- Drupal 7.63
- CiviCRM 5.9.1
Created custom fields with Field Type of Autocomplete-Select with lookup for following fields:
- Area of Study
- Year of Graduation
Used for: Participants (Role): Attendee
Attendee is a type of participant for an event type, alongside other types
- Custom Data Set is active
- Custom Data Set is public
Custom fields are to be used by CiviEvent attendees to self select as part of event registration, this information is saved against their contact entry.
- "CiviCRM: access all custom data" is active for Anonymous User role
When typing in a valid value for the custom field, such as "Accounting" for "Area of Study" the following error of "Loading Failed" is displayed for an unauthenticated user.
This lookup works fine with the following Drupal Role Permission assigned:
- CiviCRM: access CiviCRM backend and API
- Master control for access to the main CiviCRM backend and API. Give to trusted roles only.
I've been unable to find more information about the security implications of this setting, and the wording of this setting concerns me when thinking to giving it to Anonymous Users.
I'm trying to get the balance of functionality without leaving the system too open, but I'm unsure why I need to expose access to the backend and API to get this working.
When the following Drupal permission is modified: (thanks @petednz)
"CiviCRM: access AJAX API" is active
- The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "None Found" (error has light great background instead of red background per image above)
"CiviCRM: access AJAX API" is inactive
- The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "Loading Failed" (error has red background per screenshot above)