CiviCRM Community Forums (archive)

The menu rebuild will only work if a user has 'administer CiviCRM' permission.   Perhaps this is to close some kind of security hole I am unaware of.  But if it is possible to open up the menu rebuild to "access CiviCRM" permission I suggest we should.

The reason I offer this is while recently changing the permissions structure of a 4.0.5 site, many users complained that CiviContribute was still showing up in their menu when they logged in.  Clearing cache in browser had no effect.  When I suggested they rebuild their menu using civicrm/menu/rebuild?reset=1  they could not because they lacked permissions to do so.   The menu rebuild civicrm/menu/rebuild?reset=1  was the solution, but I had to temporarily grant these users 'administer CiviCRM' permission, which was an undesirable but necessary tactic to solve the problem, and a security hole (albeit temporary) in and of itself.

If it was necessary in the regular course of events to provide this privilege I would be concerned. Another tactic I might have tried that might have helped avoid giving them this privilege is to clear the sessions table. This effectively logs them out, and when they come back in they would get the appropriate permissions and thus appropriate menu.

Just a thought.