I'm implementing ACLs for a client. Users can only have view or edit to a group when adding permissions, so then don't have the ability to add or remove a contact from that group. In fact, I've found there are ways to add and delete a contact to/from a group - but the more usual methods result in the message "API permission check failed for GroupContact/delete call; insufficient permission: require access CiviCRM and edit all contacts"
This is a Drupal system & they have 'edit groups' permissions. Giving the permission 'edit all contacts' then opens up all contacts to a user, which is obviously incorrect.
Is this a limitation of ACLs? Or is there some way around this problem?
Can you try apply patch from here ? If the patch works for you than it would be worth adding your test result on PR to speed up the merge process.
-
Unfortunately I don't do cmd line stuff, I'm strictly an implementer. Actually I do cmd line stuff on IBM mainframes but that was many years ago! If you can send me the full code I can install that, rather than the patch. And thx for the fast response. – Andy Clark Apr 3 at 12:56
-
1You can also apply the patch manually by editing the file and adding lines with says + and remove lines which says - – Pradeep Nayak Apr 3 at 12:58
