CiviCRM Community Forums (archive)

I've just upgraded to CiviCRM 3.4.1.  I am wondering if that's what caused what I'm describing here.

If you refer to

Re: Trying to print CiviCRM_Address fields for Contact Refernce Via a NODE
(http://forum.civicrm.org/index.php/topic,19637.msg81734.html#msg81734)

You will see that at one point I found a solution for printing CiviCRM fields in a content node by adding php to the content template that reference api.php the civicrm_api() "get" function.

I got this working for anonymous users WITHOUT giving them access to "View ALL contacts" in Drupal Permissions by creating a "Public Sports Data" group and then adding sports contacts to it (coaches and facilities).

Two things definitely are working:

1.  the fields print in the content node when logged in as anyone with "view all contacts" privileges - but this was not necessary before today.
2.  the ACL rules in CiviCRM are WORKING when an anonymous user accesses the CiviCRM contact page directly:

      *  e.g. http://soncnv.webfactional.com/civicrm/contact/view?reset=1&cid=4

They cannot see all contacts, but CAN see the Contacts in the Public Sports Data Group.  So on the CiviCRM side, the ACL and group are set up and connected properly.

So specifically, it seems that - maybe- the api has changed and no longer provides information using ACL rules but only Drupal permissions?  Which, I'm pretty sure was not the case in 3.3.6.

Since an Admin user always sees the CiviCRM data perfectly, and so does any user were I set "see all contacts", it's definitely an issue of Drupal Permissions now overriding the CiviCRM ACL, but ONLY within a a content node, or template, or php.

I've cleared EVERY cache- site cache, views cache.

What I NEED to do is to show contact data in a Drupal node because I don't want anonymous users to go to /civicrm/contact/view?reset=1 because those screens expose WAY too much data that we don't need site visitors to see.

** ANY HELP APPRECIATED GREATLY.

If you want the full code for reference, please see:
http://forum.civicrm.org/index.php/topic,19637.msg81734.html#msg81734

THANKS!  Merci Beaucoup.

I was just going to mention the same....but Eileen beat me to it :-)

ie. add it as a field on the array you pass into the api call

It's under active discussion!

However, if we change it back (next week for example) & only make the new permissioning apply to REST it won't break again

Hi,

We came to the conclusion that having to add 'check_permissions' => false to all the php calls wasn't useful, and reverted to the previous behaviour (don't check the permission in the php code).

http://civicrm.org/API_permission

Please comment and join the discussion.

I'm trying to commit a fix today, but will have to travel soon. Someone in the A Team will come.

X+