Create issue gives privilege error even though the given user has the needed privileges

[Jo-André Lia]

Hi.

I have a script that creates tickets in a project called "Time Log Accounts".
The script is called when an Epic is transitioned from the state "To Do" to "In Progress".
The script creates tickets by calling this method:
IssueService.CreateValidationResult createValidationResult = issueManager.validateCreate(user, issueInputParameters)
if (createValidationResult.errorCollection.hasAnyErrors() || createValidationResult.warningCollection.hasAnyWarnings() || !createValidationResult.isValid()) {
log.warn("\nShould not happen! CreateEpicAccounts createValidationResult Errors " + createValidationResult.errorCollection +
"\nWarnings " + createValidationResult.warningCollection.warnings + "\n User " + user)

The user in the script is a user I have called "ProgramUser". This user is only used from scripts and have administrator rights in the "Time Log Accounts" project.

When JIRA users tries to transition an Epic from "To Do" to "In Progress" I get an error in the jira server log:

Should not happen! CreateEpicAccounts createValidationResult Errors Errors: {pid=You do not have permission to create issues in this project.}
Error Messages: []
Warnings []
User ProgramUser(programuser)

If I log into JIRA with the user "ProgramUser" I am able to do this transition and the tickets are created.

So my question is why am I allowed to do this manually and not through the API? It clearly states in the API that the user given as the parameter to issueManager.validateCreate() is the user in which the privilege check will be run against

[Jo-André Lia · Accepted solution]

This is due to a bug in JIRA (https://jira.atlassian.com/browse/JRASERVER-22111)

It does infact use the logged in user instead of the one given to the API call.

Luckily it's a workaround that can be used to get around this, but the issue should be solved in JIRA as this could cause a security issue.