CiviCRM Community Forums (archive)

Drupal 7.23
CiviCRM 4.3.5

I've discovered this handy CiviMail tag to use to give users a 'View email in your browser link':

{mailing.viewUrl}

However, I discovered that link (eg. http://bbi.peapoddev.com/en/civicrm/mailing/view?reset=1&id=12) requires these permissions:

view public CiviMail content
access CiviMail

That's cool, so I gave those permissions to all anonymous and authenticated users.  Trouble is that gives anonymous users too much power.  They can then access pages such as:

/civicrm/admin/mail
/civicrm/admin/component (they can add new stuff here)
/civicrm/admin/mailSettings

There are probably more, I didn't try all the paths, but just look for 'access CiviMail' in all *.xml files in the CiviCRM codebase and you can glean the CiviCRM pages which are allowed just for having 'access CiviMail'.

This is bad.  Am I doing something wrong, or is this intended behaviour? 

Anyone know of a way just to expose the view mailing URL (/civicrm/mailing/view), without giving away other admin paths?

Thanks!
Matt

At least for me, I do require 'access CiviMail' to see /civicrm/mailing/view as an Anonymous user.  I tried with only 'view public CiviMail content' and get access denied, then when I add 'access CiviMail' I go through.

Also, take a look at /civicrm/CRM/Mailing/xml/Menu/Mailing.xml, line 197, the definition for the civicrm/mailing/view.  The <access_arguments> tag there reads this for me:

<access_arguments>view public CiviMail content;access CiviMail;approve mailings</access_arguments>

Doesn't that corroborate my experience where 'access CiviMail' is required?

In any case, thanks for your time and please do send along that view code, I'd love to take a look see.

Thanks!
Matt

Ahhhhh, I see.  Point #1 was what I was missing.  Works beautifully now.  For future reference, if my client misses that setting and comes calling, where abouts in the DB?  I briefly scanned over the schema and I think it's:

civicrm_mailing::visibility = Public Pages

Sound right?

Thanks a bunch for your help.  You sir, are the man.

That's cool, thanks Coleman.