Versions Compared

Old Version 9

changes.mady.by.user Old Street Apps

Saved on

compared with

New Version Current

changes.mady.by.user Morgan Folsom (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Expand
titleIs User Impersonation enabled by default?

No. By default, User Impersonation is disabled and no users have access to Impersonate themselves, or any other users.

To give users access to this feature individual users and/or groups must be added to the User Impersonation Permissions in the Custom Jira Charts administration settings.

⠀

Expand
titleHow is User Impersonation secured? What is a "Unique Hash" for User Impersonation?

When a user builds a Custom Jira Chart in the Confluence editor and clicks Insert or Save a number of very important steps happen:

  1. The User Impersonation permissions of the user are checked again to ensure that they still have the correct permissions to create a chart impersonating the selected user

  2. Every parameter from the chart is used to generate a unique hash. This includes:

    1. The source JQL or Saved Filter for finding issues

    2. The Chart By and Group By field selections

    3. All segment configuration (color, names, order, etc.)

    4. The page ID of the page the chart is being created on

  3. This hash is sent to the database

    1. On Confluence Server and Data Center this is the same database as your Confluence instance

    2. On Confluence Cloud, this hash is stored on the Custom Jira Charts database

This means that, if anyone attempts to change anything about the chart, even the color of a segment, the hash that is created won’t match the has stored in the database and there will be an error.

Info

User Impersonation is secure by design so that only the Jira data specified by the creator of the chart is displayed.

⠀

...

Expand
titleCan someone without the right permissions edit a chart I've created?

No. When a chart with User Impersonation is saved, a unique hash is generated specifically for that chart configuration. This unique hash means that there can be no changes made to the chart unless the user trying to edit the chart has the correct permissions. If a user without the correct User Impersonation permissions tries to edit a chart, this is the message they will see:

Image RemovedImage Added

If they click a user clicks “Remove User Impersonation” then the chart will revert to the default setting of no impersonation and load the data as the current user.

⠀

Expand
titleDoes User Impersonation work with the Simple Search gadgetmacro?

No. When the data source for a Custom Jira Chart is a Simple Search gadget macro then User Impersonation is disabled. This is because the Simple Search gadget macro allows for arbitrary JQL to be run which would bypass the security restrictions we have built for User Impersonation, allowing any user viewing the chart to write any JQL query.

This is something we are looking to improve in future but for now, this feature is disabled.

⠀

...