Change the permissions to access Volunteer tab in CiviEvent

Question

I have found out that the Volunteer tab within CiviEvent needs 'edit_all_events'. However, I do not want people editing events they did not create.

Where in the code could I find and adjust this permission? I'm looking here https://github.com/civicrm/org.civicrm.volunteer/blob/master/volunteer.php but have not found it.

I do have permissions set so this same user role can create and manage civivolunteer projects but it would be best if they were created with the event as the associated entity.

Relevant CiviEvent Permissions:

• CiviEvent: access CiviEvent
• CiviEvent: edit event participants

Relevant CiviVolunteer Permissions

• CiviVolunteer: edit own volunteer projects
• CiviVolunteer: create volunteer projects
• CiviVolunteer: edit volunteer project relationships

With these, the user get permission denied:

Answer 1

The two places "Edit All Events" is defined as necessary is in the page callbacks in the router XML on lines 19 and 27.

You should be able to change those, then do a cache clear with menu rebuild to change the permissions.

Since CiviVolunteer is so AJAX-heavy, I'm pretty sure that's the right answer. You can probably just remove the "Edit All Events" permission. However, the better long-term answer is to do an event-level permission check in the PHP, because it's not uncommon for someone to grant permission to edit only some events via an extension.