AJAX API permissions

Question

We are using REST urls to pull data direct from Civi reports into Excel for analysis purposes. Within Civi the users are restricted via granular ACLs to specific groups of contacts.

WP role permission "Edit all contacts" is off for users.

WP role permission "CiviCRM:access AJAX API" - is on for users and the user has their own API key generated.

However when we extract the data via the rest url, it gives the error "API permission check failed for ReportTemplate/getrows call; insufficient permission: requires administer CiviCRM"

REST url looks as follows:

XXXXX/wp-content/plugins/civicrm/civicrm/extern/rest.php?entity=ReportTemplate&action=getrows&instance_id=94&options[limit]=500&api_key=PXXXXXXXXXXX3X&key=074cXXXXXXXXXXX259&json=1

We can get around the "requires administer CiviCRM" by adding a block to civicrm/CRM/Core/DAO/permissions.php as follows:

$permissions['report_template'] = array(
    'getrows' => array(
      'access CiviCRM',
      'access AJAX API',
    ),
  );

But that doesn’t respect the ACL group permissions – is there any way to limit it to just the data the user should normally be able to see? We are stuck with all records or no records.

Answer 1

I believe there is currently a bug. I have submitted a bug report:

https://issues.civicrm.org/jira/browse/CRM-20582

When I ran into my issue, I was told:

"If you need a quick fix that doesn't involve granting more permissions than users ought to have, take a look at https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_alterAPIPermissions/."