nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Why is a person with only browse project permission able to close an issue when they do not have close issue permission?

Donna Armstrong

I have the following project roles:

Administrators, Assignable Users, Read-Only, Issue Closers, and Users.

My permission scheme is set up to allow Administrators, Read-only, and Users the browse project permission - and Issue Closers and Reporter the close issue permission.

Why is it that a person with the project role Users that is not the Reporter is able to Close the ticket?

Accepted answers

Rahul Aich [Nagra]

PLease check

1. if the permission scheme you are browsing is enabled to your project

2. Close issue permission does not include any group and the member closing the issue may be included in that group

3. Close issue transition on your workflow does not have any funny post-function attached to it.

Rahul

All comments

Nic Brough -Adaptavist-

Look at the conditions on the workflow - I suspect you'll find that the "close" transition is missing a condition like "must have close permission"

Rahul Aich [Nagra]

PLease check

1. if the permission scheme you are browsing is enabled to your project

2. Close issue permission does not include any group and the member closing the issue may be included in that group

3. Close issue transition on your workflow does not have any funny post-function attached to it.

Rahul

Donna Armstrong

I don't have "must have close permission" set up in the transition - but I do have "must be in specific group". The system is allowing anyone with browse access the ability to close all issues - even though they are not part of the specific group that is a condition in the transition.

Donna Armstrong

1. I have verified that the permission scheme is in place and indicates that only the Reporter and someone with the project role Issue Closers has the Close Issues permission.

2. The Close Issue permission does not include any groups.

3. The transition only contains the 5 standard post functions:

Set issue status to the linked status of the destination workflow step.

— THEN

Add a comment to an issue if one is entered during a transition.

— THEN

Update change history for an issue and store the issue in the database.

— THEN

Re-index an issue to keep indexes in sync with the database.

— THEN

Fire a Generic Event event that can be processed by the listeners.

Nic Brough -Adaptavist-

Could you post the exact conditions, and then the group and role membership of a user who is able to perform the transition (when they shouldn't be able to)

Donna Armstrong

Transition Reopened => Closed:

All

Conditions (2)

Validators (0)

Post Functions (5)

Only users in group JIRA_SBS_REPORTERS_PR can execute this transition.

— OR

Only users in group JIRA_SBS_MANAGERS_PR can execute this transition.

Browse Project permissions go to the following:

Project Role (Interested Parties) (Delete)
Project Role (Administrators) (Delete)
Project Role (Read Only Access ) (Delete)
Project Role (Users (Developers, Project Managers, & Testers)) (Delete)
Group (JIRA_TRAINER_PR) (Delete)
Group (JIRA_ALL_PROJECT_PR) (Delete)

Close Issue permissions go to the following:

Project Role (Issue Closers) (Delete)
Reporter (Delete)

I myself am a member of the JIRA_ALL_PROJECT_PR role, which was created so that people with a need to see all projects across the company could see them...but not transition them. Browse Project is the only permission that the role has been granted. However, I am able to transition the workflow to closed.

My group memberships are as follows:

We have also verified that users who are not part of JIRA_ADMIN_PR and JIRA_SYS_ADMIN_PR can make the transitions. JIRA_USER_PR is the role that we have designated via LDAP that all users must have in order to log into JIRA.