Security for Mentions

chris taylor September 16, 2014

"@Mention" Security right now is given at a Global Level(Global Permissions - Browse Users). . However we use JIRA Projects for individual clients. We don't want one client being able to type "@" and see a list of user names from other projects. Is their away to scope this down to the project level?

2 answers

1 accepted

1 vote
Answer accepted
Andrew Wolpers [BlackPearl PDM]
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
September 18, 2014

JRA-7467 sounds like it should remedy your issue. Unfortunately, the fact that its still open means this is still in progress.

Others may know of a better workaround, but I'm not aware of one off the top of my head. 

0 votes
Jeff Turner September 12, 2017

Perhaps something has changed since 2014, but @Mention security is project-level, not global. The project 'Browse' permission is checked. This can be verified experimentally, or seen in the source at SortedMentionableUserSearcher.java#searchForUsers()

JIRA's User Picker is different - it is used (mostly) when there is no issue in scope, and so has to rely on the global Browse Users permission.

Suggest an answer

Log in or Sign up to answer