Anonymous made changes in change History - Jira 4.0.2

[Binisha]

Hi All,

In the change History i see "Anonymous made changes" what could be the root cause behind this?Please help me to debug this issue.

Jira has a login process. Then also why this kind of error?

Thanks

[Nic Brough -Adaptavist-]

Because you've allowed the group "anyone" access somewhere. To do this, "anyone" must have "browse" permissions in the permissions scheme, in order to see the issue(s) that they've changed, but also either

1) Edit/update permissions in the permission scheme, or

2) You have a workflow that does not have any "conditions" on transtitions

What change did they make? Look specifically for status changes - if that's the case, then you are missing conditions on your workflow. If they were other types of update (edit, comment, etc), then it's your permission scheme.

[Binisha]

Hi Nic,

Thanks for your response. Il check the above points specified.

Changes they have made is

1. Linked one issue to another(clone)

2. Updated a Text field

Thanks

[Nic Brough -Adaptavist-]

Ok, that kind of rules out the transitions (although I'd suggest checking them anyway).

You must have allowed your users access via the permission scheme, so check that for using the group called "anyone"

Another thought though - have you deleted any users? I never do that, so I'm not 100% sure if it would start saying "anonymous did X" instead of "-login id of deleted user- did X", but it's worth ruling out. (Someone here might be able to tell you how deleted users affect the history, I can't remember how it handles)

[Binisha]

Hi Nic,

I checked the permission scheme and we are not using the Group called "anyone". And also we have not deleted any users.

Thanks

[Nic Brough -Adaptavist-]

Hmm, ok, that covers the two ways I've done it before. Some other quick questions though

• I assume you haven't got a user called anonymous?
• No one has changed stuff in the database?
• Do you have plugins installed that might be doing things anonymously? The script runner, bespokse stuff etc?
• Do you have remote access enabled and in use by anything that might be trying to do things that might not be picked up correctly?

I admit that I'm a bit stuck now - my two initial scenarios are the only ones I can think might do it, and you might need to ask Atlassian directly to see if there are other ways you can do it. Note though - the one about allowing "anyone" to do stuff is quite powerful. It is possible for an admin to log in, enable "anyone" access, log out, do something as anonymous and then log back in and disable "anyone" access. That would leave you with the symptoms you have now, and I don't think there's any way to spot it.

[Binisha]

Hi Nic,

To answer your questions

1. No there is no user called annonymous

2. Ya no one has changed the stuff in database

3. Ya there is a customised plugin which adds/ updates textfields etc, but thats not done anonymously we checked it thoroughly.( its actually a postFunction)

4. We do have remote access enabled - this area we are looking into it right now.

Thanks for your guidance. Please put in any other information if you find, which will help us to track the problem

Thanks

[Binisha]

Hi Nic,

There was a postFunction which was creating a issue link with User = null. Hence the problem. Now its resolved.

Thanks for the guidance provided it was really helpful.