Custom fields can be edited (and deleted!) by users outside a project

Briefly describe (1-2 sentences) the Bug you’re experiencing:

I have a custom field on Project A, that is not in the library, nor on Project B. However, if I move the task to Project B, I can see the field’s name grayed out – which is fine, but also shows an X to delete the field and its value which is a big problem.

Steps to reproduce:

  1. Create a custom field of any data type in Project A.
  2. Create a task within Project A and set the custom field value
  3. Move the task to Project B (removing it from Project A, not multi-homed)
  4. Open the task and look at custom fields
  5. Hover over the grayed-out custom field’s value, and click the X
  6. Move the task back to Project A (again, removing it from Project B)
  7. Open the task, and the value will be gone

Browser version:

  • Chrome Version 106.0.5249.119 (Official Build) (64-bit)
  • Desktop app

Upload screenshots below:
image

2 Likes

This is likely not seen as a bug by Asana.

With Business or Enterprise plans, you can lock custom fields:

There’s more info in the Permissions section too, FWIW.

Hope that helps,

Larry

Thanks for the info @lpb , I’ve seen the locking option, but that doesn’t lock the values from being changed. The info you linked talks about locking the field settings (name/type), not its values within a task.

The issue I’m having is that a custom field’s value is being deleted by a user that is not even part of the project where that custom field exists.

Right, @Jorge-wms, I think the Permissions section of the doc that I mentioned, or other parts, explains that

I don’t think it’s relevant about the project where the custom field exists. Once a task has a custom field, anyone with access to the task has access to its custom fields. That makes sense to me because the alternative that bits of pieces of the task have different access rights would be highly confusing for users (and developers!).

Larry

Larry is 100% correct here. It seems a little bit odd behavior in some circumstances, but it’s not a bug, it’s the way Asana works.

@Marie explained it here a while back:

1 Like

Thanks @Phil_Seeman and @lpb
It made sense once I saw it with the explanation of “any data that’s part of the task is visible to users who can see the task”. That changes some of our plans, but managed to work around it by having a parent project that houses those tasks. Not great, but being a concern since 2019 I don’t see it improving anytime soon.

2 Likes