'Edit' link not shown in profile search results for user with correct rights

[DanilaD]

Hello.

I have the following setup: there are several groups of custom fields. There is a profile, which uses custom fields from two of the custom groups, and just one 'native' field - primary email.

All fields in the profile are 'Searchable' and 'In selector'. Only primary email is editable.

I have a user which does not need a full contact database access. I created an ACL role, a group for that role, and added user to that group. I created the following ACLs for this role:

Edit   Profile         MyProfile
Edit   Group           All Groups
Edit   Custom Group    CustGroup1
Edit   Custom Group    CustGroup2

Then I provide the user with appropriate link to the profile search page, like mysite.org/civicrm/profile?reset=1&gid=9.

User can perform search and see the results. However, only 'View' link is appearing in the search results page. By pressing this link, user gets to proper page, showing relevant contact data. However, 'Edit' link is not shown.

But if user edits the address line from ...profile/view?reset=1&id=123&gid=9 to ...profile/edit?reset=1&id=123&gid=9, the correct form with only one editable email field is shown. This means user can edit the fields, but cannot see the link to edit them in profile search results.

Workaround presented below.

[DanilaD]

I figured out that this happens because for this user, in CRM/Profile/Selector/Listings.php

at the following area:

Code: [Select]

        $mask = CRM_Core_Action::mask( CRM_Core_Permission::getPermission( ) );

        require_once 'CRM/Core/PseudoConstant.php';
        $locationTypes = CRM_Core_PseudoConstant::locationType( );

        $links =& self::links( $this->_map, $this->_editLink, $this->_linkToUF );
       
Variable $links gets only the 'view' link because $this->_editLink is equal to false despite the fact that variable $mask is equal to 65535, meaning 'user can view and edit this contact'.

I do not know what is the proper way for ACLs to work, but my workaround for this is simple: add the following code immediately before line require_once in the code above:

Code: [Select]

if ($mask==65535){
        $this->_editLink=true;
}

This gives me the desired behaviour - user can see and use the Edit link, users outside of the specified group cannot use this profile at all.

What would be the correct and right (ACL-style) way to deal with this?

Regards,
Danila

[Donald Lobo]

that is a bug and your fix seems right. I've patched the 2.2 code base

http://issues.civicrm.org/jira/browse/CRM-4341

lobo