Jira - History tab

[Dolly Kirubavathi]

How I can I filter the contents of the History tab to see the list of all the changes that has happened to an Issue?

Appreciate the help!

[Jack Brickey]

Hi Dolly,

There isn't any means of filtering on the contents in the history tab. You mentioned wanting to see the list of all changes which I think is the purpose of the history tab itself.

[Dolly Kirubavathi]

If I want to see the history of changes for a group of projects in a list view or something I cannot? 

thanks!

[Quentin Sixt]

@Jack Brickeythis is a confidentiality breach if you let it open without right management.

Jira itself manages rights, so, the sames rights should be managed in the history log.

You shouldn't be able to see logs about things you're not allowed to see.

For exemple, if i use Tempo-Timesheet and I log time in the issue, you should not see this, and the amount of time logged if you don't have the rights to see the tempo module ...

And right now, you can see it, that's not logical, and that's a confidentiality leak.

[Deniz Oğuz - The Starware]

Hi @Quentin Sixt 

For this reason, our timesheet app, "WorklogPRO - Timesheets for Jira" provides its own "History tab" implementation. It correctly filters worklog related events from the history tab depending on your permission to view worklogs. After installing the app, you need to switch to WorklogPRO's "History tab" from "General settings" of the app. The same issue also exists in "Activity stream" and WorklogPRO also provides its own "Activity stream".

Unfortunately, advanced users can still access Jira's Rest API to see worklogs (if they have permission to view issue itself) even though they don't have permission to view worlogs. At least our implementation fixes this on the UI.

[Jack Brickey]

@Quentin Sixt , if you feel there is a security issue you should report here - report-a-vulnerability 

[Quentin Sixt]

Thanks @Deniz Oğuz - The Starware i'll check. We should'nt have to pay for a basic functionnality, but, i'll check.

@Jack Brickeythe problem here is that Atlassian's definition of vulnerability is biaised, as they only count as vulnerability, things that compromises their system. This one doesn't do that... it's just a basic confidentiality feature missing.

[Jack Brickey]

That could be but I think the best course to get your voice heard would be thru direct Atlassian feedback channels trust center, in-app feedback, support