassian.com/1212271) that allows you to restrict visibility of attachments to a user group and/or reporter, assignee and creator.  This isn't just for open and closed JIRAs but if access is restricted to creator, assignee and reporter than only these users would have access when the JIRA is closed.

Thanks, Paul