CiviCRM Community Forums (archive)

*

News:

Have a question about CiviCRM?
Get it answered quickly at the new
CiviCRM Stack Exchange Q+A site
This forum was archived on 25 November 2017. Learn more.
How to get involved.
What to do if you think you've found a bug.



  • CiviCRM Community Forums (archive) »
  • Old sections (read-only, deprecated) »
  • Support »
  • Using CiviCRM »
  • Using Core CiviCRM Functions (Moderator: Yashodha Chaku) »
  • Has drupal permission "View user profiles" always given access to dashboard
Pages: [1]

Author Topic: Has drupal permission "View user profiles" always given access to dashboard  (Read 1780 times)

petednz

  • Forum Godess / God
  • I’m (like) Lobo ;)
  • *****
  • Posts: 4899
  • Karma: 193
    • Fuzion
  • CiviCRM version: 3.x - 4.x
  • CMS version: Drupal 6 and 7
Has drupal permission "View user profiles" always given access to dashboard
June 01, 2012, 03:39:35 am
Surprised me to find that if I give Authenticated permission to 'View user profiles' then as well as seeing the Drupal user of another contact, and the civicrm profile that is there, they also see the 'view contact dashboard' of that other person - and can click through and see that other persons Donations etc.

Has this always been the case?
Sign up to StackExchange and get free expert advice: https://civicrm.org/blogs/colemanw/get-exclusive-access-free-expert-help

pete davis : www.fuzion.co.nz : connect + campaign + communicate

Dave Greenberg

  • Administrator
  • I’m (like) Lobo ;)
  • *****
  • Posts: 5760
  • Karma: 226
    • My CiviCRM Blog
Re: Has drupal permission "View user profiles" always given access to dashboard
June 01, 2012, 09:06:52 am
Peter - I just did a test in my 4.1 / Drupal 7 local install with the following permissions for authenticated role:
- access Contact Dashboard
- profile listings, create, edit, view
- Drupal view user profiles

When I go to /user/N for a different user I am seeing a "View Contact Dashboard" link. This is definitely a bug. However clicking that link gives me "fatal" page with "You do not have permission to view this contact". I am not seeing any of that person's data. I also am NOT seeing any of the CiviCRM profile fields in the /user/N page.

Can you verify what you're seeing / what permissions you've got. We should suppress the dashboard link - but I'd like to figure out why your behavior is different from mine.
Protect your investment in CiviCRM by  becoming a Member!

petednz

  • Forum Godess / God
  • I’m (like) Lobo ;)
  • *****
  • Posts: 4899
  • Karma: 193
    • Fuzion
  • CiviCRM version: 3.x - 4.x
  • CMS version: Drupal 6 and 7
Re: Has drupal permission "View user profiles" always given access to dashboard
June 03, 2012, 07:27:12 pm
so i have several sites where i am getting different outcomes. I have tried to analyse the differences but haven't spotted it yet. Thought it might be due to it being multi-org but think i have confirmed that it is not  ???
Sign up to StackExchange and get free expert advice: https://civicrm.org/blogs/colemanw/get-exclusive-access-free-expert-help

pete davis : www.fuzion.co.nz : connect + campaign + communicate

phunter

  • I’m new here
  • *
  • Posts: 29
  • Karma: 0
  • CiviCRM version: Latest
  • CMS version: Drupal 7
Re: Has drupal permission "View user profiles" always given access to dashboard
July 28, 2012, 05:39:41 am
Quote from: Dave Greenberg on June 01, 2012, 09:06:52 am

When I go to /user/N for a different user I am seeing a "View Contact Dashboard" link. This is definitely a bug.

Dave, has this been raised as an issue? I was unable to find if this was now fixed.
Currently running with 4.1.2 and shows the issue as you state it

Dave Greenberg

  • Administrator
  • I’m (like) Lobo ;)
  • *****
  • Posts: 5760
  • Karma: 226
    • My CiviCRM Blog
Re: Has drupal permission "View user profiles" always given access to dashboard
July 30, 2012, 04:40:32 pm
No this hadn't gotten fixed (evidently a regression bug after fix in http://issues.civicrm.org/jira/browse/CRM-7136). I've committed a fix for 4.2 so should be part of 4.2 beta 4 due out on Wed. Would be great if you could test it out.
Protect your investment in CiviCRM by  becoming a Member!

phunter

  • I’m new here
  • *
  • Posts: 29
  • Karma: 0
  • CiviCRM version: Latest
  • CMS version: Drupal 7
Re: Has drupal permission "View user profiles" always given access to dashboard
August 15, 2012, 07:42:36 am
Sorry that I was a bit late in replying. I will test on the 16th Aug and feedback if there is still a problem
Pages: [1]
  • CiviCRM Community Forums (archive) »
  • Old sections (read-only, deprecated) »
  • Support »
  • Using CiviCRM »
  • Using Core CiviCRM Functions (Moderator: Yashodha Chaku) »
  • Has drupal permission "View user profiles" always given access to dashboard

This forum was archived on 2017-11-26.