4

We think we have found a bug in the core CiviCRM related to user permissions.

If we give a role (eg authenticated) only the "CiviCRM: view my contact" permission. They have NO other CiviCRM permissions. Then as that user we go to our CiviCRM contact record (we did this by typing in the path as have provided no way to get there ie http://demo.fuzion.co.nz/civicrm/contact/view?reset=1&cid=230). On that page you get a EDIT button, which allows you to edit your contact details, and you are able to save these changes. I would assume this button should only be available if the role is given the "CiviCRM: edit my contact" permission.

We are on Drupal 7.43 and CiviCRM 4.6.14.

This is not the same issue as https://civicrm.stackexchange.com/questions/7151/permissions-view-my-contact-and-edit-my-contact-do-not-seem-to-work as I checked without the "CiviCRM: view my contact" they get access denied on the page.

Improve this question
4
  • Reported in JIRA issues.civicrm.org/jira/browse/CRM-18239
    – petednz - fuzion ♦
    Commented Mar 15, 2016 at 4:21
  • Thanks for having reported this issue. I'm voting to close this question because it's a bug report and it has been logged in JIRA.
    – samuelsov
    Commented May 4, 2016 at 14:04
  • 1
    but isn't leaving question for others to find if they have the same issue useful to them? do you mean you want to close (delete) it, or lock it?
    – petednz - fuzion ♦
    Commented May 5, 2016 at 6:12
  • i added an answer - in case that gives it more validity to stay around for posterity ;-)
    – petednz - fuzion ♦
    Commented May 5, 2016 at 6:13

1 Answer 1

Reset to default
1

This issue was a bug that has been fixed. For reference purposes you can see the issue here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.