Users can see projects they do not have access to when creating an external dependent task if the user has Hierarchy - View - All access rights
Steps to Reproduce:
- Create a Resource with the below instance rights for one project
- Project - Task Management
- Project - View
- Project - Edit
- Project - View Tasks
- Add Global access rights
- Hierarchy - View - All
- Project Management - Navigate
- Log in or impersonate that user in the MUX
- Go to Project grid view. You will only see the one project
- Open the project and go to tasks module
- Go to Timeline view
- Right click the task and select Add External Dependency
Expected Results: The user will not see any projects available in the drop down
Actual Results: The user can see all projects
This also happens with Custom Investments