script runner separation - seriously?

[Tomas Karas]

Hello community,

I'd like to question and challenge the current scriptRunner code when it comes to handling jira-administrators and jira-system-administrators separation being applied in Jira. This can be due to various reasons, for example one team responsible for platform being up and performing, and the other only responsible for doing support related tasks for users requesting configuration changes.

ref: https://confluence.atlassian.com/adminjiraserver072/managing-global-permissions-828787760.html

Effectively with script runner including script console, any user can do and execute anything as account that runs Jira, possibly even grab LDAP configuration from database, aside creating/modification/deletion of files in filesystem.

So my question is as follows: if Jira already has separation of these roles build in, why such powerful tool, ignores it?

I would ask for confluence as well, but there Atlassian is seriously behind because they offer the separation in global permissions, but in the end of the day nearly everywhere is confluence-administrators group hard-coded anyway.

//Tomas

[Peter-Dave Sheehan · Accepted solution]

Do you know that you can manage script edit permission via the /plugins/servlet/scriptrunner/admin/settings page?

You can't remove the system-admin permissions, but you can decide which other admin groups to include.

[Tomas Karas]

That works, except it literally restrict all scriptRunner access.

Even parts that are just workflow related that uses nearly same access as non system-admin group.