You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
An issue security scheme is created for my project. In the project there are project roles: Project role 1 and Project role 2.
The following security levels are created in the issue security scheme:
Level 1 - Project role 1
Level 2 - Project role 2
A user "User 1" has project role "Project role 1" , a user "User 2" has project role "Project role 2".
User 1 has created an issue (TEST-1), a security level of TEST-1 is set to Level 1. If User 2 tries to view TEST-1 using url link to TEST-1, he cant open it. That is correct.
But if User 2 selects TEST-1 using jql search he can see the issue in the result list. He still can not open this issue, but if he knows field names he can specify columns and get the data!
Is this a bug? Or such behaviour of the issue security is normal?
@John Funk @Nic Brough -Adaptavist- , this seems to be reproducible only in Jira version 7. Yesterday I tried to reproduce this in Jira Server v8.17.1 and jql search works correctly - it returns only non-restricted issues.
In Jira v7 it was a simple jql "project = TEST" and issue type = task (not sub task).
I'm sorry for disturbing you, this seems to be a bug in old versions of Jira, in Jira v8 this works correctly.
You're right in that this shouldn't work like this - if you're not at the security level, you should not see the issue anywhere.
I too want to ask for the info @John Funk asked for, but could you also tell us the issue types? I'd like to rule out dubious practice with sub-tasks that can be set up to break security in the way you describe...