CiviCRM Community Forums (archive)

Hello.

Today, while testing access rights for a profile and viewing/editing data based on ACL (please see http://forum.civicrm.org/index.php/topic,7415.0.html for details), I've noticed that if a user is added to a Group, that is linked to an ACL role, everything works as it should.

But if I remove user from that group, and later add him back, he does not get the proper permissions back. Removing from a group is a kind of a 'never return' action for ACL. User cannot access profile and edit anything. Luckily I was testing this on a dummy user...

Regards,
Danila

Hello, Lobo.

Unfortunatelly it does not.

The records in civicrm_acl_cache appear only after user tries to access the profile page. Always 6 of them appear, all with NULL contact_id and with NULL modified date. Foreign key to ACL is increasing from 2 to 7.

I checked both adding/removing from find contact page, and from contact view page with tabs.

civicrm_acl_cache is empty after I added new contact to the group.

When I use this fresh contact to go to the profile page, civicrm_acl_cache gets much more records, and they all have correct number in contact_id. modified_date is still empty.

So I think problem is not in civicrm_acl_cache.

Regards,
Danila

Sorry, Lobo, my clients will be unhappy with this...

I have replicated this setup on

http://drupal.demo.civicrm.org/civicrm/profile?reset=1&gid=5

user: TestACL
password: testtest

group: ACL testers
role: ACL tester

The only thing which is different between my setup and setup on drupal.demo.civicrm.org, as it seems to me, is that all authenticated users have access rights 'view all profiles' and 'edit all contacts', so I cannot replicate this bug.

So, could you please keep this rights for a while only for demo account role, and drop them for the authenticated users? Authenticated users need only 'access all custom data' from the civicrm permissions.

Regards,
Danila