Why do users with the Contributor role have access to everything in JPD?

[Jarmo Valli]

We purchased a Premium license for our organization to give different parties access to a few views and the ability to comment, vote, and add ideas.

However, the Contributor role allows users to edit view filters (for themselves), so by removing filters, users with the Contributor role can see all items in our JPD environment.

1. Is this a bug or a feature?
2. If it is a feature, how do you plan to address the issue above, which I believe is a very generic need?

@Tanguy Crusson, have you recognized this issue?

[Tanguy Crusson · Accepted solution]

@Jarmo Valli here's how it works today and how we're planning to change it:

• You give access to a user for a space. If you add someone to a space they have access to all ideas within that space
• You can then restrict which views users in a space can view and edit. But this permission is for the view object, not the ideas in the space that show in that view. And people with read-only access to a view can currently adjust filters on a view, just for themselves - but not save their changes for everyone else (for that they need to be able to to edit the view).

That being said, we've gotten the same feedback you just sent a few times, and to be honest it makes complete sense. So what we're planning to do is: 

• If you do not have the permission to edit a view (via view restrictions), then we'll assume that you cannot edit existing filters (remove existing filters) - instead you'll just be able to add new filters on top of the existing filter configuration (to filter the ideas further).
• That means you won't be able to view more ideas than what was intended to be in the view

Does that make sense?

[Jarmo Valli]

Thank you for your quick reply!

It makes sense that users other than admins can add filters to views in addition to the view filters, but cannot remove filters added by the admin.
(Without this restriction, view-specific access rights would be meaningless – i.e., in the current situation.)

Another critical point is that even if a user does not have the right to remove view-specific filters or edit tasks, that user group should still be able to add, comment on, and vote on tasks in that specific view (=Contributor).

Those are currently the only blockers preventing us from using the Contributor role and thus taking full advantage of JPD.

[Tanguy Crusson]

Gotcha - we'll let you know when this ships! I just chatted with the team and it's not a big change. We'll prioritise it. 

[Jarmo Valli]

That's great news! Thanks!