Details
-
Type: Bug
-
Status: Done/Fixed
-
Priority: Critical
-
Resolution: Fixed/Completed
-
Affects Version/s: 4.7.6
-
Fix Version/s: 4.7.7
-
Component/s: CiviCase, CiviCRM API, Core CiviCRM
-
Labels:
-
Documentation Required?:None
-
Funding Source:Needs Funding
Description
This is related to CRM-18309 (and thus CRM-17645), but is much more serious, so I'm giving it its own issue.
This can't be replicated on the demo server because it requires access to CMS permissions, but I replicated it on a clean install of dmaster using civibuildkit.
Steps to replicate:
- Remove all CiviCase permissions from a role (I used Administrator).
- Leave CiviCase enabled.
- Log in with a user with that role who is NOT Drupal user 1 (user 1 has all permissions regardless of role)
- Visit the Activities tab of any contact with at least one activity.
You'll see the error:
DataTables warning: table id=DataTables_Table_0 - Invalid JSON response. For more information about this error, please see http://datatables.net/tn/1
The root cause is the same as CRM-18309: The AJAX for DataTables is returning the error: "API permission check failed for Case/getcount call; insufficient permission: require Array". However, the fix I posted there does NOT work here. This confirms my belief that this needs fixing at a lower level.
Workarounds:
- Grant the CiviCase permissions to all roles.
- Disable CiviCase.
Aggravating factors:
- "CiviCase enabled without giving everyone all permissions" is a very common configuration. Especially since new CiviCRM downloaders seem to enable all components.
- This is a recent regression - I tested and confirmed that this problem doesn't exist in 4.7.4.
- Activity tab is more prominent than Option Values, which
CRM-18309deals with.
Attachments
Issue Links
- is supplemented by
-
CRM-18309 CRM-17645 breaks viewing Option Groups in some cases
- Done/Fixed
- links to