Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-4080

User can edit contacts just with "view All Groups" permission

          Details

          • Type: Bug
          • Status: Done/Fixed
          • Priority: Critical
          • Resolution: Cannot Reproduce
          • Affects Version/s: 2.2.0
          • Fix Version/s: 2.2.0
          • Component/s: Core CiviCRM
          • Labels:
            None

            Description

            • A User is only in one Group assigned to only one Role "Group A".
            • "Group A" has only one ACL: "view" / "Group" / "All Groups".
            • In Drupal permissions the User has only "access CiviCRM" and "add contacts"

            Now the user is not only able to view all contacts but to edit them too.

              Attachments

                Activity

                  People

                  • Assignee:
                    lobo Donald A. Lobo
                    Reporter:
                    sokki Till Schmidt
                  • Votes:
                    0 Vote for this issue
                    Watchers:
                    1 Start watching this issue

                    Dates

                    • Created:
                      Updated:
                      Resolved: