JIRA Android App allows regular users to change/assign Sprint

[Henry Katz]

We run a JIRA Cloud. 

Our project set up such that only Project Lead can change Sprint Assignment.

However, The Atlassian official Android JIRA app allows all users to change Sprints.  We want to disable/block this access problem.

Is it a permission bug in JIRA? Is there a workaround?

[Josh Carolan · Accepted solution]

Hi Henry, 

I just have a couple of follow up questions so we can get to the bottom of the problem here. When you say 'change Sprint Assignment' do you mean edit the sprint of an issue (ie move an issue to a different sprint) or do you mean editing the sprint information/ starting a sprint from the backlog or completing a sprint from the board? 

This may well be a bug on our end but I just need some more information on what the problem is.

--------------------------------------------------

EDIT:
After some investigation we have found that this is indeed a bug. Thanks for bringing it to our attention, you can follow the progress of the fix here: https://jira.atlassian.com/browse/JSWCLOUD-16954

--------------------------------------------------

 Thanks,

Josh

Developer, Jira Android

[Henry Katz]

Josh, 

I mean the Sprint Issue filed is editable in  Android App by users. In other words, users can set the value of the Sprint to any active sprint.  

-

We discovered that one engineer was manipulating the sprint values using the mobile app and the Project Lead did not know it happened. Which brings another question how can I (admin) search all other instances of Sprint value manipulation. Just to see if this was abused in the past in multiple instances.

[Josh Carolan]

Henry,

Thanks for bringing this to our attention, I will do a bit more investigation and get back to you here.

[Josh Carolan]

Henry,

Just checking - the way you made it so that other users cannot change the sprint, did you do this by revoking their schedule issues permission? If this isn't how you did it, what did you do to make it so that the project lead is the only one that can move issues between sprints?

[Josh Carolan]

After some investigation we have found that this is indeed a bug. Thanks for bringing it to our attention, you can follow the progress of the fix here: https://jira.atlassian.com/browse/JSWCLOUD-16954