I cannot reproduce on vanilla Redmine version:3.1.6.
I think this is fixed by #20206.
--------------------------------------------------------------------------------
I can reproduce it on 3.2-stable (the Affected version is set to 3.1.3 since this is the latest version available in the custom field). The actual issue was found on a Redmine 3.2.1.

#20206 fixes a related issue for the default non-member role. Now with a custom non-member role, the problem is back. It is however important to strictly reproduce the setup described by Alexander: you need the default non-member role to have the Issue visibility set to all. You also need a *different* role with restricted issue visibility assigned as non-member role for the specific project.

The result is that @Project.allowed_to_condition@ first considers the default non-member role and adds statements since the default role has the permission to view all issues. However, the custom role has not. Now the bug is that @Project.allowed_to_condition@ does not consider custom default-roles in this first step. They are only considered later in @User#projects_by_role@.

I think a quick patch could look like this (mostly untested):

<pre>
diff --git a/app/models/project.rb b/app/models/project.rb
index 197f45e..9f177ee 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -197,7 +197,7 @@ class Project < ActiveRecord::Base
if role.allowed_to?(permission)
s = "#{Project.table_name}.is_public = #{connection.quoted_true}"
if user.id
- s = "(#{s} AND #{Project.table_name}.id NOT IN (SELECT project_id FROM #{Member.table_name} WHERE user_id = #{user.id}))"
+ s = "(#{s} AND #{Project.table_name}.id NOT IN (SELECT project_id FROM #{Member.table_name} LEFT OUTER JOIN #{Principal.table_name} ON #{Member.table_name}.user_id = #{Principal.table_name}.id WHERE #{Member.table_name}.user_id = #{user.id} OR #{Principal.table_name}.type IN ('GroupAnonymous', 'GroupNonMember')))"
end
statement_by_role[role] = s
end
</pre>

--------------------------------------------------------------------------------
I still cannot reproduce on 3.2-stable.
I cannot understand "You also need a different role with restricted issue visibility assigned as non-member role for the specific project."

!role.png!

!project-setting.png!
--------------------------------------------------------------------------------
@Toshi: The role (test02 in your case) needs to be assigned to the project for Non member users, that is, you don't assign the role to an actual user but you set it a custom non-member role for the project. The user can not be an explicit member of the project. This feature to set a custom non-member role was added in #17976.

The settings screen should thus look like this:

!desired_member_settings.png!
--------------------------------------------------------------------------------
I got it.
--------------------------------------------------------------------------------
Fixed in r15750, thanks for pointing this out.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
It seems as if the problem is back:
I added the group "Nicht-Mitglieder" (which is the translated version of "Non member users") in a role called "TicketViewer" to some of our projects and authenticated (so not anonymous) users are not able to view the issues in the project.

<pre>
Informationen

Redmine 3.3.4.stable.16947
</pre>

I add screenshots of the added role in an example project and the roles configuration.
Maybe i made a error on setting it up.

Is there any other way to ensure a group (and it should be a dynamically changing group of authenticated users - e.g. employees which don't belong to the project as reporters, developers or any other set of roles/functions within the project), let's call them authenticated non-members,
* authenticated non-members are able to view tickets
* authenticated non-members are not able to view any other module
* authenticated non-members are enabled to add themselves to the watchlist
* authenticated non-members won't receive any news or forum notifications

Any advice, tipps, workarounds?

Thanks in advance,

JT
--------------------------------------------------------------------------------