Author Topic: I removed contact from group, can't rejoin him without "edit all contacts" perm (Read 757 times)

TwoMice · July 14, 2010, 02:26:15 pm

This behavior on 3.1.3 for Drupal:

Unless a user has the "edit all contacts" permission, he cannot re-add a contact to a group after removing them from the group.

Well, to be more specific, he can't do it under the Groups tab on on the Contact summary page, because of two things:

display of removed group members is blocked without this permission, and
the select-list of available groups doesn't display a group that the contact has been removed from.

A user in this situation actually can do it if he opens the group page itself, and then searches for contacts to add to the group. This is pretty tedious, and it's strange for the user to find that he can't do it "over here" but he can do it "over there," while the reason for the distinction is unclear.

I'm not sure if there's a good reason to hide "removed" group membership records from one user and not from another, if both users have access to edit that contact. As it is, if you and I can both edit this contact, and you have "edit all contacts" and I don't, then you can see this history, and I can't.

However, if there is a good reason for that, then we could at least make those groups available again in the select-list of groups to be joined. As it is, once a contact is a member of the group, that group is forever removed from the select list, even after the contact is removed from the group.

I'm lobbying to do away with this use of the "edit all contacts" permission.

Any thoughts?

Thanks,
Allen

P.S. I can't think of a way to test this on sandbox demo, but from the looks of the code this is still the case in the 3.2 branch.

TwoMice · July 24, 2010, 08:51:32 am

Update: This is behavior is confirmed in 3.2 beta 5.

I hopped on #civicrm and cgg was kind enough to hash this out with me. We found a reason why this behavior may go unnoticed:

Normally, users can't add contacts to groups unless they have either the Drupal permission "edit all contacts", OR an ACL setup that gives them the "edit" action for "all groups". If you want users to be able to add contacts to groups, and you accomplish that with the "edit all contacts" permission, this issue doesn't come up. But if you accomplish it with ACLs, it does come up.

We're using the ACL method because we rely on hook_civicrm_aclWhereClause and hook_civicrm_aclGroup. So we can't use "edit all contacts" permission, which causes these hooks to be skipped over. In that situation, this issue comes up.

In any case, we agreed that this behavior is odd and inconsistent and could rightly be called a bug, and that it doesn't really make sense to hide past groups based on this permission. I'm thinking we should just stop requiring "edit all contacts" permission to see "Past groups" group history. The attached patch does that by simply removing the requirement for "status = 'Added'" from the where clause that queries for these rows.

Thanks,
Allen

CiviCRM Community Forums (archive)

News:

Author Topic: I removed contact from group, can't rejoin him without "edit all contacts" perm (Read 757 times)

TwoMice

I removed contact from group, can't rejoin him without "edit all contacts" perm

TwoMice

Re: I removed contact from group, can't rejoin him without "edit all contacts" perm