Details
-
Type: Improvement
-
Status: Done/Fixed
-
Priority: Trivial
-
Resolution: Duplicate
-
Affects Version/s: 4.4.5
-
Fix Version/s: Unscheduled
-
Component/s: CiviCRM API, Core CiviCRM
-
Labels:
-
Documentation Required?:None
-
Funding Source:Needs Funding
Description
Currently the CiviCRM API requires the "Manage CiviCRM" permission in Drupal in order for a user to be able to retrieve Price Sets, Price Fields and Price Field Values. I think "Manage CiviCRM" should be assignable to Admins only so curious people don't change core system settings.
Permissions should be more fine grained for Price Sets and allow eg. a non-admin (in our case board and staff members) to both manage and/or retrieve Price Sets.
I have not yet looked into a solution for this, I believe it may be trivial.