Drupal Permissions for Anonymous Profile Editing

[farbman]

Hello all,

I am wondering which Drupal permissions I need to activate for anonymous users.  I want to send out a CiviMail e-mail with a link to a specific profile that allows people to edit the profile without logging in?

I have read all of the relevant posts on these forums, but they do not seem to answer my question.

Thanks,
Eric

[Sunil]

Hi,

I want to send out a CiviMail e-mail with a link to a specific profile that allows people to edit the profile without logging in?

For edit the contact anonymously
drupal permission edit all contacts for anonymous user

http://yourdomain/civicrm/profile/edit?reset=1&id=ContactID&gid=profileID

[farbman]

Am I correct that by setting the "edit all contacts" permission for anonymous users, individuals would be able to simply change the ContactID in the URL and access a different profile?  It appears that the checksum only limits the access time.  Is there any way to avoid this or have I exceeded the current feature set?

Thanks,
Eric

[petednz]

I don't think you need to give 'edit all contacts' - though I suspect the checksum stops you just inserting another ID anyhow. I am guessing (?) checksum means the 'visitor' is being treated as 'authenticated' - they will need 'access all custom data' and 'profile listings and forms'.

[farbman]

It does not appear that I can access the profile without enabling "edit all contacts" for anonymous users.  This is clearly not ideal.  Am I missing something or can it just not be done?

Thanks,
Eric

[petednz]

Have you tested sending a correctly configured a checksum and used this in a non-logged in browser and failed to have it work with 'edit all contacts' not checked?

[xavier]

Hi,

Without any access right, you can see all the fields (including custom ones) in the profile edit form (with the right cs).

However, when saving, it automatically redirect to the home page of the site, without saving and without any error message.

Lobo or one of the guru, could you tell me where this redirect code is ? I'd modify it to check if there is a cs and if the hash is correct befodoing the redirect.

X+

[Donald Lobo]

hey xavier:

replied to your IM messages, but u disconnected. can u do one of the foll:

1. give us ssh access to your machine

2. steps to reproduce this issue on our local install.

fixing it via 1 will be the fastest ping us on IRC/IM

lobo

[xavier]

@lobo: thanks for finding the pb:

@all: the problem has been fixed already there:
http://issues.civicrm.org/jira/browse/CRM-4259