CiviCRM Community Forums (archive)

Hi All,

I'm having problems with access control...

I've set up smart groups like:

Permissions:  Admins
Permissions:  Data Entry
etc...

Next, I created roles such as:
Add New Constituent
Add New Legislator
etc...

Next I created ACLs making it possible for:
The 'Add New Constituent' role to VIEW (and EDIT) the New Constituent Organization, Household and Individual Profile data

Lastly I tied everything together by:
Assigning the smart groups: Admins, Team Expert, Team Organizer, Data Entry and Fundraisers to the Add New Constituent Role.

Once all this was set up, I expected -- while masquerading as our test user (testperm) -- to not be able to link to the New Individual, New Household or New Organization entry forms, because testperm does not belong to either Admins, Team Expert, Team Organizer, Data Entry nor the Fundraisers group.  However, testperm can still link to those forms without any problem.

My question is, what have I overlooked.  Why are the ACL access rules not being followed?  If anyone has an answer or an idea that would be great!

Thanks so much!
aj

Hi Lobo,

I've tried logging in via another browser as testperm.  It's still the same result. 

What I have is a custom block module that has links for creating the following profiles:

Constituent
Legislator

What I want to happen is for that page (the profile creation form) to show 'access denied' when those links are clicked by a user who does not have creds to create (view or edit) a profile.

For example I would like users who are Team Organizers to be able to create Constituent contacts.

I went through these steps:
1 - Created a group called 'Team Organizers'
2 - Added some contacts to that group.
3 - Created an ACL Role called 'Add New Constituent'
4 - Created an ACL which allows the view (and edit I believe, because they are both the same for profiles if I understand correctly) operation on the 'New Constituent Individual' profile for the 'Add New Constituent' role.
5 - Assigned the 'Add New Constituent' role to the users in the 'Team Organizers' group.

Afterwards, I logged in as testperms -- who is NOT in the 'Team Organizers' group.  When I click on the link to take me to the form to create a new constituent profile I shouldn't be able to see that page, but I can see and save the form with no problems. 

Any idea what I may have missed here?

thanks!
aj

What I have is a custom block module that has links for creating the following profiles:
Constituent
Legislator

Can we check there isn't some drupal/civi language looseness here.

In civicrm you wont have a link to 'create' a profile. Are you talking civicrm profiles or drupal profiles?

can u get on IRC. We'll need ssh access to the machine.

lobo

the transaction pages (event/contribution/membership) display the profiles that they have irrespective of permissions. This can be construed as a bug or a feature, but is definitely inconsistent behavior. Its a side effect of profiles having multiple uses and too many options

i'm pretty sure profile  create/edit does match against permissions. if you think this is not true, please reproduce on a local machine and give us ssh access (cant do this on demo, since u'll probably need to disallow anon access to profiles by default)

lobo

Eileen wrote:

I don't think this is unique to AJ. If I understand correctly he is saying he can still get to a CREATE PROFILE page even when he doesn't appear to have permission to.

Hi Eileen,

Yes!  This is exactly what I'm saying.  Sorry if I was being unclear.  Have there been any new developments regarding this problem?  Was anyone else able to reproduce profile creation not matching against permissions? 

Thanks,
aj

Hi,

Lobo pointed out to me that it was because I had set in the administer civiCRM Access Control

Everyone   Edit   Profile   All Profiles   Edit All Profiles    Yes

and that was allowing people access to the profiles even when the drupal permissions weren't

I have removed that permission. The profile set to be used for 'Profile' still appears to be available to anonymous users in both it's create and it's search incarnation.

http://classes.org.nz/civicrm/profile/create?reset=1&gid=6

However, those set to 'search' are no longer available to anonymous users.

I think this is how it's supposed to work?

Hi,

For the sake of my site I'm happy just to try upgrading to a later version - that site is on 2.2.0 at the moment. But I'll leave it for now if you feel there is value in investigating. Might be good to hear if AJ is still having problems.

I don't see a change from truncating. Some users have been having a couple of profile errors that don't seem right since we've been looking at this so I truncated sessions as well and am hoping they will tell me that those errors have gone now