ForecastMainPage: User without permission to edit Epics can update an Epic's forecast values

XMLWordPrintable

      Issue Summary

      User is able to update Epic forecast values from ForecastMainPage view even though their System Role disables editing Epics and hides the Forecast tab.

      Steps to Reproduce

      1. Add userA as a Portfolio Member for Epic1's parent portfolio.
      2. For userA's System Role, enable Portfolio > Manage > Epics, but disable all sub-toggles (Add,.... Forecast Tab...etc).
      3. Log in as userA, open Epic1 and note neither the Save button nor Forecast tab are available.
      4. Navigate to ForecastMainPage view and locate Epic1.
      5. Modify Epic1's Capacity Planning value and click the blue arrow to apply.
      6. Login as user with all Epic permissions. View Epic1's Forecast tab and note estimate has been updated.

      Expected Results

      UserA should not be able to update an Epic's Forecast values from ForecastMainPage when Role permissions prohibit them from editing / saving Epics.

      Actual Results

      UserA is able to update an Epic's Forecast values from the ForecastMainPage despite lacking the permission to Save epics.

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

        1. image-2021-11-11-17-06-22-549.png
          42 kB
          Brandon Harris
        2. image-2021-11-11-17-11-51-208.png
          27 kB
          Brandon Harris
        3. image-2021-11-11-17-15-35-243.png
          36 kB
          Brandon Harris
        4. image-2021-11-11-17-20-46-791.png
          20 kB
          Brandon Harris
        5. image-2021-11-11-17-21-15-697.png
          42 kB
          Brandon Harris
        6. image-2021-11-11-17-25-04-137.png
          39 kB
          Brandon Harris

              Assignee:
              Bhanu Vanjaku
              Reporter:
              Brandon Harris (Inactive)
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: