Non-administrators unable to tag contacts using Tags tab

Question

More specifically, when they click tag checkboxes they get the message "API permission check failed for EntityTag/create call; insufficient permission: require access CiviCRM and edit all contacts". However, they are able to tag users after clicking the "Edit" button.

The solution offered by the error message (enabling, in Drupal, the ability to edit all contacts) is not practical for me since it also allows them to view all contacts (which is against our internal policy).

A little more info on my permission structure in case it's relevant: My ACLs allow users to view and edit contacts that are members of certain groups. Ex: A user named "Bob" is in the group named "Staff". Those in the group named "Staff" are allowed to view and edit contacts in the group named "Universe".

As admin, I don't have this problem. But when I log in as a lowly user I do.

Drupal version: 7.37. CiviCRM version: 4.6.3. Thanks in advance for any help.

Answer 1

I suspect this is because acl permissions is not consistently applied across all aspects of civicrm. In this case the API permission check is a lot more granular.

At this point, I suspect your options are to either live with the status quo and/or (ask your developer if you have one to) take a look at the code to see if you can improve the API to make the permission checking incorporate ACL's also. You can look at the code on the main contact edit page (CRM/Contact/Form/Contact.php) to see how this is done.

You could also consider using the Paid issue queue service offered by the core team if your org has the funding to do so.