Anonymous user can resolve and reopen issues in one of our project. In other our projects it is not allowed. All projects use the same Default Permissions Scheme. So it is strange. I need to restrict anonymous user only for view isses w/o any editing. Please help.
It is not based on permission scheme. The workflow transitions require that Conditions are set so that only authorised people can execute the workflow transistion. Please check the workflow of the issuetype/project which is having this problem and add the necessary 'Conditions'
If they can view it, they can execute a workflow transition if it doesn't have restrictions. We restrict all transitions to the Assignee and in some cases roles. The idea is the assignee is responsible for the issue and no one should be moving it through a transition besides them. If they need to move it, say for instance the assignee is on vacation, they just assign the issue to themselves first. An anonymous user would never be the assignee so they couldn't move it.
I'd also add that in Jira 6.3+, there is a new permission called something like "Can use transitions". This fixes the default "anyone can use a transition if they can see the issue" problem so you don't have to worry about it any more. Despite saying that it fixes it, I would still STRONGLY recommend that you think about your conditions while working with workflows at all times.
Thanks all for fast answers! We are using JIRA v6.0.4.
I checked my problem project, its indeed has a custom workflow. I check a transition "Reopen", it has no any conditions. I add one: "Only the assignee of the issue can execute this transition." but it didnt help. Anonymous still can see "Reopen" button and can click it, and issue is reopened in this case.
I also checked our default workflow which is used in the most of our projects. "Reopened" transition in it doesnt have any conditions but projects which use this workflow doesnt show "Reopen" button for anonymous.
Joseph, it not very obvious practice that if users can view an issue then they can do transitions. And for my JIRA instance it is not true since for projects with default workflow issues can be viewed by anonymous but can not be reopened.
May be I missed some simple thing in massive JIRA configuration mechanism, please narrow me. Our Project managers complain about every action which is done by anonymous user.
I don't know what could cause this behavior. I'd open an issue with Atlassian.
Oh, my question still being actual. I have to say that one of our team rejected to use JIRA in theirs work, and one of the reason was the issue from the topic.
It sounds like you're resisting the solution of putting conditions on transitions. As NIc said, the way to control transitions is with conditions such as Assignee only, a particular project role, or assignee and project role.
Yes, but I failed to find out how to restrict Anonymous user using conditions on transitions. Probably its my fault, but if JIRA' settings would have a checkbox "dont allow to edit by anonymous" per project or smth like that it would make my life much easier:)
It looks like you're new here. Sign in or register to get started.
