Author Topic: ACLs & APIs (Read 5364 times)

Eileen · May 12, 2010, 09:01:31 pm

Hi,

I'm just looking at some code written by someone else to integrate with CiviCRM. It is using an API function to search contacts but the API isn't respecting ACLS (or multisite-ness) and doesn't look like it is supposed to.

Is there a search function that does? The AJAX contactlist function does but it relies on browser variables.

Eileen · May 12, 2010, 09:44:48 pm

NB - this is the piece of code calling the search & returned rows appears to be more than is permissioned

$params['rowCount'] = $maxRows;
$params['sort'] = 'sort_name ASC';
$params['return.sort_name'] = 1;
$params['sort_name'] = $_REQUEST['contact_name'];

$numrows = 0;
$num_called = 0;
$num_without_phone = 0;
$result = civicrm_contact_search( $params );

xavier · May 13, 2010, 09:45:32 am

What user are you using for the api call? The same as the end user that sees less contacts ?

Could you try using the ajax interface to test/debug when connected as a ACL limited user ?

http://en.flossmanuals.net/CiviCRM/DevelopAPI

Eileen · May 13, 2010, 02:17:01 pm

Ah, so let me get this clear. This bit of code is happening in a bunch of Drupal code so I suppose it may not be running under the rights of the logged on user? What would make it use the logged on user rights - only doing via the REST / AJAX api or can that be specified in the PHP code?

Eileen · May 13, 2010, 03:38:17 pm

OK, so talking to Lobo on IRC I believe that the module I have attached *should* return different results for my admin user (who finds hundreds of contact when she searches in civicrm) and my tester user (who only sees 2 contacts due to not have 'view all contacts' but having been given access (via CiviCRM ACL to view the members of one group)

However, when I install the module & hit the URL <sitename>/contactapisearch I see the same 25 contacts whether I am logged in as the user who can see lots of user in CiviCRM or as the user who can only see 2

Eileen · May 13, 2010, 03:39:23 pm

I should have mentioned - that chapter is great! I'm still finding time to read the updated manual

xavier · May 14, 2010, 04:05:19 am

What do you get when you ajax search as the non admin user ?
/civicrm/ajax/rest?fnName=civicrm/contact/search&json=1&sort_name=

(p.s you .module file is empty)

Eileen · May 14, 2010, 02:39:29 pm

Don't you hate that?

the .module said - wait for it ...

<?php

function fuzion_civi_test_menu() {
$items['contactapisearch'] = array(
'title' => 'My Voters',
'page callback' => 'fuzion_civi_test_contact_search',
'access arguments' => array('access content'),
'type' => MENU_CALLBACK,
'file' => 'civi_test.forms.inc',
);
return $items;

}

and civi_test.forms.inc

<?php

function fuzion_civi_test_contact_search(){
civicrm_initialize() ;
require_once 'api/v2/Contact.php';
echo "<pre>";
$params['sort'] = 'sort_name ASC';
$params['return.sort_name'] = 1;
$params['sort_name'] = '%';

$result = civicrm_contact_search( $params );

print_r($result);
die;
}

Eileen · May 14, 2010, 02:47:39 pm

Ok so I reattached the modules on the last post. The behaviour I am seeing is the same through AJAX and allows my test user to see contacts they otherwise can't (I'm hoping I'm doing something wrong - otherwise this would seem to be a bit of a major security issue)

I am testing on two sites one is 3.0.2 and the other is 3.1.4. The 3.0.2 version is pretty much out of the box whereas the 3.1.4 has multisite enabled and a few patches applied but the behaviour is the same on both

The test user has pretty broad permissions via drupals and perhaps this is where we are going wrong. They have all civicrm permissions via drupal except: view all contacts & edit all contacts (and in the multisite they don't have administer multisite).

The test user has been given permission to view 2 contacts through ACL and these are the only ones they can access through CiviCRM interface but if they hit the REST URL they seem to be able to view all users.

Donald Lobo · May 14, 2010, 05:36:22 pm

had an issue unzipping the module. you might need to reattach a clean copy to a new forum post

you might also want to check

CRM/Contact/BAO/Query.php, line 3129

and see how the search query is modified in the two cases with regard to the permissions and why

lobo

Eileen · May 14, 2010, 05:41:15 pm

aargh will re-zip.

However, the behaviour is the same using the AJAX interface - ie. my user who can see two users through the CiviCRM interface can see all users using the ajax URL posted by Xavier.:: /civicrm/ajax/rest?fnName=civicrm/contact/search&json=1&sort_name=%

Eileen · May 14, 2010, 05:44:29 pm

OK - re-attached the module but since it is the same as the ajax call it may be redundant now

xavier · May 15, 2010, 04:24:01 am

the api search is a wrapper around the apiQuery that looks like it's a wrapper around the BAO query. No idea why the ACL isn't applied.

Could you recreate on demo your group ACL configuration ? Seems that we will need someone from the core to help the investigation.

CRM/Contact/BAO/Query.php

Code: [Select]

    static function apiQuery( $params = null,
                              $returnProperties = null,
                              $fields = null,
                              $sort = null,
                              $offset = 0,
                              $row_count = 25,
                              $smartGroupCache = true )
    {
        $query = new CRM_Contact_BAO_Query( $params, $returnProperties,
                                             null, true, false, 1,
                                             false, true, $smartGroupCache );

Donald Lobo · May 15, 2010, 07:12:26 am

i checked apiQuery AND it does not apply permissioning

So basically civicrm_contact_search bypases all permissioning

i'm not sure why we did this, but if my guess would be we wrote apiQuery before we introduced ACL permissioning and hence the permissioning code never got in there

one potential option is to have a parameter within civicrm_contact_search which tells apiQuery whether to include or exclude permissioning. For backward compatbility we will skip permissioning

eileen: wanna write a patch for that?

thanx

xavier · May 15, 2010, 07:24:46 am

IMO, should be seen as a security vulnerability, not as a feature.

By introducing the ACL in the query, you don't break compatibility, you fix a bug. If you need to get access to all the contacts from your rest api (or any of the way of accessing the api), simply use a user that has the right permissions.

Eileen, if you find the time to see what is the performance cost of introducing the api, I'd be very interested to see the result.

X+

CiviCRM Community Forums (archive)

News:

Author Topic: ACLs & APIs (Read 5364 times)

Eileen

ACLs & APIs

Eileen

Re: ACLs & APIs

xavier

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

xavier

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

Donald Lobo

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

Eileen

Re: ACLs & APIs

xavier

Re: ACLs & APIs

Donald Lobo

Re: ACLs & APIs

xavier

Re: ACLs & APIs