An issue security scheme is created for my project. In the project there are project roles: Project role 1 and Project role 2.
The following security levels are created in the issue security scheme:
Level 1 - Project role 1
Level 2 - Project role 2
A user "User 1" has project role "Project role 1" , a user "User 2" has project role "Project role 2".
User 1 has created an issue (TEST-1), a security level of TEST-1 is set to Level 1. If User 2 tries to view TEST-1 using url link to TEST-1, he cant open it. That is correct.
But if User 2 selects TEST-1 using jql search he can see the issue in the result list. He still can not open this issue, but if he knows field names he can specify columns and get the data!
Is this a bug? Or such behaviour of the issue security is normal?
@John Funk @Nic Brough _Adaptavist_ , this seems to be reproducible only in Jira version 7. Yesterday I tried to reproduce this in Jira Server v8.17.1 and jql search works correctly - it returns only non-restricted issues.
In Jira v7 it was a simple jql "project = TEST" and issue type = task (not sub task).
I'm sorry for disturbing you, this seems to be a bug in old versions of Jira, in Jira v8 this works correctly.
You're right in that this shouldn't work like this - if you're not at the security level, you should not see the issue anywhere.
I too want to ask for the info @John Funk asked for, but could you also tell us the issue types? I'd like to rule out dubious practice with sub-tasks that can be set up to break security in the way you describe...
Hi, Jira users! Do you use Jira alongside Microsoft Teams? We want to hear how you’ve used the power of Jira Cloud and Microsoft Teams (via the Jira Cloud for Microsoft Teams app) to achieve a team...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events