Project visibility and its components - security issue

[Maciej Kawczynski]

After migrating to new jira 6.2.3 every user can see couple of projects on the all project list and its components names with no permission to this project. Anyone know problem like this solution ?

[Nic Brough -Adaptavist-]

You've allowed "anyone" to see the projects.

[Maciej Kawczynski]

Users with no permission to this project can see it on the list. They dont see the issues, only project and components names

[Nic Brough -Adaptavist-]

Oops, sorry. Also a possibility - you've used a user or group picker in the project browse permission. That has to expose the project to people who might be named there, even if there are not yet any issues that match the criteria.

[Maciej Kawczynski]

In project permissions there is only couple of users who need acces to this project and they see all issues, can create issues, but every one (around 2k users) can see the project on the list with no permission. There is no group added to project permission, only users

[Nic Brough -Adaptavist-]

That still strongly suggest you've allowed "anyone" to browse the projects. Then used issue security and/or reporter-browse to hide existing issues from them.

[Nic Brough -Adaptavist-]

Right. First, go to the project and check exactly which permission scheme it is using. Then, go into that scheme and list here *everything* that has "browse project" rights.

Don't try to interpret or explain anything, just give us the plain text of the box on the right (feel free to obscure any names with personal id info with xxxx's)

[Maciej Kawczynski]

This is browse project rights of this project:

• Zgłaszający - Reporter
• Aktualnie Przypisany - Current assignee
• Rola w Projekcie (xxxxxxx) - Project Role
• Rola w Projekcie (Administrators) - Project Role
• Wartość Niestandardowego Pola Użytkownika (xxxxx) - Custom filed value
• Wartość Niestandardowego Pola Użytkownika (xxxxx) - Custom filed value

[Nic Brough -Adaptavist-]

It's the first line.

If you allow the reporter to see the project, Jira has to open up the project to everyone who *might* report an issue.

Sorry it's taken a while to get there, you said the users had "no permissions", but there's actually loads there (other than the role ones which tend to be standard)

[Maciej Kawczynski]

We have done test with newly created user with only jira-users group and after login to jira we can see only this project on the list of all projects.

[Maciej Kawczynski]

You are right but permission for "Create Issue" in this project looks like:

• Rola w Projekcie (Administrators) - Project Role
• Rola w Projekcie (xxxx) - Project Role
• Rola w Projekcie (xxxx) - Project Role
• Rola w Projekcie (xxxx) - Project Role
• Rola w Projekcie (xxxx) - Project Role

[Nic Brough -Adaptavist-]

Yes, because they might be a reporter.

[Maciej Kawczynski]

After i deleted Reporter permission to browse project i still can see project

[Nic Brough -Adaptavist-]

Could you remove (temporarily, of course) assignee and the two custom fields as well?

[Maciej Kawczynski]

I have to removed all permissions except project roles, and now work fine only users with permission can see project. I think it is bug because users with permission create issues should see project not every user in jira.

[Maciej Kawczynski]

Than you for your help