Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,456,675
Community Members
 
Community Events
176
Community Groups

Issues restricted by security level are shown in jql results

Edited

An issue security scheme is created for my project. In the project there are project roles: Project role 1 and Project role 2.

The following security levels are created in the issue security scheme:

Level 1 - Project role 1

Level 2 - Project role 2

 

A user "User 1" has project role "Project role 1" , a user "User 2" has project role "Project role 2".

User 1 has created an issue (TEST-1), a security level of TEST-1 is set to Level 1. If User 2 tries to view TEST-1 using url link to TEST-1, he cant open it.  That is correct.

But if User 2  selects TEST-1 using jql search he can see the issue in the result list. He still can not open this issue, but if he knows field names he can specify columns and get the data!

Is this a bug? Or such behaviour of the issue security is normal?

3 answers

@John Funk @Nic Brough -Adaptavist- , this seems to be reproducible only in Jira version 7. Yesterday I tried to reproduce this in Jira Server v8.17.1 and jql search works correctly - it returns only non-restricted issues.

In Jira v7 it was a simple jql "project = TEST" and issue type = task (not sub task).

I'm sorry for disturbing you, this seems to be a bug in old versions of Jira, in Jira v8 this works correctly.

John Funk Community Leader Jan 11, 2022

Glad that is it is working in a later version. 

0 votes

You're right in that this shouldn't work like this - if you're not at the security level, you should not see the issue anywhere.

I too want to ask for the info @John Funk asked for, but could you also tell us the issue types?  I'd like to rule out dubious practice with sub-tasks that can be set up to break security in the way you describe...

0 votes
John Funk Community Leader Jan 10, 2022

Hi @Ekaterina 

Can you share some screenshots of your JQL and the results which show the Security level also? 

Suggest an answer

Log in or Sign up to answer
TAGS

Atlassian Community Events