CiviCRM Community Forums (archive)

My client has a policy that only a given group of people are allowed to add/edit/view contributions. To this end, I created a Drupal role called contribution_access_allowed and checked the "Access CiviContribute" check box. I then unchecked this box for all other roles. Then I assigned the role to  specific individuals so they could manage contributions. This side of it worked OK, except that contributions added via civiContribute show up under Activities for any/all users, which violates the security policy!

So, what I have done is to temporarily obscure contribution "activities" in the activity view, by modifying civicrm/templates/CRM/Activity/Selector/Activity.tpl and adding  {if $row.activity_type NEQ "Contribution"} on line 28 (with a subsequent {/if} of course)

This is simply an "obscure" though and I think that from a security perspective it would be good to have finer grained control over this. Thoughts? Is there a way to do this already that I'm missing?

Thanks,
Marty.

Possibly it's been changed in one of the minor 2.2.x versions - we're running 2.2.0 - although I haven't seen any reference to it... I'll wait for 2.3, as I need to upgrade to fix another "bug" anyway:
http://forum.civicrm.org/index.php/topic,8367.0.html

Cheers,
Marty.