Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-13920

view case with my cases permission flawed

    Details

    • Type: Bug
    • Status: Done/Fixed
    • Priority: Major
    • Resolution: Fixed/Completed
    • Affects Version/s: 4.4.3
    • Fix Version/s: 4.4.4
    • Component/s: CiviCase
    • Labels:
      None

      Description

      1) create a new case and make contact A the case manager. make sure the case only has the completed open case activity.
      2) give contact/user A a role with the my cases and activities permission – but not the all cases and activities permission
      3) login as contact/user A and view the contact with the case. the case will be listed on the case tab. click manage.

      this triggers a fatal error.

      when we retrieve cases for the user to see if the requested case is one of them, we call CRM_Case_BAO_Case::getCases() which calls CRM_Case_BAO_Case::getCaseActivityQuery(). passed through each of these is the type param – which may be upcoming or recent (in this use it calls the default upcoming).

      but in this case, we shouldn't care if there are recent or upcoming activities in the case. we just need to know if the user is permissioned to access the case.

      I propose we add a new type = "all" to getCaseActivityQuery and then pass that through. I suspect there are other places where we may want to retrieve cases irrespective of the activities.

      I can supply a PR if there's agreement on the solution.

        Attachments

          Activity

            People

            • Assignee:
              dgg David Greenberg
              Reporter:
              lcdweb Brian Shaughnessy
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: