Why is the comment button still visible even user has no permission to place comments?

[Marya Calaunan Magno]

Hi!

We defined a user to NOT have permission to add comments in any issue. She doesn't have a comment button when viewing the issue details BUT she can leave comments via the side bar that appears when you click an issue. **please see screenshot below**

I do not have any idea what else can I setup just to hide that comment button. Permission scheme is setup correctly. Please help. Thank you so much! I'd really appreciate. Cheers!

[Andy Heinzer]

I tried to reproduce this problem in my Jira Software 7.8.1 version.  I created a user that had access to view these issues, but not to comment on them.  While I could see that Comment button in on the board's issue detail view, my restricted user could not actually leave comments on that issue.   Instead in my case I got a popup error of Communication breakdown when attempting to leave a comment via that method.  The comment button does not appear when visiting the issue directly for that user.

I believe the fact that comment button appears for this user is a bug in Jira.

However I am interested to learn more about your instance of Jira to better understand if there is possibly a second separate bug report that should be filed for this permission discrepancy.

Please let me know what version of Jira Software you are running in this instance.   You can find this information by going to the Cog icon -> Applications -> Versions & Licenses or you can go to directly by using your [JIRAURL]/plugins/servlet/applications/versions-licenses.

Regards,

Andy

[Marya Calaunan Magno]

Hi Andrew,

Your response is really helpful! Tried replicating the scenario in a test project and indeed I just encounter the Communication breakdown message. :)

Thank you so much! By the way, just a follow up question, are "Add Vote" and "Add Watch" functions available by default to a user who ONLY has Browse permission?

Hope you can advise as well.

Thanks so much,

Marya

[Andy Heinzer]

Hi Marya,

I created a bug ticket for the Comment button appearing on that page: https://jira.atlassian.com/browse/JSWSERVER-16559

I don't think that button should be appearing there for users without the comment permission.   I know Jira 7.8.1 is effected, but there are likely other versions that exhibit this bug behavior.   The good news so far is that, I don't believe users can use that button to actually leave comments, unless they have permissions in that project.

As for the vote and watchers part of a Jira issue; the ability to see these elements on a Jira issue is a separate permission in the Jira Permission scheme applied to each project.  The name of the permission is 'View Voters and Watchers'.   By default in Jira, this is granted to the 'Any logged in user'. 

However if you have modified a permission scheme and only granted this particular user/role the 'browse issue' permission, that user would be able to see the issue, but not be able to see the watcher or the votes on the issue.  That user would also need the 'View Voters and Watchers' permission to be able to view that information.   That permission is explained in more detail in Managing project permissions.

I hope this helps.

Andy