CiviCRM Community Forums (archive)

I'm trying to understand under what circumstances a particular user will have contact access permissions applied to them.

Is this correct?

 * If the user's role has "edit all contacts" permission, then they can access all contacts, no matter what.
 * If the user's role does not have "edit all contacts", then contact access is dictated by the query as modified by hook_civicrm_aclWhereClause
 * (presumably CiviCRM's builtin ACL config applies in the case that it has been configured, with modifications applied in hook_civicrm_aclWhereClause if applicable)
 * If hook_civicrm_aclWhereClause is not implemented, the user has access to no contacts whatsoever

If hook_civicrm_aclWhereClause is not implemented, the user has access to no contacts whatsoever

This one is incorrect.  A corrected version would be:
"If hook_civicrm_aclWhereClause is not implemented, CiviCRM's buil-in ACL config applies, unmodified."

Also, I know that in civicrm 3.1.x, "view all contacts" would cause this hook to be bypassed just as "edit all contacts" does.  But I haven't had cause to use it in 3.2.

- TM