2

Cool little extension. I am about to trial it on a site. I'm new to extensions so am trying to work out how this is permissioned. On the wiki I see "At this time, permissions for extensions are not influenced by CiviCRM's ACL system so we need to rely on the underlying permissions of the CMS to allow or deny access to an extensions pages." I can't find any info on the specific extension page/post but from the wiki it seems like extensions are usable by anyone with the 'administer CiviCRM' permission and/or 'access Contact Dashboard'. BUT, I'm masquerading as a user with neither of these permissions, and I can still access the admin screen for this extension at mysite.org/civicrm/phonevalidator.

Help appreciated.

2 Answers 2

2

I think the remark is for the installation of extensions. You are accessing the admin screen WITHIN the extension. You then rely solely on what the developer has checked within the extension, and apparently there is no permission checking in the extension. So you would have to add that if that is required?

2
  • Thanks Erik. That makes sense. I'll look in to what it would involve to add these permissions and make a decision.
    – Katy J
    Commented Apr 28, 2015 at 11:03
  • You would probably have to develop/customize the extension, add a CiviCRM permission and validate it @KatyJ. Let me know if you want it bad enough to need a helping hand :-) Commented Apr 28, 2015 at 11:29
0

I might be necro-ing a thread here, but it got my attention because the person who wrote this extension used to be my manager. The (indeed underlying CMS) permission required to access an extension page would be found in xml/Menu/phonevalidator.xml under the extension directory. You might want to investigate hook_civicrm_permission, and/or change the permission in said XML file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.