Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-19113

Merge data loss on custom data when permissions are in play

    Details

    • Type: Bug
    • Status: Done/Fixed
    • Priority: Critical
    • Resolution: Fixed/Completed
    • Affects Version/s: 4.7.9
    • Fix Version/s: 4.7.11
    • Component/s: Dedupe
    • Documentation Required?:
      None
    • Funding Source:
      Contributed Code

      Description

      Custom data is lost when merging under the following conditions

      1) the contact being retained already has a row in the table for the custom data group
      2) the batch merge api is called with 'check_permissions' where there is no logged in contact or the logged in contact does not have view all custom data.

      The value that is being transferred across is lost because the user does not have permission to write to that custom data field. While my focus is on the batch merge without a logged in user or less permissioned user (under custom script) this probably also affects custom data that cannot be seen by the logged in user (but should not be discarded). I replicated the api batch merge variant in a unit test. It's important to note that if the contact being retained does NOT have a row in the custom value table the bug is bypassed by the code that moves referenced rows over.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                eileen Eileen McNaughton
                Reporter:
                eileen Eileen McNaughton
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: