Users can see secured projects when adding external dependency task

Products

• Clarity PPM On Premise
• Clarity PPM SaaS

Issue/Introduction

Users can see projects they do not have access to when creating an external dependent task if the user has Hierarchy - View - All access rights

Steps to Reproduce:

1. Create a Resource with the below instance rights for one project
2. Project - Task Management
   1. Project - View
   2. Project - Edit
   3. Project - View Tasks
3. Add Global access rights
   1. Hierarchy - View - All
   2. Project Management - Navigate
4. Log in or impersonate that user in the MUX
5. Go to Project grid view.  You will only see the one project
6. Open the project and go to tasks module
7. Go to Timeline view
8. Right click the task and select Add External Dependency

Expected Results: The user will not see any projects available in the drop down

Actual Results: The user can see all projects

This also happens with Custom Investments 

Environment

16.3.1+

Cause

DE178163

Resolution

Submitted to Sustaining Engineering for analysis