We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm trying and have failed to find further documentation on any security considerations before allowing allowing access AJAX API to anonymous users. If we enable this are there features in CiviCRM that would prevent an anonymous user from using the AJAX API maliciously?


Is the visibility for your field defined in the profile as Expose Publicly and also with the Searchable checkbox checked? You might not have to fiddle with permissions.

Otherwise to directly answer your question, some of the other permissions might still restrict undesired actions, but among other things it gives access to the REST api (via civicrm/ajax/rest), so you'd have to check what your other actions are allowing. For example you could open a developer tools console in the browser and type (this uses civicrm/ajax/rest behind the scenes)

CRM.api3('Contact', 'create', {
  "contact_type": "Individual",
  "first_name": "John",
  "last_name": "Smith"
}).done(function(result) {

which would probably fail because you might not have the add contact permission enabled for anonymous, but you might be able to do something like read all the contributions, depending on what else you're allowing for anonymous.

Also the autocomplete might be limited by whatever you restrict it to in the profile, e.g. limit to a group, but you could use the api to locate other contacts and their info.

The bottom line is it depends what your other permissions are also allowing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.