2

I have found out that the Volunteer tab within CiviEvent needs 'edit_all_events'. However, I do not want people editing events they did not create.

Where in the code could I find and adjust this permission? I'm looking here https://github.com/civicrm/org.civicrm.volunteer/blob/master/volunteer.php but have not found it.

I do have permissions set so this same user role can create and manage civivolunteer projects but it would be best if they were created with the event as the associated entity.

Relevant CiviEvent Permissions:

  • CiviEvent: access CiviEvent
  • CiviEvent: edit event participants

Relevant CiviVolunteer Permissions

  • CiviVolunteer: edit own volunteer projects
  • CiviVolunteer: create volunteer projects
  • CiviVolunteer: edit volunteer project relationships

With these, the user get permission denied: enter image description here

2
+100

The two places "Edit All Events" is defined as necessary is in the page callbacks in the router XML on lines 19 and 27.

You should be able to change those, then do a cache clear with menu rebuild to change the permissions.

Since CiviVolunteer is so AJAX-heavy, I'm pretty sure that's the right answer. You can probably just remove the "Edit All Events" permission. However, the better long-term answer is to do an event-level permission check in the PHP, because it's not uncommon for someone to grant permission to edit only some events via an extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.