# Bug OP-14257 - Users can enter any work package id when setting a work package's parent

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-14257

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 13.3.0 |
| Observed in versions | 13.2.0 |
| Sprint | 13.3.0 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 13.2.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Create work package P in project A
2.  Create project B
3.  Add user U to project B but not to project A
4.  As user U, create work package C in project B, with a start and end date
5.  As user U, update work package C's parent, manually entering the ID of work package P from the other project

### What is the buggy behavior?

  - a journal is created both for work packages C and P
  - P's start and due dates are set to those of C

### What is the expected behavior?

  - the user should not be able to even select P's ID as a parent
  - most importantly, P should not be updated in any way

### Environment information

**OpenProject installation type**

- [x] Hosted cloud edition
- [ ] Packaged installation
    - What distribution?
- [ ] Docker All-in-one container
- [ ] Docker-compose installation
- [ ] Other (please specify)

**OpenProject version**

*v13.2.0*