User without View Development Tools permission is able to browse indexed Git repos

[Dominik Pyrka]

We have a service account in JIRA which doesn't belong to any group tied to any permission schemes where 'View Development Tools' is allowed. However, after logging to JIRA using such account, we can still click Git > View all repositories and browse everything. The tooltip next to 'Repository Browser' option clearly states that user has to have View Development Tools permission to be able to browse the repos. Is this a bug? Is there any other way to prevent this service account from accessing indexed content?

This is an LDAP account which has been blocked on our Gitlab server. Git integration for Jira is the only way of accessing repos for this account and we would like to revoke such access.

[Mark L. Smith]

And one more thing... is the service account an administrator?

[Dominik Pyrka]

No, the service account is not an administrator.

[Mark L. Smith]

Hi Dominik,

Typically what we find when this happens is that the user has some random projects where it has View Development Tools permission (possibly through a group) AND all/some of the Git repos are associated with all projects.

What you should see happen is if a user really has no access to any project View Development Tools then the Git menu itself won't show up for that user at all.

Do you currently have all the Git repos associated with all projects?

[Dominik Pyrka]

Yes, the 'associate with all projects' option is checked. We could manually select projects we wish the plugin to be associated with, but it's a large number and in the past we've been experiencing issues. With every update of the Git integration add-on, we needed to remove and readd the integration or else it wouldn't index. Manually marking these projects after every update sounds like a lot of pain.

[Mark L. Smith]

I think solving the index failure after upgrade might help.

What version are you on now?

[Dominik Pyrka]

We're on JIRA 7.9.0 and Git addon 2.13.4.

Let me manually associate repos to projects and get back to you.