Is there an option to hide form field for some users?

[Tomasz Karliński]

I am creating a new employee registration form that must be completed by the manager.

1. the manager fills in the form
2. a request is created
3. the request is shared to few users

The manager must provide all information, such as name, address, AND salary...

However, there is a problem because as i said - after the form is submitted, it is shared with some users – few of them can see the salary, while others cannot.

I have an idea to create a second task (accessible only to authorised persons) alongside the main task (they are linked) - and in this second task in comment leader will place salary - but I am not sure if this is too complicated :P

Is there any option to hide this form field for some users? Or is there any other way to get around this problem?

[Tomislav Tobijas]

Hi @Tomasz Karliński ,

As Mateo mentioned, you could use security levels. Additionally, and specifically related to forms, you could use forms restrictions. But, this wouldn't restrict Jira fields (as displayed in the notice at the bottom of the article).

There are a couple of feature suggestions that might be relevant to your requirement:

• JRACLOUD-69298: Allow fields to be hidden/edited when certain group or users views a ticket i.e field-level security 
• JSDCLOUD-11470: Form security: Show/hide JSM Forms based on the User/Group/Organisation/Domain (not that related, but could be a helpful thing to have as well)

But yeah, mainly people use Marketplace solutions to achieve field-level security.

Cheers,
Tobi

[Matteo Vecchiato]

Hi @Tomasz Karliński ,

Thank you for your question. 

Out-of-the-box is not possible to hide a field depending on user / user roles in a single work item.

The way to create a linked work item, with a specific work type, could work; using the security schema levels you can restrict the access of that kind of work item to selected users.

An alternative way is using Scriptrunner Behaviours from marketplace: https://docs.adaptavist.com/sr4jc/latest/features/behaviours 

Hope it helps.

Regards

[Marc - Devoteam]

Hi @Matteo Vecchiato 

Behaviours can do this, but they don't work from portal side. They only work when an issue is created from then backend by an agent.

[Matteo Vecchiato]

Yes @Marc - Devoteam , I confirm it. Despite of hiding the salary field in the agent view, it remain visible from the portal view and all the agent with access could see it.

As you mentioned in your reply, probably it is better to separate completely the employee data from the sensitive data.

[Marc - Devoteam]

Hi @Tomasz Karliński 

For me personal it would be the question, why aks/store salary?

Isn't this GDPR information only for the employee/manager and HR?

I would not store this in Jira.

As a solution you could create a linked task where issue security is set or create a different project where this task lives and issue security is set.

Then you can even have issue security and project related permissions to prevent unauthorised people to get access. You could even base the permission scheme of the project on groups and not on roles, to even tighten security.

But I still wonder why store this personal GDPR related info in Jira?