Why do users with the Contributor role have access to everything in JPD?

[Jarmo Valli]

We purchased a Premium license for our organization to give different parties access to a few views and the ability to comment, vote, and add ideas.

However, the Contributor role allows users to edit view filters (for themselves), so by removing filters, users with the Contributor role can see all items in our JPD environment.

1. Is this a bug or a feature?
2. If it is a feature, how do you plan to address the issue above, which I believe is a very generic need?

@Tanguy Crusson, have you recognized this issue?

[Tanguy Crusson · Accepted solution]

@Jarmo Valli here's how it works today and how we're planning to change it:

• You give access to a user for a space. If you add someone to a space they have access to all ideas within that space
• You can then restrict which views users in a space can view and edit. But this permission is for the view object, not the ideas in the space that show in that view. And people with read-only access to a view can currently adjust filters on a view, just for themselves - but not save their changes for everyone else (for that they need to be able to to edit the view).

That being said, we've gotten the same feedback you just sent a few times, and to be honest it makes complete sense. So what we're planning to do is: 

• If you do not have the permission to edit a view (via view restrictions), then we'll assume that you cannot edit existing filters (remove existing filters) - instead you'll just be able to add new filters on top of the existing filter configuration (to filter the ideas further).
• That means you won't be able to view more ideas than what was intended to be in the view

Does that make sense?

[Jarmo Valli]

Thank you for your quick reply!

It makes sense that users other than admins can add filters to views in addition to the view filters, but cannot remove filters added by the admin.
(Without this restriction, view-specific access rights would be meaningless – i.e., in the current situation.)

Another critical point is that even if a user does not have the right to remove view-specific filters or edit tasks, that user group should still be able to add, comment on, and vote on tasks in that specific view (=Contributor).

Those are currently the only blockers preventing us from using the Contributor role and thus taking full advantage of JPD.

[Tanguy Crusson]

Gotcha - we'll let you know when this ships! I just chatted with the team and it's not a big change. We'll prioritise it. 

[Jarmo Valli]

That's great news! Thanks!

[Tanguy Crusson]

Update: the team started working on it this week!

[Jarmo Valli]

Thank you very much for the information! I look forward to trying this out.

[Jarmo Valli]

Hi! Any updates on this?

[Tanguy Crusson]

The rollout is going to start very soon - expect an article from @Olga Springer with the details

[Olga Springer]

Hello @Jarmo Valli 

This change should already be available on your site. Please verify it in your instance and let me know if it solves your needs!

What changed:

Base filters on views are now locked for contributors, which means:

• Contributors will clearly see which filters are locked and won’t be able to change or remove them.

• They’ll still be able to add extra filters for their own temporary use, but those will reset when the view is refreshed.

More details:
📣 Coming Soon: Enhanced view restrictions with Locked Filters for Contributors

Best,

Olga Springer

[Jarmo Valli]

Hi @Olga Springer & @Tanguy Crusson 

The solution you have implemented does not solve the problem itself, because users with the Contributor role can still see ALL tasks in the space through the Filters views.

Furthermore, your solution does not lock the filter for the "Type" field.

At the same time, I noticed that copying a view is also a dangerous operation, because it does not copy the view lock; instead, when copied, the restricted view becomes public to all users of the space.

[Jarmo Valli]

In addition to the above, is there another way for a user with the contributor role to see ALL issues in Space?

[Tanguy Crusson]

Hi @Jarmo Valli , what do you mean by "the Contributor role can still see ALL tasks in the space through the Filters views"?

The way this feature works: 

• You create a view, you configure it. As part of that you define the filter. 
• Contributors can open that view and can see the ideas based on that filter
• they can only add more filters (not change the existing ones)

So to restrict access to data you'd need to do 2 things:

1. Configure the views you want to share with them
2. Use view restrictions (lock icon top right of the view) to decide which views they can open

What are you seeing for the "Type" field? this is what I see: