Client user can see, and add, internal notes

[Peter Connolly]

We found out recently that a client user of our JSM product can read and add internal comments intended for our team only.

The user needs to be able to see all tickets for their company (they can), whether they created them or not, but should NOT be able to read or create internal comments. In this screenshot, you can see that the user created the original ticket, and was able to add an internal note. He should be able to reply to the previous comment, but only publicly.

[Nicholi Gray]

I found a work around for now until Atlassian fixes the larger permissions issue.

Go to project permissions > in the Browse Project permission, make sure you only have roles to the project and "Service Project Customer - Portal Access"

If you you have a group, lets say everyone, or Internal users, they will be able to view and create internal comments.
As long as you have the project roles added and "Service Project Customer - Portal Access" added customers will be able to submit requests and comment on the ticket without seeing Internal comments.

[Jack Brickey]

I think this is JSM not JSW. Can you confirm? 

In JSM if the user has a license to access the application then they will see internal and public comments. The only way to hide internal comments from a user is if that user is a customer do you not have access to the application as an agent does. 

[Nicholas Torres]

Hi Jack, I am having this same issue with the same setup. I can confirm the customers having issues are only JSM customers and do not have a JSM license nor added via the agent center. The customer was able to add an internal comment via the JSM portal. I look forward to hearing from you.

Nicholas

[Jack Brickey]

If what you have conveyed is true then this would be a bug. Simply put Customers cannot make/see internal comments unless the also happen to have a Jira user license as well and further the are in a group/role that has browse and comment permissions on said project. 

I would love to see a screenshot of where a customer is making a comment and then another screenshot that shows it as an internal message. Ultimately if it is happening as you state then you need to reach out to Atlassian support directly to have them login and have a look.

[Nicholas Torres]

Thank you Jack, I am going to reach out to Atlassian to further investigate this.

[Jack Brickey]

Please share any results here.

[Sergei]

How did it all end?

[Omar Hutchens]

Was looking around to see if Atlassian has fixed the Browse Project Permission to view customer comments and not internal team comments, but it's still a problem. 

I found this if you guys want to follow too: 

https://jira.atlassian.com/browse/JSDCLOUD-3392

https://jira.atlassian.com/browse/JSDCLOUD-829

Hide internal notes from specific project roles. I'm all for this, because of the amount of times i get from team managers saying they want to see all their teams tickets in advance search and not able too unless they are added as participant. BUT if i get them browse project permission they can see internal notes. Big flaw, IMO. 

Hope this steers some of you to vote on this and get Atlassian to implement it!