CiviVisualize and permissions

Question

We are using CiviCRM 4.6 with Drupal 7. We have CiviVisualize 1.42 installed and think it's pretty great. We just found a wrinkle though and wondered if the issue is with the extension or our (lack of) setup.

We have a few Drupal roles that do not have access to CiviContribute. Yet when those users navigate to the CiviVisualize section (oursite.org/civicrm/dataviz) they are able to see the CiviContribute section at /civicrm/dataviz/contribute and the Donor Trends (with specific donor names!) at /civicrm/dataviz/donortrends.

I don't see any CiviVisualize permissions in our Drupal permission list and I can't think of how Civi permissions (ACLs) would/could impact the extension's permissions. I also don't see a CiviVisualize setup page within Civi that might have settings for permissions.

Any ideas? Does CiviVisualize follow permissions from the CMS and I'm just not seeing how to set it up, or would we need to do something different to get CiviVisualize to respect our permissions? Thanks for the help!

Answer 1

I've taken a look in the code, and it looks like CiviVisualise/Civisualise/Civivisualise the missing CiviCRM visualisation extension (:P :P :P) uses direct SQL commands, meaning that certain CRM features such as ACL checks would be bypassed.

This would need changing at a code level, I'm sure Xavier would love to hear from you.

JohnFF

Answer 2

We kinda got around this by adding some permissions to civizualise.xml:

<access_arguments>access CiviCRM, view all contacts</access_arguments>

Not as good as the proper ACLs, but works ok. As JohnFF says, civizualise uses direct SQL so I imagine ACLs wouldn't be an easy thing to add.