User with no Browse Project permission can still see project in Projects list

[Tibor Polgar]

We have one and the same Jira instance for multiple teams. I want to have my team to only see our projects and remove/exclude every other project from the Projects list that my team has no Browse Project permission to.

If I look at the Permission Scheme of one project that I want to exclude from the Projects list, I can see this:

The user I am currently testing this scenario with is not a member of the internal users, and yet he can still see the project in question in his Projects list. It would not let him see the project details when he clicks on the project however (as expected).

Any help is much appreciated!

[Sebastian Krzewiński]

Hi Tibor

Please check that user, who shouldn't see this project is not member of:

- internal users

- PJ Abatement...

- project role atlassian-addons-project-access

Regards,

Sebastian

[Tibor Polgar]

Hi Sebastian,

thank you for your quick reply.

The user in question is not assigned to the project role in the project and is not a member of those two groups. Up until last week I had had a trial version of Jira Cloud - and I experienced the same issue there: you could see projects in the Projects list even if you did not have Browse Projects permissions to them.

Thanks,

Tibor

[Brian Mertens]

@Tibor Polgar Did you ever resolve this issue?  I have a Data Center instance that is experiencing the same problem.  Thanks!

[Tibor Polgar]

hi @Brian Mertens , we have simply ignored this glitch in the matrix since then. It is annoying for sure, but not a deal-breaker for us. Our Jira-cloud instance is company managed and to make our lives easier, we have come up with a team-specific prefix in project names. This way we can search and filter for team projects and construct boards a lot easier.

[Steve Letch]

@Tibor Polgar 

Currently experiencing this while carrying out a project to onboard a separate entity into our Jira. Have changed our 'public' permission scheme from any logged in user to a specific group. However the test user can still see all the projects on our 'restricted' permission scheme that requires Developer role for browse rights, odd thing is, if they click into the project, they can't see any tickets and if you inspect perms as an admin, it shows they don't have the browse perm. Have restarted the instance, no fix, am doing a full reindex to see if that fixes, failing that I'll do a test tweak to the 'restricted' permission scheme of some dummy role to see if that essentially 'reindexes' the permission scheme itself.

[Brian Mertens]

@Tibor Polgar @Steve Letch , check out this bug: JRASERVER-74235.  That may be the cause of the behavior that you are experiencing.  That bug is for Data Center/Server (I haven't tested in Cloud).