Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Standalone: Fix ACL help/links, tweak Users and Permissions menu #27119

Merged
merged 1 commit into from Aug 24, 2023
Merged

Standalone: Fix ACL help/links, tweak Users and Permissions menu #27119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion CRM/Utils/System/Standalone.php
View file
Open in desktop
Expand Up @@ -574,7 +574,7 @@ public function languageNegotiationURL($url, $addLanguagePart = TRUE, $removeLan
*/
public function getCMSPermissionsUrlParams() {
if ($this->missingStandaloneExtension()) {
return ['ufAccessURL' => '/fixme/standalone/permissions/url/params'];
return ['ufAccessURL' => '/civicrm/admin/roles'];
}
return Security::singleton()->getCMSPermissionsUrlParams();
}
Expand Down
2 changes: 1 addition & 1 deletion ext/standaloneusers/Civi/Standalone/Security.php
View file
Open in desktop
Expand Up @@ -295,7 +295,7 @@ public function languageNegotiationURL($url, $addLanguagePart = TRUE, $removeLan
* @return array
*/
public function getCMSPermissionsUrlParams() {
return ['ufAccessURL' => '/fixme/standalone/permissions/url/params'];
return ['ufAccessURL' => '/civicrm/admin/roles'];
}

/**
Expand Down
4 changes: 2 additions & 2 deletions ext/standaloneusers/ang/afsearchAdministerUserAccounts.aff.json
View file
Open in desktop
Expand Up @@ -16,8 +16,8 @@
"redirect": null,
"create_submission": false,
"navigation": {
"parent": "Administer",
"label": "Administer User Accounts",
"parent": "Users and Permissions",
"label": "User Accounts",
"weight": 0
}
}
2 changes: 1 addition & 1 deletion ext/standaloneusers/ang/afsearchUserRoles.aff.json
View file
Open in desktop
Expand Up @@ -6,7 +6,7 @@
"server_route": "civicrm/admin/roles",
"permission": "cms:administer users",
"navigation": {
"parent": "Administer",
"parent": "Users and Permissions",
"label": "User Roles",
"weight": 0
},
Expand Down
57 changes: 32 additions & 25 deletions templates/CRM/Admin/Page/Access.tpl
View file
Open in desktop
Expand Up @@ -10,29 +10,36 @@
{capture assign=docUrlText}{ts}Access Control Documentation{/ts}{/capture}
{capture assign=docLink}{docURL page="user/initial-set-up/permissions-and-access-control/" text=$docUrlText}{/capture}
<div class="help">
<p>{ts 1=$docLink}ACLs (Access Control Lists) allow you control access to CiviCRM data. An ACL consists of an <strong>Operation</strong> (e.g. 'View' or 'Edit'), a <strong>set of Data</strong> that the operation can be performed on (e.g. a group of contacts), and a <strong>Role</strong> that has permission to do this operation. Refer to the %1 for more info.{/ts}
{if $config->userSystem->is_drupal EQ '1'}{ts}Note that a CiviCRM ACL Role is not related to the Drupal Role.{/ts}{/if}</p>
<p>{ts}<strong>EXAMPLE:</strong> 'Team Leaders' (<em>ACL Role</em>) can 'Edit' (<em>Operation</em>) all contacts in the 'Active Volunteers Group' (<em>Data</em>).{/ts}</p>
<p>{ts 1=$ufAccessURL|smarty:nodefaults 2=$jAccessParams 3=$config->userFramework}Use <a href='%1' %2>%3 Access Control</a> to manage basic access to CiviCRM components and menu items. Use CiviCRM ACLs to control access to specific CiviCRM contact groups. You can also configure ACLs to grant or deny access to specific Events, Profiles, and/or Custom Data Fields.{/ts}</p>
<p>{ts 1=$config->userFramework}Note that %1 Access Control permissions take precedence over CiviCRM ACLs. If you wish to use CiviCRM ACLs, first disable the related permission in %1 Access control for a user role, and then gradually add ACLs to replace that permission for certain groups of contacts.{/ts}
<p>{ts 1=$docLink}ACLs (Access Control Lists) allow you control access to CiviCRM data. An ACL consists of an <strong>Operation</strong> (e.g. 'View' or 'Edit'), a <strong>set of Data</strong> that the operation can be performed on (e.g. a group of contacts), and a <strong>Role</strong> that has permission to do this operation. Refer to the %1 for more info.{/ts}
{if $config->userSystem->is_drupal EQ '1'}{ts}Note that a CiviCRM ACL Role is not related to the Drupal Role.{/ts}{/if}</p>
<p>{ts}<strong>EXAMPLE:</strong> 'Team Leaders' (<em>ACL Role</em>) can 'Edit' (<em>Operation</em>) all contacts in the 'Active Volunteers Group' (<em>Data</em>).{/ts}</p>
<p>{ts}CiviCRM ACLs can control access to specific CiviCRM contact groups. You can also configure ACLs to grant or deny access to specific Events, Profiles or Custom Data Fields.{/ts}</p>
{if $config->userFramework == 'Standalone'}
<p>{ts 1=$ufAccessURL|smarty:nodefaults}Note that <a href="%1">User Role</a> permissions take precedence over CiviCRM ACLs. If you wish to use CiviCRM ACLs, first disable the related permission in User Roles, and then gradually add ACLs to replace that permission for certain groups of contacts.{/ts}
{else}
<p>{ts 1=$ufAccessURL|smarty:nodefaults 2=$jAccessParams 3=$config->userFramework}Note that <a href='%1' %2>%3 permissions</a> take precedence over CiviCRM ACLs. If you wish to use CiviCRM ACLs, first disable the related permission in %3 for a user role, and then gradually add ACLs to replace that permission for certain groups of contacts.{/ts}
{/if}
</div>

<table class="report">
<tr>
<td class="nowrap"><a href="{$ufAccessURL|smarty:nodefaults}" {$jAccessParams} id="adminAccess"><i class="crm-i fa-chevron-right fa-fw" aria-hidden="true"></i> {ts 1=$config->userFramework}%1 Access Control{/ts}</a></td>
<td>{ts}Grant access to CiviCRM components and other CiviCRM permissions.{/ts}</td>
</tr>
<tr><td colspan="2" class="separator"><strong>{ts}Use following steps if you need to control View and/or Edit permissions for specific contact groups, specific profiles or specific custom data fields.{/ts}</strong></td></tr>
<tr>
<td class="nowrap"><a href="{crmURL p='civicrm/admin/options/acl_role' q="reset=1"}" id="editACLRoles"><i class="crm-i fa-users fa-fw" aria-hidden="true"></i> {ts}1. Manage Roles{/ts}</a></td>
<td>{ts}Each CiviCRM ACL Role is assigned a set of permissions. Use this link to create or edit the different roles needed for your site.{/ts}</td>
</tr>
<tr>
<td class="nowrap"><a href="{crmURL p='civicrm/acl/entityrole' q="reset=1"}" id="editRoleAssignments"><i class="crm-i fa-user-plus fa-fw" aria-hidden="true"></i> {ts}2. Assign Users to CiviCRM ACL Roles{/ts}</a></td>
<td>{ts}Once you have defined CiviCRM ACL Roles and granted ACLs to those Roles, use this link to assign users to role(s).{/ts}</td>
</tr>
<tr>
<td class="nowrap"><a href="{crmURL p='civicrm/acl' q="reset=1"}" id="editACLs"><i class="crm-i fa-id-card-o fa-fw" aria-hidden="true"></i> {ts}3. Manage ACLs{/ts}</a></td>
<td>{ts}ACLs define permission to do an operation on a set of data, and grant that permission to a CiviCRM ACL Role. Use this link to create or edit the ACLs for your site.{/ts}</td>
</tr>
</table>
<table class="report">
<tr>
{if $config->userFramework == 'Standalone'}
<td class="nowrap"><a href="{$ufAccessURL|smarty:nodefaults}" id="adminAccess"><i class="crm-i fa-chevron-right fa-fw" aria-hidden="true"></i>{ts}User Roles{/ts}</a></td>
{else}
<td class="nowrap"><a href="{$ufAccessURL|smarty:nodefaults}" {$jAccessParams} id="adminAccess"><i class="crm-i fa-chevron-right fa-fw" aria-hidden="true"></i> {ts 1=$config->userFramework}%1 Permissions{/ts}</a></td>
{/if}
<td>{ts}Grant access to CiviCRM components and other CiviCRM permissions.{/ts}</td>
</tr>
<tr><td colspan="2" class="separator"><strong>{ts}Use following steps if you need to control View and/or Edit permissions for specific contact groups, specific profiles or specific custom data fields.{/ts}</strong></td></tr>
<tr>
<td class="nowrap"><a href="{crmURL p='civicrm/admin/options/acl_role' q="reset=1"}" id="editACLRoles"><i class="crm-i fa-users fa-fw" aria-hidden="true"></i> {ts}1. Manage Roles{/ts}</a></td>
<td>{ts}Each CiviCRM ACL Role is assigned a set of permissions. Use this link to create or edit the different roles needed for your site.{/ts}</td>
</tr>
<tr>
<td class="nowrap"><a href="{crmURL p='civicrm/acl/entityrole' q="reset=1"}" id="editRoleAssignments"><i class="crm-i fa-user-plus fa-fw" aria-hidden="true"></i> {ts}2. Assign Users to CiviCRM ACL Roles{/ts}</a></td>
<td>{ts}Once you have defined CiviCRM ACL Roles and granted ACLs to those Roles, use this link to assign users to role(s).{/ts}</td>
</tr>
<tr>
<td class="nowrap"><a href="{crmURL p='civicrm/acl' q="reset=1"}" id="editACLs"><i class="crm-i fa-id-card-o fa-fw" aria-hidden="true"></i> {ts}3. Manage ACLs{/ts}</a></td>
<td>{ts}ACLs define permission to do an operation on a set of data, and grant that permission to a CiviCRM ACL Role. Use this link to create or edit the ACLs for your site.{/ts}</td>
</tr>
</table>
4 changes: 2 additions & 2 deletions xml/templates/civicrm_navigation.tpl
View file
Open in desktop
Expand Up @@ -344,8 +344,8 @@ SET @usersPermslastID:=LAST_INSERT_ID();
INSERT INTO civicrm_navigation
( domain_id, url, label, name, permission, permission_operator, parent_id, is_active, has_separator, weight )
VALUES
( @domainID, 'civicrm/admin/access?reset=1', '{ts escape="sql" skip="true"}Permissions (Access Control){/ts}', 'Permissions (Access Control)', 'administer CiviCRM', '', @usersPermslastID, '1', NULL, 1 ),
( @domainID, 'civicrm/admin/synchUser?reset=1', '{ts escape="sql" skip="true"}Synchronize Users to Contacts{/ts}', 'Synchronize Users to Contacts', 'administer CiviCRM', '', @usersPermslastID, '1', NULL, 2 );
( @domainID, 'civicrm/admin/access?reset=1', '{ts escape="sql" skip="true"}Access Control Lists{/ts}', 'Permissions (Access Control)', 'administer CiviCRM', '', @usersPermslastID, '1', NULL, 5 ),
( @domainID, 'civicrm/admin/synchUser?reset=1', '{ts escape="sql" skip="true"}Synchronize Users to Contacts{/ts}', 'Synchronize Users to Contacts', 'administer CiviCRM', '', @usersPermslastID, '1', NULL, 10 );

INSERT INTO civicrm_navigation
( domain_id, url, label, name, permission, permission_operator, parent_id, is_active, has_separator, weight )
Expand Down