CiviCRM_API3_Exception: "Authorization failed to join onto StateProvince api in parameter loc_block_id.address_id.state_province_id.name"

Question

We are using CiviCRM with Drupal 7.54 and we just upgraded to CiviCRM 4.7.19. After the upgrade, when I go to an event (Event->Manage Events->[some event]->location) with a user who has 'access CiviEvent' permissions and try to go to the location tab I receive this error:

CiviCRM_API3_Exception: "Authorization failed to join onto StateProvince api in parameter loc_block_id.address_id.state_province_id.name"

#0 sites/all/modules/civicrm/CRM/Event/BAO/Event.php(1889): civicrm_api3("Event", "get", (Array:5))
#1 sites/all/modules/civicrm/CRM/Event/Form/ManageEvent/Location.php(172): CRM_Event_BAO_Event::getLocationEvents()
#2 sites/all/modules/civicrm/CRM/Core/Form.php(564): CRM_Event_Form_ManageEvent_Location->buildQuickForm()
#3 sites/all/modules/civicrm/CRM/Core/QuickForm/Action/Display.php(92): CRM_Core_Form->buildForm()
#4 sites/all/modules/civicrm/packages/HTML/QuickForm/Controller.php(203): CRM_Core_QuickForm_Action_Display->perform(Object(CRM_Event_Form_ManageEvent_Location), "display")
#5 sites/all/modules/civicrm/packages/HTML/QuickForm/Page.php(103): HTML_QuickForm_Controller->handle(Object(CRM_Event_Form_ManageEvent_Location), "display")
#6 sites/all/modules/civicrm/CRM/Core/Controller.php(351): HTML_QuickForm_Page->handle("display")
#7 sites/all/modules/civicrm/CRM/Utils/Wrapper.php(113): CRM_Core_Controller->run()
#8 sites/all/modules/civicrm/CRM/Core/Invoke.php(283): CRM_Utils_Wrapper->run("CRM_Event_Form_ManageEvent_Location", "Event Location", (Array:0))
#9 sites/all/modules/civicrm/CRM/Core/Invoke.php(84): CRM_Core_Invoke::runItem((Array:14))
#10 sites/all/modules/civicrm/CRM/Core/Invoke.php(52): CRM_Core_Invoke::_invoke((Array:4))
#11 sites/all/modules/civicrm/drupal/civicrm.module(448): CRM_Core_Invoke::invoke((Array:4))
#12 includes/menu.inc(527): civicrm_invoke("event", "manage", "location")
#13 index.php(20): menu_execute_active_handler()
#14 {main}

We upgraded from 4.7.15 so one of the upgrades implemented a permission check for

CRM_Event_BAO_Event::getLocationEvents()

Located in CRM/Event/BAO/Event.php

 $events = array();
    $ret = array(
      'loc_block_id',
      'loc_block_id.address_id.name',
      'loc_block_id.address_id.street_address',
      'loc_block_id.address_id.supplemental_address_1',
      'loc_block_id.address_id.supplemental_address_2',
      'loc_block_id.address_id.supplemental_address_3',
      'loc_block_id.address_id.city',
      'loc_block_id.address_id.state_province_id.name',
    );

    $result = civicrm_api3('Event', 'get', array(
      'check_permissions' => TRUE,
      'return' => $ret,
      'loc_block_id.address_id' => array('IS NOT NULL' => 1),
      'options' => array(
        'limit' => 0,
      ),
    ));

Now I am able to access the tab with the permission 'administer CiviCRM' but not with just 'access CiviEvent'. This is problematic because many of my CiviEvent users can't complete their event postings.

When I comment out the this field

'loc_block_id.address_id.state_province_id.name'

in the return array ($ret) it passes permissions. I'm wondering if something is wrong with the join in the API, or if there's a permission I need to set somewhere.

Also when I go to the API explorer and reproduce the API call above, I receive the same error.

I'm wondering if this is a bug in core or maybe something on my end. Any help to find a way around this permission failure would awesome.

Thanks!

Answer 1

The problem lies with the API permission to the StateProvince entity. Civi event users do not have access to this entity via the API. (I'm not sure why this is)

To fix this I created a custom drupal module with the civi hook: mymodule_civicrm_alterAPIPermissions

mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions) {

$permissions['state_province'] = array(
    'get' => array(
      'access CiviCRM',
      'access CiviEvent',
      'edit all events',
    ),
  );
}

Which gives CiviEvent users access to this entity via the API.