Answers.Body: <p>I've taken a look in the code, and it looks like CiviVisualise/Civisualise/Civivisualise the missing CiviCRM visualisation extension (:P :P :P) uses direct SQL commands, meaning that certain CRM features such as ACL checks would be bypassed.</p>
  
  <p>This would need changing at a code level, I'm sure Xavier would love to hear from you.</p>
  
  <p>JohnFF</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-29T17:18:39.003Z
Answers.LastActivityDate: 2017-03-29T17:18:39.003Z
Answers.UserDisplayName: JohnFF
Answers.Body: <p>We kinda got around this by adding some permissions to civizualise.xml:</p>
  
  <p><code>&lt;access_arguments&gt;access CiviCRM, view all contacts&lt;/access_arguments&gt;</code></p>
  
  <p>Not as good as the proper ACLs, but works ok. As JohnFF says, civizualise uses direct SQL so I imagine ACLs wouldn't be an easy thing to add.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-31T10:21:31.827Z
Answers.LastActivityDate: 2017-03-31T12:38:43.163Z
Answers.LastEditDate: 2017-03-31T12:38:43.163Z
Answers.UserDisplayName: Andrew West
Body: <p>We are using CiviCRM 4.6 with Drupal 7.  We have <a href="https://civicrm.org/extensions/civisualize-missing-data-visualization-extension" rel="nofollow noreferrer">CiviVisualize</a> 1.42 installed and think it's pretty great.  We just found a wrinkle though and wondered if the issue is with the extension or our (lack of) setup.</p>
  
  <p>We have a few Drupal roles that do not have access to CiviContribute.  Yet when those users navigate to the CiviVisualize section (oursite.org/civicrm/dataviz) they are able to see the CiviContribute section at /civicrm/dataviz/contribute and the Donor Trends (with specific donor names!) at /civicrm/dataviz/donortrends.</p>
  
  <p>I don't see any CiviVisualize permissions in our Drupal permission list and I can't think of how Civi permissions (ACLs) would/could impact the extension's permissions.  I also don't see a CiviVisualize setup page within Civi that might have settings for permissions.</p>
  
  <p>Any ideas?  Does CiviVisualize follow permissions from the CMS and I'm just not seeing how to set it up, or would we need to do something different to get CiviVisualize to respect our permissions?  Thanks for the help!</p>
  
Tags: <extension><permissions>
Title: CiviVisualize and permissions
ThreadText: # CiviVisualize and permissions
  
  (Asked by: username_0 on 2017-03-29)
  
  We are using CiviCRM 4.6 with Drupal 7. We have [CiviVisualize](https://civicrm.org/extensions/civisualize-missing-data-visualization-extension) 1.42 installed and think it's pretty great. We just found a wrinkle though and wondered if the issue is with the extension or our (lack of) setup.
  
  We have a few Drupal roles that do not have access to CiviContribute. Yet when those users navigate to the CiviVisualize section (oursite.org/civicrm/dataviz) they are able to see the CiviContribute section at /civicrm/dataviz/contribute and the Donor Trends (with specific donor names!) at /civicrm/dataviz/donortrends.
  
  I don't see any CiviVisualize permissions in our Drupal permission list and I can't think of how Civi permissions (ACLs) would/could impact the extension's permissions. I also don't see a CiviVisualize setup page within Civi that might have settings for permissions.
  
  Any ideas? Does CiviVisualize follow permissions from the CMS and I'm just not seeing how to set it up, or would we need to do something different to get CiviVisualize to respect our permissions? Thanks for the help!
  
  **Tags:** extension, permissions
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-03-29. Score: 1 | Accepted answer
  
  I've taken a look in the code, and it looks like CiviVisualise/Civisualise/Civivisualise the missing CiviCRM visualisation extension (:P :P :P) uses direct SQL commands, meaning that certain CRM features such as ACL checks would be bypassed.
  
  This would need changing at a code level, I'm sure Xavier would love to hear from you.
  
  username_1
  
  
  ---
  
  ### Answer by username_2 on 2017-03-31. Score: 0
  
  We kinda got around this by adding some permissions to civizualise.xml:
  
  `<access_arguments>access CiviCRM, view all contacts</access_arguments>`
  
  Not as good as the proper ACLs, but works ok. As username_1 says, civizualise uses direct SQL so I imagine ACLs wouldn't be an easy thing to add.
  
  
  ---
  
  