Users can clone tasks & retain the Sprint Value without 'permissions'

[Charles Johnson]

I had a user (without the schedule or manage sprint permissions) clone an existing active sprint task, and the user was able to retain the cloned sprint value - thereby altering the sprint scope.

That seems wrong - 

I would think that if they don't have the permissions to add something to a sprint - they shouldn't be able to clone tasks & retain the sprint information.

has anyone else encountered this?

[Earl McCutcheon]

Hi Charles,

As of implementing the fix for this Feature Request:

- https://jira.atlassian.com/browse/JSWSERVER-6541

We added in an option to remove the Sprint details on the clone action, so when a user clones the issue there is a check box "Clone sprint values" when unchecked it will remove the sprint value, but this does ad in the behavior you described where a users Schedule Issue permission is ignored in this action and if selected can add an issue to an active sprint, and we are tracking this as a separate BUG here for the follow up:

- https://jira.atlassian.com/browse/JSWSERVER-10548

The Workaround Involves using the add-on Jira Suite Utility (JSU) to run a post function to clear out the sprint data tied to the permission on the create issue transition so that cloned issues do not erroneously cause scope creep, Additional details on this can be found here:

- Clear Sprint information when cloning JIRA issue

Regards,
Earl