Extension: UK Phone Number Validator - permissions

Question

Cool little extension. I am about to trial it on a site. I'm new to extensions so am trying to work out how this is permissioned. On the wiki I see "At this time, permissions for extensions are not influenced by CiviCRM's ACL system so we need to rely on the underlying permissions of the CMS to allow or deny access to an extensions pages." I can't find any info on the specific extension page/post but from the wiki it seems like extensions are usable by anyone with the 'administer CiviCRM' permission and/or 'access Contact Dashboard'. BUT, I'm masquerading as a user with neither of these permissions, and I can still access the admin screen for this extension at mysite.org/civicrm/phonevalidator.

Help appreciated.

Answer 1

I think the remark is for the installation of extensions. You are accessing the admin screen WITHIN the extension. You then rely solely on what the developer has checked within the extension, and apparently there is no permission checking in the extension. So you would have to add that if that is required?

Answer 2

I might be necro-ing a thread here, but it got my attention because the person who wrote this extension used to be my manager. The (indeed underlying CMS) permission required to access an extension page would be found in xml/Menu/phonevalidator.xml under the extension directory. You might want to investigate hook_civicrm_permission, and/or change the permission in said XML file.