4

We think we have found a bug in the core CiviCRM related to user permissions.

If we give a role (eg authenticated) only the "CiviCRM: view my contact" permission. They have NO other CiviCRM permissions. Then as that user we go to our CiviCRM contact record (we did this by typing in the path as have provided no way to get there ie http://demo.fuzion.co.nz/civicrm/contact/view?reset=1&cid=230). On that page you get a EDIT button, which allows you to edit your contact details, and you are able to save these changes. I would assume this button should only be available if the role is given the "CiviCRM: edit my contact" permission.

We are on Drupal 7.43 and CiviCRM 4.6.14.

This is not the same issue as https://civicrm.stackexchange.com/questions/7151/permissions-view-my-contact-and-edit-my-contact-do-not-seem-to-work as I checked without the "CiviCRM: view my contact" they get access denied on the page.

  • Reported in JIRA issues.civicrm.org/jira/browse/CRM-18239 – petednz - fuzion Mar 15 '16 at 4:21
  • Thanks for having reported this issue. I'm voting to close this question because it's a bug report and it has been logged in JIRA. – samuelsov May 4 '16 at 14:04
  • 1
    but isn't leaving question for others to find if they have the same issue useful to them? do you mean you want to close (delete) it, or lock it? – petednz - fuzion May 5 '16 at 6:12
  • i added an answer - in case that gives it more validity to stay around for posterity ;-) – petednz - fuzion May 5 '16 at 6:13
1

This issue was a bug that has been fixed. For reference purposes you can see the issue here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.