Users can see other projects they don't have access to

[Erwin Manuel]

Hi,

As normally implemented, some users only have permission to specific project/s.

When a restricted user browse the 'Projects' menu, he can only see his projects. However, If he clicks 'Create Issue' he can browse, and select the other projects. Is there a way to prevent this?

Thanks in advance!

[Thomas Schlegel · Accepted solution]

Hi Erwin,

check the permission scheme of your projects. There is a permission "create issue". There you can control, which projects are visible by clicking "create issue".

Best regards

Thomas

[Erwin Manuel]

I already checked the permission "Create Issues" and I'm positive that the user does not have any permission with the projects that he can create an issue with. Really strange.

[Thomas Schlegel]

that is strange. "Create issues" is the only permission that controls the selection of the projects menu in the "create issue" window. I've tested it in our Jira installation.

How did you set this permission ?

[Erwin Manuel]

'User A' only belongs to 'Group A'.

'Group A' has a developer role in 'Project A'.

developer role has permissions to 'Permission Scheme A', this is the permission scheme of 'Project A'

That is all the permission of 'User A', however, when clicking 'Create Issue', the user can see project B,C,D,F,X...

[Thomas Schlegel]

maybe group A has the developer role in Projects B, C, D ... ?

are there any projects, user A cannot see in the "create issues" view ?

[Thomas Schlegel]

you're welcome,

great you found it :-)

[Erwin Manuel]

I found the culprit! I removed everything in the "Create Issues" permission and added it one by one to catch problem.

The culprit is the 'Current Assignee' item that was included in the "Create Issue" permission.

I removed it and the issue is gone. Thanks!