Author Topic: ajax api permission (Read 4955 times)

dlats · February 17, 2013, 07:39:54 am

I'm using 4.2.7.
From the docs for 4.2

"No matter how the user is identified, it checks if:

1) The user has ‘access AJAX API’ (that could be granted to anonymous) OR 'access CiviCRM'

2) The user has the right permission.
"
A user has access AJAX api and View all contacts permissions.

An ajax api call to get contacts returns "API permission check failed for Contact/get call; missing permission: access Civicrm".

What am I missing?

Donald Lobo · February 17, 2013, 04:52:19 pm

can u post a link tot the docs, so we have a better context of where that is made etc

lobo

xavier · February 18, 2013, 12:26:14 am

Pretty much any api won't work out of the box without "access CiviCRM". Your example might be one of the view cases where it would make sense, but as it hasn't been a common use case, we kept is save and made mandatory access civicrm.

The difference is that if your user has already access AJAX API, a simple hook can let you decide how wide you want it open at each api level:
http://wiki.civicrm.org/confluence/display/CRMDOC41/CiviCRM+hook+specification#CiviCRMhookspecification-hook_civicrm_alterAPIPermissions

What is your use case? granting view all contacts but not access civicrm seems rather unconventional

dlats · February 18, 2013, 03:51:29 am

The doc is here: http://wiki.civicrm.org/confluence/display/CRMDOC42/API+Security

The use case; A profile for an authenticated user to create a contact with several memberships. There is a select with options of Organizations that have membership types associated with them. The user selects an organization and then the membership type select is populated using AJAX. This user has no access to civicrm. This user only does data entry. The membership part of the profile are custom fields with the membership entry done in a custom module.

I have converted the AJAX api call to jquery ajax calling a custom php script that does the db fetches. This avoids the api permissioning .system

xavier · February 18, 2013, 07:06:02 am

So you don't want to expose all the contacts, but only the org (or some of the organisations), isn't it?

The civi way would be to create an extension (using civix) create an api/v3/Contact/Getmembers.php

put a civicrm_api3_Contact_getmembers () {

return civicrm_api("Contact","get", array("contact_type"=>"Organization"...)
}

and implement the hook to grant to the right users access to this new api

dlats · February 18, 2013, 01:10:23 pm

Thanks Xavier. That would work, but I don't have ssh access to the site (can't install civix). I've searched for a manual method for creating extensions, but have not found any yet.....

Eileen · February 18, 2013, 01:37:41 pm

You can create the extension (using Civix) on another machine ftp it onto the site

dlats · March 12, 2013, 05:41:51 am

I did create an extension and implemented hook_civicrm_alterAPIPermissions setting $params['check_permissions'] = false; for my new entity. Works great. Thanks.

xavier · March 12, 2013, 06:58:31 am

Great you made it.

Could you share the result? might be quite specific to your org, but could be a good example for others trying to get a custom api accessible by anonymous

X+

chiebert · June 25, 2013, 03:56:46 pm

Did this example ever get posted somewhere? I'd love to see the real-life example!

Also, the page referenced (http://wiki.civicrm.org/confluence/display/CRMDOC42/API+Security) is for Civi 4.2 - and I haven't been able to find a 4.3 version of the page in the wiki, even though there's a rather important reference to changes made in the 4.3 API default permissions setup!

Quote

Permissions within API

When check_permissions is set to 1 then the contact calling the API will be checked to see if they have appropriate credentials.

Permissions used by each API action as set in the file CRM/Core/DAO/.permissions. As of 4.3 any api action not specifically defined there required 'Administer CiviCRM' access.

These permissions can be altered using the AlterAPIPermissions hook.

As of 4.3 the Contact-Get API also applies ACL permissions. So, a person will only have the records of the contacts they are permitted to see returned. Only fields explicitly declared in getfields may be returned (the return param can not be manipulated to get extra fields).

chiebert · June 25, 2013, 04:38:28 pm

Spoke too soon: found the docs it at http://wiki.civicrm.org/confluence/display/CRMDOC43/API+Security.

(Interestingly, it didn't show up in he search results when I used the 'search documentation' block using 'API security')

... Still interested in the example!

andersiversen · September 16, 2013, 11:34:33 am

Hi

I'm on drupal and I have problems as well with the ajax api permissions:

I have a view, where I want to get the OptionValues to use as options in a select form. I have this script fetching the optionValues:

Code: [Select]

CRM.api('OptionValue', 'get', {'sequential': 1, 'option_group_id': 87},
     {success: function(data) { // doing stuff ...

It works great for me, the admin, but for another user role, having permissions "access civicrm" and "acces AJAX API", I get this error:
API permission check failed for OptionValue/get call; missing permission: administer CiviCRM.

So I created a custom module to stop checking for permissions when calling for those optionvalues (following the example from the wiki):

Code: [Select]

function mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions)
{
    // skip permission checks for optionvalue get calls
    // note: unsetting the below would require the default ‘access CiviCRM’ permission
    $permissions['optionvalue']['get'] = array();

    // the above didn't work, so I tried this as well
    if ($entity == 'OptionValue' and $action == 'get' and $params['option_group_id'] == '87') {
        $params['check_permissions'] = false;
    }

}

Alas - I cannot get it to work. Any clues on what I am missing?

xavier · September 16, 2013, 02:50:09 pm

Hi,

Could you check if your custom module is called? ie. add a die ("it's here"); You are on the right track, if the module is called it should work.

Is this a module of civi extension?

andersiversen · September 16, 2013, 04:50:10 pm

Checked, and it's here - or I mean there - it get's called.
It's a drupal module, so not a module of civi extension

andersiversen · September 30, 2013, 02:02:37 pm

I found the errors in my code by using the dd function of the drupal dev module - with dd($something); in your code, $something will be pretty printed to /tmp/drupal_debug.txt - quite handy

So the code needs to be like this:

Code: [Select]

function mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions)
{
  // skip permission checks for option_value get calls
  if ($entity == 'option_value' && $action == 'get' && $params['option_group_id'] == '87') {
    $params['check_permissions'] = 0;
  }
}

CiviCRM Community Forums (archive)

News:

Author Topic: ajax api permission (Read 4955 times)

dlats

ajax api permission

Donald Lobo

Re: ajax api permission

xavier

Re: ajax api permission

dlats

Re: ajax api permission

xavier

Re: ajax api permission

dlats

Re: ajax api permission

Eileen

Re: ajax api permission

dlats

Re: ajax api permission

xavier

Re: ajax api permission

chiebert

Re: ajax api permission

chiebert

Re: ajax api permission

andersiversen

Re: ajax api permission

xavier

Re: ajax api permission

andersiversen

Re: ajax api permission

andersiversen

Re: ajax api permission