CiviCRM Community Forums (archive)

I seem to have a conflict of permissions and I can't devise a way around it... so looking to see if anyone has any ideas that could help me.

I have a role called "member" that I would like to be able to see their OWN dashboard, so that they can view their contribution history. I enabled the "View Contact Dashboard" permission for this role and created my own menu item pointing to /civicrm/user?reset=1 and everything is great.

However, I have another group of people (a subset of people in the "member" role) that I want to be able to use the email contacts feature of Civi. I created this role ("email contacts") and gave them Access CiviCRM and View All Contacts permissions.

The problem is that they now have access to any user's dashboard, being able to see their contribution history (even though they don't have CiviContribute access and can't see the contributions tab on the user record).

I found this thread: http://forum.civicrm.org/index.php/topic,3448.0.html that seems to imply that even without the View Contact Dashboard permission, authenticated users could see their own dashboard, just wouldn't have the link on the Drupal user page. I am not seeing that behavior, however. If I remove the View Contact Dashboard permission for the "member" role, I get an Access Denied when I go to the user dashboard url.

Is there any way to set up permissions so that users can only view their own dashboard?  (Or any other workarounds anyone can think of?)

Thanks!

ETA: This is Civi 2.0.5 and Drupal 5.7

View all Contacts is a all powerful permission and hence you see the behavior below.

Understood. However, even if I were to use CiviCRM ACL permissions, I would still have the same problem.

I'll probably take a look at the code and see if I can add a check to display only if self.  I really have no need for anyone to ever see anyone else's dashboard but their own.