CiviCRM Community Forums (archive)

Hi

A potential issue has been raised by one of our members. When viewing a members contacts details on an online profile if you delete the profile number from the end of the URL you are then able to view all member details.

Ie. if I remove the profile number 20 from the following link which shows a Civi Profile

http://www.ereps.eu.com/index.php?q=civicrm/profile/view&reset=1&id=9456&gid=20

you get the following link which shows multiple views of all member details probably based on the number of groups they belong to;

http://www.ereps.eu.com/index.php?q=civicrm/profile/view&reset=1&id=9456&gid=

although it does say Permission Denied You do not have permission to view this contact record. Contact the site administrator if you need assistance

Is this a permissions thing or a bug in the system. If permissions can somebody please advise what I need to do to restrict this.

Many thanks

Robbie

Hi Lobo

Unfortunately I am not a developer so submitting a patch is a wee bit beyond me.

The url minus the GID seems to show all created profiles populating fields where the viewed contact has data...I have attached some screenshots for reference. This of course is a bit of a nightmare as we don't wish to be in a position where personal data can be viewed. Good job we don't store bank details.

How do we proceed to get this bug addressed?

Robbie

To remove the: "Permission Denied You do not have permission to view this contact record. Contact the site administrator if you need assistance" in drupal; even though you provided proper permissions.  A simple click on "Rebuild permissions" from the Status report page and flushed all caches, removed it for me.