Project permissions are ignored in the "Create issue" mask?

[Maureen Putz]

Hi!

I went through a lot of the support articles and community questions but coudln't find anything regarding my problem.

We have noticed that when we create an issue we are able to assign it to colleagues who don't have that permission in certain projects. However when we try to assign them an already created issue it's not possible (as it should be).

For example. We have the Project "Projects" (creative, I know) for new Project Requests. Alina does not have the permissions to be assignee of any issues in this project. If I try to assign one to her, it's not possible to choose her name form the dropdown menu.

However, when I create a new issue and choose "Projects" I can create an issue with her as assignee, even though she doesn't have the permissons.

Is this a bug or did we miss something in our permisson settings?

Thanks,

Maureen

[Joe Pitt]

When you want to assign an existing issue are you doing it with the assign button or editing the assignee field in edit or on a transition? 

Could anyone before you have modified the code? 

[Maureen Putz]

Hi!

I've tried both, it's the same either way. It's only in the "create issue" mask that they can be assigned tickets in these restricted projects.

According to my boss it's not possible anyone modified the code.

[Nic Brough -Adaptavist-]

My guess is that you're not quite looking at the right thing in your first screenshot.  Can you expand the list of users with the drop-down instead of typing the names in?  Is Alina on the fulll list?

[Maureen Putz]

Hi!

Nope, she isn't. We have tested it with a few users who don't have permissions in this project.

If it's an already existing issue it's not possible to assign them the issue. They also can't view or comment on issues in this project, all as it should be.

It's just in the "Create Issue" mask that we are able to add them as assignee.

Thanks,

Maureen

[Nic Brough -Adaptavist-]

Ok, two things to check next:

What exactly does the project's permission scheme say for "assignable user"?

Could you go into the workflow, find the "in progress" step, and look at its properties?  (Might be easier to find in the "text" mode of the workflow editor)

[Maureen Putz]

Hi,

the project's permission scheme for "assignable user" says that users with permissions in project roles 1 through 4 can be assigned issues. I checked permissions of the example user Alina and she definitely does not have permissions in this project.

It's not specific to the project "Projects" either. We have a few other projects with strict permissions and it's the same with these too. In the "create issue" mask it's possible to assign any user irregardles of the permissons they have or don't have, in this case.

I checked the workflow for "Projects". The step "in progress" currently has no defined properties.

Thanks,

Maureen

[Joe Pitt]

Can she create issues? Maybe there is a bug that allows users that can create to be assignable. 

[Maureen Putz]

Hi!

No she doesn't have permission to create issues in this project either. She can't even choose this project from the dropdown menu when creating an issue.

[Nic Brough -Adaptavist-]

Can you tell us what roles and groups Alina is in?

And exactly what the "assignable user" rule is in the permission scheme?

[Maureen Putz]

Hi,

I've checked with my boss and unfortunately I can't tell you the specific group names. But I have checked several times and Alina is not in any of the groups or roles that have permissions in "Projects". Plus, as I said, she is just an example. It's the same in other restricted projects and with other users who don't have permissions in this projects.

The "assignable user" in the permission scheme says the following:

Users with this permission may be assinged to issues:

Project Role (0_Administrators)
Project Role (1_Project Managers)
Project Role (2_Project Members)
Project Role (3_Restricted Members)
Project Role (4_ Exernal Members)
Reporters
Project Role (2_Developers)

[Nic Brough -Adaptavist-]

Ah, thought so.

Try removing "reporters".