Smart Commit Warning

[Prantar Bora]

Hi,

We want to enable smart commits in Crucible so that users can directly transition issues in the linked project in JIRA or create review while committing. 

However we have seen the following warning while enabling smart commits in Crucible administration.-- "When using Git or Mercurial, it is possible to commit under any username. Ensure you can fully trust your committers when using those systems."

Our repositories are hosted in Bitbucket and most users use Git clients.

Could some please suggest what exactly this means and what implications this could have ? For e.g. can a user who is having permission to commit in Stash but no permissions in the JIRA project be able to transition an issue while committing?

Thanks,

[Vitalii Petrychuk · Accepted solution]

This means that UserA can modify his git config settings in the next way:

• Set user.name to UserB
• Set user.email to UserB@company.com

Then using Smart Commits he can perform all possible operations as UserB (if UserB is authenticated with JIRA Software).

[Lance Milleson]

This sounds like a horrible security issue!