CiviCRM Community Forums (archive)

I may have a misconfiguration error otherwise this is a security concern.

When granting CiviCRM access to an ACL user, they get default access to two menu items.

New Activity
New Email

While they cannot search the database for contacts through the main search, when I go to either of these settings, the autofill queries the whole database, and for instance, if I type in "d", it starts showing them all users and emails (as I have alot of email only contacts) that contain that letter.  While the user records are secure, even exposing emails or who is in our database is of a concern.  (We are using ACL with Domain to host more than one group.)

Again, maybe I have turned on a wrong setting.  But everything else works okay.

PS. moved from the wrong forum..

Thanks DL! 

For now I've deleted those items from the civicrm menu and will keep my access permissions limited.  We've got about 20K contacts, so I'll check in the roadmap for 3.1 and try to check on this or beta when I've got a chance to set up my sandbox.

Otherwise 3.0s been a charm. 

- Dan