Drupal gives me only one choice in its listing of CiviCRM permissions to assign to a Drupal role related to the editing of CiviEvents, namely "Edit all events". I'm nervous assigning this permission and would rather restrict the permission to "Edit own events."

Other CiviCRM functions show the normal sequence of permissions which include ones like "Edit own manual batches." Is it safe to assign "Edit all events" to non-admin users?

  • That really depends on who the non-admin users are and whether you trust them.
    – Graham
    Commented Apr 22, 2015 at 15:10
  • Just wondering if anyone else has developed the code needed to address this issue. I am working with a larger Organization that has many branches and will have MANY events. We definitely want people to be able to manage and edit their own events but not others at all. If someone has worked this out would sure love the help since I don't have the code skills, and this seems like a pretty important permission option.
    – user6070
    Commented Aug 15, 2018 at 4:36

3 Answers 3


It depends on the context and the definition of non-admin users.

If, for example, your context is a small organisation with a small number of users I would say it is safe to do so. You could generally agree with each other that everybody is responsible for the events they have created which is usually the case anyway.

But if you have hunderds of users who might edit other events the it might be something which is not really helpfull for your situation. Then you might think about other solutions for creating and managing events because manage own events is missing from the permission settings.


It really depends on your specific circumstance. Do you trust the users that will be editing these events? If not, then No.

If your website has open registration, certainly don't assign that permission to the default Drupal role. It would be helpful to know more about your use case.

If you NEED an "edit own events" permission, it wouldn't be too difficult to create that permission with just a little PHP.

  • (Yikes, hitting 'return' as well as 'shift-return' saves the comment-- that's odd behavior, so I'm editing my comment now with no line breaks (nope, can't edit it 'cause you can only edit for 5 minutes and I'm too slow)), It is a very small set of users (@user3853493), but it does have open registration and is about a politically controversial subject, so someone unfriendly might want to mess around. Sadly, PHP is not one of my strong points, but yes, I would love "just a little PHP" to enable an "edit own event" permission. How might I obtain such code?
    – webpotato
    Commented Apr 25, 2015 at 22:25
  • Oh! And no, not I won't be setting that for the default (anonymous) Drupal user, rather it's for an "autheniticated" Drupal role that we give certain content creation permissions to. But apparently, setting "edit all events" for that role by itself does not do the trick. Yes, a wrench icon appears on the event display page, and clicking that link takes the user to the page where they should be able to edit the event, but without the "Access CiviCRM" permission set for that role, nothing enabling editing the event appears. (cont.)
    – webpotato
    Commented Apr 25, 2015 at 22:44
  • With that permission set for that role, the CiviCRM menu bar appears and, in my case, only "Events" shows on that bar, however, the drop down from that includes:Dashboard Find Participants Event Reports New Event Manage Events Event Templates New Price Set Manage Price Sets, I'm not sure how functional all that is, but as you can see, having that little snippet of PHP to allow for "edit own events" would be handy.
    – webpotato
    Commented Apr 25, 2015 at 22:44

For Drupal 9/10, you need to add an event handler, something like

function mymodule_entity_type_build(&$entity_info) {
  if (isset($entity_info['civicrm_event'])) {
    $entity_info['civicrm_event']->setHandlerClass('access', 'Drupal\mymodule\Access\EventAccessControlHandler');

And add a new handler class at src/Access/EventAccessControlHandler.php


namespace Drupal\mymodule\Access;

use Drupal\civicrm_entity\CivicrmEntityAccessHandler;
use Drupal\Core\Entity\EntityInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Access\AccessResult;

class EventAccessControlHandler extends CivicrmEntityAccessHandler {

   * {@inheritdoc}
  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
    $eventId = $entity->id();

    // Check if this event is created by the logged in user.
    $isOwner = \Civi\Api4\Event::get(FALSE)
      ->addWhere('created_id', '=', 'user_contact_id')
      ->addWhere('id', '=', $eventId)
    if (!empty($isOwner)) {
      $permissions = ['edit my events']; // New custom permission added in permissions.yml
      return AccessResult::allowedIfHasPermissions($account, $permissions, 'OR');

    return parent::checkAccess($entity, $operation, $account);


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.