CiviCRM Community Forums (archive)

We restrict who can import data, but we don't restrict who can output data or how much.  Here are 3 areas:

1) Export
2) Send email to contacts
3) Print

I'm not sure what is really needed here, but there are people that have general access to CiviCRM, that I don't want to easily print off, export all or send email to all contacts (when don't have civimail access).   Some contacts might be fine, but maybe not all.

Also, while not a security concern, step 4 of CiviMail that has send test to group, does very bad things when the user picks the group for all contacts for the test.  We modified version 1.9 to hide the send test to groups option (which we never use) and two separate people decided they would send the test to the group that was the whole database (step 4 test, not the civimailing itself).

RE: sending 'test' to entire DB - how about keep the 'Send Test to Groups' visible and making sure you have a WELL MARKED group for test mailings (with a group name that sorts it to the TOP of the list :-) ). Just an idea ...

Probably depends on the individual situations.  In our case, we only used send to group by mistake and I'm not sure how we did it, but it was not hard to comment out the option on the page in version 1.9.