Bug in permissions

[Jandieg]

This field is not from a project the user has permissions. Yet he can remove that field!

Steps to reproduce:

1. Create Project A, add Field A
2. Create Project B, add Field B
3. Create task add the 2 projects
4. Give permissions to User A to Project A
5. User A is able to remove value from Field B in the task

Browser version: Chrome latest

[Marie]

Hi @Jandieg and thanks for the report! Could you please reach out to our support team with the following info?

1. Email of your colleague (User A in your example)
2. URL of the task you shared the screenshot from
3. URL of the project this task belongs to
4. URL of this thread (so you don’t have to re-explain everything)

Investigating this issue involves a lot of private information that can’t be shared in a public Forum, so our support team will be in a better position to help!
Marking this thread resolved from the Forum end, but if you have a chance keep us posted once you found the solution to this problem

[Juan_Diego]

No need for sharing private info. I provided the repro steps, so that any QA engineer can reproduce on their end. Let me know if after that you still need my data.

I also sent an email to asana support.

[lpb]

@Marie, @Jandieg, @Juan_Diego,

I believe this is the expected behavior, not a bug.

For an explanation, see:

Prevent users to edit Custom Fields nested in Projects they don't have access to (multi-homed Tasks)

Thank you all for your patience! I’ve worked closely with our support and dev team to investigate this behavior and I can confirm this is not a bug or the result of a recent change; this is in fact how custom fields in multi-homed tasks have behaved since their original launch; but let me give you more context to understand why this is happening: In our guide article dedicated to custom fields, we mention that “Anyone with access to a task can modify the values of its custom fields.” This is b…

For workarounds, see:

Prevent users to edit Custom Fields nested in Projects they don't have access to (multi-homed Tasks)

Custom field values, like anything else in the task, is visible if the task is visible. I too wish there was a way to have some task information project-related and visible only if you have visibility into that project, but nothing like that exists. They are hacks but two workarounds exist: One would be to add a link to a task in a private (to some) project as I mentioned here: That link will appear as Private Link to those w/o access. For the rest, it could contain the set of “private” cu…

Perhaps this thread should either be merged, or re-created as a product feedback votable request?

Thanks,

Larry

[Juan_Diego]

For vote. Because same task (usually in workflows) it goes through different departments, each has it’s relevant fields. And precisely different projects are created to keep things separate, and enforcing users to only edit what they are authorized to.

[Natalia]

Happy Monday everybody!

I’ve gone ahead and moved the thread mentioned by Larry to the #productfeedback category

@Issue with custom fields permissions Tips and Tricks

Thank you all for your patience! I’ve worked closely with our support and dev team to investigate this behavior and I can confirm this is not a bug or the result of a recent change; this is in fact how custom fields in multi-homed tasks have behaved since their original launch.

Feel free to cast your vote! Have a great day!