Problem/Motivation

I am creating a "member list", where users in a given role can see the other users (and mapped contact entities) on the site in a listing. Therefore I gave the "View any contact" permission to that role.

When users in that role view the listing, they can see the Contact entity fields.
However, fields using "Contact detail" config entity references do not fully show.
For example the Telephones field shows the telephone number, but not the contact detail (e.g. Main, Mobile, Fax, ...).

The phone number itself is a regular field on the crm_contact_method entity, which the user can view (access is delegated to the parent CRM contact).
The detail however is a reference to a config entity that requires admin permission ("administer crm") to view, which I obviously will not give to users in this role.

Proposed resolution

Add access control logic for contact detail config entities.

CommentFileSizeAuthor
#9 After patch.PNG31.9 KBanjuelsaphilip2020
#9 Before patch.PNG25.67 KBanjuelsaphilip2020

Issue fork crm-3571861

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

svendecabooter created an issue. See original summary.

svendecabooter opened merge request !192

svendecabooter’s picture

svendecabooter
he/him
Primary language Dutch
Location Gent
commented
Status: Active » Needs review
svendecabooter’s picture

svendecabooter
he/him
Primary language Dutch
Location Gent
commented
Status: Needs review » Needs work

bluegeek9 made their first commit to this issue’s fork.

bluegeek9 made their first commit to this issue’s fork.

bluegeek9 changed the visibility of the branch 1.0.x to hidden.

svendecabooter’s picture

svendecabooter
he/him
Primary language Dutch
Location Gent
commented
Status: Needs work » Needs review
anjuelsaphilip2020’s picture

anjuelsaphilip2020 commented
Status: Needs review » Reviewed & tested by the community
StatusFileSize
new Before patch.PNG25.67 KB
new After patch.PNG31.9 KB

Hi, I’ve verified and tested MR !192 and applied the patch successfully on CRM 1.0.x-dev. The changes are working as expected.
Following steps I followed:

  1. Created a role with the “View any contact” permission (without granting administer crm).
  2. Created contacts with contact methods (e.g. Telephone) that include contact detail labels (Main / Mobile / Fax).
  3. Viewed the contact listing as a user with the above role.
  4. Observed that the contact detail labels are displayed correctly.

Testing Result: After applying the patch, contact detail labels (Main / Mobile / Fax) are displayed correctly for users with “View any contact” permission, without requiring administer crm access.
Attaching screenshots for reference.
Thanks

bluegeek9’s picture

bluegeek9 commented
Status: Reviewed & tested by the community » Needs work

The average user really only needs viem label access to the Method Details.

Instead of granting view and view label access if the user has 'view any crm contact', or 'view mapped crm contact', could we grant everyone view label access? The other operations would still require "administer crm".

bluegeek9’s picture

bluegeek9 commented
Assigned: Unassigned » bluegeek9
Status: Needs work » Active

bluegeek9 opened merge request !198

bluegeek9 changed the visibility of the branch 3571861-contact-detail-access to hidden.

bluegeek9’s picture

bluegeek9 commented
Assigned: bluegeek9 » Unassigned
Status: Active » Needs review

  • bluegeek9 committed 141c8997 on 1.0.x 
    feat: #3571861 Contact detail access control permissions missing
bluegeek9’s picture

bluegeek9 commented
Status: Needs review » Fixed
//www.flaticon.com/free-icons/thank-you Thank you for your contribution! Your continued support makes this project sustainable.
There are multiple ways to show appreciation for the work contributed to this project including:
  • Triage issues and adding more context to existing issues.
  • Flagging CRM as a favorite on the project page to help others discover it and show your support.
  • Review the Developer Docs for accuracy and clarity.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.