Restricting assign permission does not work?

[yorams]

Hi,

As a process manager I would like to configure a read-only user so I can display relevant Jira boards in a public area of the company where visitors may have access to the mouse and keyboard of the computer showing the browser with the Jira boards.

It is a security thing.

I have used admin privileges to mange user groups so that there is a distinction between jira-access (view, read) and jira-users (write, make changes).

I made sure that all state-changing permissions are given only to jira-users in the relevant projects and defined a read-only user by including it in the jira-access group yet not in the jira-users group.

All seems to work well except for the assign permission.

The read only user can still assign issues to assignable users thus changing issue state.

Bug?

[Vishwas]

Hi @yorams 

Can you please check what roles or groups are there for "Edit Issues" and these 2 below in Project Permission Scheme

Regards,

Vishwas

[yorams]

Hi @Vishwas thanks,

The relevant read-only user has no permissions for either of these.

This works correctly for assignable user (R/O user is not available for assigning) and for edit issues (R/O user cannot edit fields on issues), yet it can change assignees of issues no problem.