@mentioned issue across teams with guest users

[anon17036750]

Hello,

Here’s the setup:
-We have set up a few teams to share projects with external clients.
-There is one team for each client.
-Our internal staff is a member of the team therefore able to see all of the projects for that client.
-Our external clients are set up as Guests who are only invited to the projects within their team that they are working on.

The problem:
When an external client (ie, guest user) @mentions in the comment section of a task, they get a list of all possible users they can direct the mention to. This seems like a serious oversight as they are able to see guest users from other teams (ie. our other clients) where they have no access. In our case, guest clients are able to see their competitors and in most cases their email addresses.

I can not find any way to prevent this from happening so I’m hoping someone can point me in the right direction.

I want our guest users to be able to comment on tasks in projects they are given access to and I want them to have the ability to direct @mentions to our internal team and their own team members but do not want to see who all of the guest users are.

Thanks all!

Ken

[Andrea_Mayer]

Hey @anon17036750

and the clients are really not added to the team directly? Only to the private project with comment only?

I think this should answer your question:

@Charlie_Pilch

I’ve tested it a little. What I’ve establish:

• member of Organisation can view and search for all guests
• guest can view and search other guest only if they are “connected” (added to) the same project
• guest who isn’t “connected” with other guest is displayed as “private user” for him (and can’t be found)

Here is a nice overview from Bastien as well about who can see who: Who sees whom, a guide to guest visibility with Batman & Robin

And here is a thread you might want to upvote: Assignee field should only show members of a project or team

[anon17036750]

@Andrea_Mayer - correct, the clients are not added to the team directly and are individually added to each project with comment only.

My original problem was breaking the rule in the third bullet point from above but since posting discovered that my test user was actually included on a project in the other team therefore was able to see the other guests. After removing the test user from that team, everything is not behaving as expected.

Thanks for the response!

[Phil_Seeman]

@anon17036750

everything is not behaving as expected.

Just to make sure, you meant “now behaving as expected”, right?

[anon17036750]

Ha, yes “now”. Thanks for checking