1

I am currently testing the dashboard feature before enabling it on a production site. There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and not "Edit my contact" is able to Edit a relative's contact (for which he has Dashboard access) even though he can only View his own contact.

Can someone confirm that this isn't only on my installation? I cannot test this on the Demo site as there is no access to Drupal.

PermissionsPermissions User's DashboardContact's Dashboard User's CiviCRM ProfileContact's own profileThe Spouse's ProfileSpouse's ProfileSpouse's Profile Edit ScreenEdit Spouse's Profile

  • Does the contact have a relationship to the spouse, and on that relationship settings does the contact have A to B edit permissions? – jackrabbithanna Jan 24 '17 at 2:09
  • Yes, Mr. I'm testing can view and update information about Evan Andrews. However, in the CMS permissions a user cannot edit their contacts – Yossi Jan 24 '17 at 2:23
  • If Mr. Testing has a relationship that connects him to Evan, and that relationship has an option to allow the contact special permission to edit the spouse. If you have the relationship on the Mr Testing contact and edit that relationship and the checkbox to allow to edit Evan is NOT checked, then it would definitely be a bug. The whole point of that relationship option is to sometimes allow a contact to edit their spouses record. Go to the relationship tab of Mr. Testing, edit the spousal relationship, and put a screenshot up here. Also what other CiviCRM permissions does the auth user have – jackrabbithanna Jan 24 '17 at 4:06
  • @jackrabbithanna, that would make sense if in the CMS permissions Mr. Testing had the permission to "edit my contacts" but he does not and that is why he cannot edit his own contact. It doesn't make sense to be able to edit the spouse's contact but not his own... The permission in relationship screen is indeed enabled and that is why you can see the spouse in the dashboard, otherwise Evan wouldn't be visible – Yossi Jan 24 '17 at 4:18
  • There is no "edit my contacts" permission, only "edit my contact" . The behavior you describe makes sense to me, but I wonder if this is a change in behavior from earlier versions? – jackrabbithanna Jan 24 '17 at 13:35
1

You should look at the comment by cividesk, and make sure that if you uncheck the setting on Evan's relationship record to be able to edit the spouse contact, that Evan can't edit the spouse record. If that works as expected then:

Discussed this issue with CiviCRM Security Team. The consensus is that this is not a bug, more like a feature, or one way to look at it is that CiviCRM is just flexible/configurable in this manner. If you don't want to have the contact be able to their spouse from that form you either need to not enable the setting on the contact's relationship record to allow editing, or possibly use ACLs(Access Control Lists) or some custom code in an extension to modify this behavior.

Also as a side note, the permissions "edit my contact" and "view my contact" when enabled for a Drupal user role can cause performance issues in installations with large numbers of contacts.

| improve this answer | |
  • It still doesn't make sense to me that there is either the option to edit the contact with full edit capability of all fields including all tags or nothing at all. Seems to me that one should be able to view relatives without necessarily editing especially since one is able to do view his own contact without edit capability. In addition, there are 2 links to edit the contact one as seen on the dashboard screenshot "edit contact info" which allows you to update basic info without seeing all the org's tags and you can click on the name to have full edit access as seen in image above. – Yossi Jan 27 '17 at 0:07
  • I'm happy to give you a login to my demo instance for you to take a look for yourself if you'd like – Yossi Jan 27 '17 at 0:07
  • yeah I'm not doubting you or necessarily disagreeing. Its more like that it is what it currently is, some other people who contributed code to make what is there just happened to think the current way is the way it should be. Sometimes the line between "bug" and "feature" is a bit fuzzy and grey, and depends on your perspective. You can raise a issue at issues.civicrm.org , and make a PR against github.com/civicrm/civicrm-core/tree/4.6 for community evaluation. Its an open source community, and debates of this nature are a daily occurrence. – jackrabbithanna Jan 27 '17 at 1:28
  • I see. I guess I will stick to Drupal Views and Webforms for now. – Yossi Jan 27 '17 at 6:30
  • Views and Webforms are always a good idea....CivICRM Entity lets developers write custom access handlers for Drupal based view pages of CiviCRM data, see civicrm_entity.api.php for hook documentation – jackrabbithanna Feb 24 '17 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.