Feature #44581
closed
Make project members page available to all users who can see the Members box on the overview page
Description
Currently, project members are displayed in two distinct places:
- On the Overview page in the Members box, where only active members are listed grouped by role for any user who can view the project.
- In the Members tab under project Settings, which is only accessible to users with the Manage members permission.
Users who do not have permission to manage members cannot view the full, paginated, or searchable list of project members (#43355, #44458).
The attached patch introduces a project members page (/projects/:id/members) available to all users with the View members (:view_members) permission, unifying it with the settings members tab while maintaining appropriate permission boundaries:
- A "View all members" link is added at the bottom of the Members box on the project overview page (visible to users with the
:view_memberspermission). - When accessed via this link (or directly via
/projects/:id/members), the members list is rendered under the Overview project menu tab. - Filtering (by principal name and role) and pagination work seamlessly across both views.
- Users without the
:manage_memberspermission are restricted to viewing active members only (matching the overview box and preserving consistency with user visibility rules), and administrative action buttons (add, edit, remove) as well as CSV export remain hidden and restricted.
Files
Related issues
Updated by Marius BĂLTEANU 23 days ago
- Subject changed from Make project members page available to all users with the *View members* permission to Make project members page available to all users with the "View members" permission
Updated by Marius BĂLTEANU 23 days ago
- File deleted (
0001-Make-project-members-page-available-to-all-users-wit.patch)
Updated by Marius BĂLTEANU 23 days ago
- File Screenshot 2026-10-07 at 23.09.46.png Screenshot 2026-10-07 at 23.09.46.png added
- File Screenshot 2026-10-07 at 23.20.40.png Screenshot 2026-10-07 at 23.20.40.png added
- File Screenshot 2026-10-07 at 23.22.18.png Screenshot 2026-10-07 at 23.22.18.png added
Screenshots:
1. Members box with the "View all members" link:
2. Unified members page for user with permission to manage members:
3. Unified members page for user without permission to manage members:
Updated by Marius BĂLTEANU 23 days ago
- Related to Defect #44350: Project overview page is slow when the members box contains many members added
Updated by Go MAEDA 20 days ago
Marius BĂLTEANU wrote:
- A "View all members" link is added at the bottom of the Members box on the project overview page (visible to users with the
:view_memberspermission).
Since view_members is a public permission that is granted to every role, I think the new "View all members" link and the /projects/:id/members page will be available to every user who can view the project overview page, including anonymous users on public projects. Is this the intended behavior?
Updated by Marius BĂLTEANU 19 days ago
Go MAEDA wrote in #note-6:
Yes, it is. The reason is that it follows the exact same logic and visibility as the members box on the project overview page:Marius BĂLTEANU wrote:
- A "View all members" link is added at the bottom of the Members box on the project overview page (visible to users with the
:view_memberspermission).Since
view_membersis a public permission that is granted to every role, I think the new "View all members" link and the/projects/:id/memberspage will be available to every user who can view the project overview page, including anonymous users on public projects. Is this the intended behavior?
- The page displays the exact same information already accessible on the overview page (only active members).
- Users without the "Manage members" permission (including anonymous users) cannot view locked members, filter by status, export to CSV, or perform any administrative actions.
Therefore, this new page introduces no privacy or security concerns beyond what is already visible on the project overview.
Do you see any potential concerns with this approach?
Updated by Go MAEDA 19 days ago
Marius BĂLTEANU wrote in #note-7:
Do you see any potential concerns with this approach?
Thank you for the clarification. I now understand your intention, and I have no concerns about the visibility itself, since the new page shows only the information that is already available in the Members box on the project overview page.
However, I think the current subject may be misleading for people who are not familiar with the internals of Redmine. Because "View members" is a public permission and does not appear in the role settings, the phrase 'all users with the "View members" permission' may give the impression that administrators can control who sees the page through the permission settings.
How about changing the subject to something like the following?
"Make project members page available to all users who can see the Members box on the overview page"
Updated by Marius BĂLTEANU 19 days ago
- Subject changed from Make project members page available to all users with the "View members" permission to Make project members page available to all users who can see the Members box on the overview page
Your point is very valid, thanks! I've updated the subject accordingly.
Updated by Marius BĂLTEANU 18 days ago
- Status changed from New to Resolved
- Resolution set to Fixed
Feature implemented.