Can "project lead" changes be traced using JIRA auditor ?

[Dieter]

Hi all,

I haven't found a way how to detect changes of project leads using this plugin.

Anyone knows if this can be done?

Please look here to see why we have this requirement

[Sergey Markovich · Accepted solution]

Hi Dieter,

This feasture is not implemented in JIRA Auditor yet.

We'll implement it in the next minor version. I'll update you when it is available.

[Dieter]

Good news, thanks -:-)

[Nic Brough -Adaptavist-]

Hmm, I can't get a normal user with admin rights to change the project lead. What version of Jira are you using, what rights do your project leads have and could you show us where they get to edit the project lead?

[Dieter]

Hi Nic,

We have many project administrators within a single project and each one of them can change the project lead. On the other hand we have granted the right to delete issues only to the project lead. So each project administrator can change the lead to himself and thus get the right to delete issues. This is not traced but as you see one effectively bypasses the security scheme

[Nic Brough -Adaptavist-]

Oops, sorry, I misunderstood. I think that's a design flaw in Jira. I think I've seen it raised somewhere in Atlassian's Jira, but I can't remember where.

[Dieter]

if you don't mind, vote on my issue . Your voice is heard at Atlassian :-)

[C_ Faysal]

i voted on that one

[C_ Faysal]

Hi Dieter...

i don't get behind the request completely...

We have noticed that any project administrator is able to change the project lead. This is a security problem in our opinion since the permission scheme grants special rights (e.g. Delete issue) only to the project admin.

what i got is..that any user who is in the "administrator" role in a project is able to change project lead from any other project?

[C_ Faysal]

oh i see....

looks like you ask for the possibilty to allow project-lead changes to a selected group of users only...

afaik this is not possible with permission schemes...

[Dieter]

I have updated the JRA issue to make clear that a project administrator can change the lead of *his* project only.

Knowing that it's not possible i have created this issue. But as long Atlassian hasn't fixed that i am looking for a possibillity to trace it using the JIRA Audit plugin.

Of course it could hack something on my own but this would make my JIRA installation even more unmaintainable as it already is ;-)

[C_ Faysal]

to trace changes on this you could enable sql loging. all sql relevant stuff will be posted in atlassian-jira-sql.log

changes to project lead will look like

2012-12-20 14:19:24,296 ajp-bio-8009-exec-20 cfaysal 859x7090x1 10g48yp /secure/project/EditProjectLeadAndDefaultAssignee.jspa 7ms "UPDATE project SET pname='TEST', URL='null', LEAD='tester', DESCRIPTION='', ASSIGNEETYPE='2' WHERE ID='11701'"

where cfaysal is me who was logged in and setting Lead of a project called "Test" to username "Tester"

i understand this is not the most comfortable way to do it....but at least you can grab the information you were askin for

[C_ Faysal]

i am looking for a possibillity to trace it using the JIRA Audit plugin.

did you asked the vendor if it is possible to track this action too?

[Dieter]

i asked the vendor to post an answer here.

I appreciate your suggestion to turn on SQL logging but our environment is likely to dynamic so the log files will roll over quickly. Let's see what Atlassian and the vendor of the plugin tells me.