How to force login to view Jira filters and dashboards pages
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
Even though Jira administrators can restrict filters and dashboards to internal usage only, as seen in the article "How to bulk restrict Filters and Dashboards shared with anyone on the web or logged-in users in Jira", especially in instances with legacy data back from Jira 7.2.1 or earlier, dashboards and filter pages can still be shown with some content. You can check your instance through the URLs:
<jira-url>/secure/ManageFilters.jspa
<jira-url>/secure/ConfigurePortalPages.jspa
Solution
If you have "Shared with anyone on the web" permission dashboards or filters, we recommend applying the fix pointed in the mentioned article. However, you shall also force Jira to request users to login to Jira to access those pages. To do so, please:
Stop Jira.
In each node go to <Jira app directory>/atlassian-jira/WEB-INF/classes, backup, and then edit the actions.xml
In the action.xml look for the actions filter.ManageFilters and ConfigurePortalPages and add the roles-required="use", as the example below:
To restrict the /secure/ManageFilters.jspa
1<action name="filter.ManageFilters" alias="ManageFilters" roles-required="use">To restrict the /secure/ConfigurePortalPages.jspa
1<action name="user.ConfigurePortalPages" alias="ConfigurePortalPages" roles-required="use">Restart Jira.
Please note this is a customization on your Jira instance; in upgrades, you need to repeat the steps in all nodes.
Was this helpful?