How to restrict access to CiviMail's reports, e.g. click rates

Question

If one sends out a mailing using CiviCRM, one can access an overview of the mailing's result from the mailings menu (see screenshot). From this summary you will also be able to access more detailed information, including the unique opens (see screenshot).

As this information can be considered quite sensitive in regard to data protection, I would like to restrict access to it to certain users/roles. I tried editing the permissions of all relevant mailing reports I could find.

However, it turns out that this information does not seem to be based on CiviCRM'S report function. Even If restrict user's access to any report functions, the detailed mailing information can still be viewed.

Hence my questions are:

• Which permission is actually relevant for opening pages such as civicrm/mailing/report/event?reset=1&event=opened&mid=XYZ&distinct=1 ?
• Is there any way to restrict access to this information without denying users to use CiviMail at all?

Tested on CiviCRM 4.7.18 and Drupal 7.54.

Answer 1

I don't know an intended way to alter the permissions directly.

However, you can play around with disallowing the simple mailing event reports altogether for unprivledged users and restrict access for users to the regular reports as you need it.

SELECT * FROM civicrm_menu where path = 'civicrm/mailing/report/event';

e.g. altering access_arguments from a:2:{i:0;a:1:{i:0;s:15:"access CiviMail";}i:1;s:3:"and";} to a:2:{i:0;a:1:{i:0;s:18:"administer CiviCRM";}i:1;s:3:"and";} will only allow admins to view any of the event reports.

Answer 2

I think you can bypass using permission_check hook.

Answer 3

We ended up using a hook as suggested. Anyone interested in how we did it can take a look at the code.