Answers.Body: <p>You should look at the comment by cividesk, and make sure that if you uncheck the setting on Evan's relationship record to be able to edit the spouse contact, that Evan can't edit the spouse record.  If that works as expected then:</p>
  
  <p>Discussed this issue with CiviCRM Security Team.  The consensus is that this is not a bug, more like a feature, or one way to look at it is that CiviCRM is just flexible/configurable in this manner. If you don't want to have the contact be able to their spouse from that form you either need to not enable the setting on the contact's relationship record to allow editing, or possibly use ACLs(Access Control Lists) or some custom code in an extension to modify this behavior. </p>
  
  <p>Also as a side note, the permissions "edit my contact" and "view my contact" when enabled for a Drupal user role can cause performance issues in installations with large numbers of contacts.  </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-27T00:07:07.447Z
Answers.Text: It still doesn't make sense to me that there is either the option to edit the contact with full edit capability of all fields including all tags or nothing at all. Seems to me that one should be able to view relatives without necessarily editing especially since one is able to do view his own contact without edit capability. In addition, there are 2 links to edit the contact one as seen on the dashboard screenshot "edit contact info" which allows you to update basic info without seeing all the org's tags and you can click on the name to have full edit access as seen in image above.
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-27T00:07:43.587Z
Answers.Text: I'm happy to give you a login to my demo instance for you to take a look for yourself if you'd like
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-27T01:28:56.163Z
Answers.Text: yeah I'm not doubting you or necessarily disagreeing.  Its more like that it is what it currently is, some other people who contributed code to make what is there just happened to think the current way is the way it should be. Sometimes the line between "bug" and "feature" is a bit fuzzy and grey, and depends on your perspective. You can raise a issue at issues.civicrm.org , and make a PR against https://github.com/civicrm/civicrm-core/tree/4.6 for community evaluation. Its an open source community, and debates of this nature are a daily occurrence.
Answers.UserDisplayName: jackrabbithanna
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-27T06:30:06.433Z
Answers.Text: I see. I guess I will stick to Drupal Views and Webforms for now.
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-02-24T20:42:04.787Z
Answers.Text: Views and Webforms are always a good idea....CivICRM Entity lets developers write custom access handlers for Drupal based view pages of CiviCRM data, see civicrm_entity.api.php for hook documentation
Answers.UserDisplayName: jackrabbithanna
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-25T18:02:55.837Z
Answers.LastActivityDate: 2017-01-25T18:02:55.837Z
Answers.UserDisplayName: jackrabbithanna
Body: <p>I am currently testing the dashboard feature before enabling it on a production site. 
  There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and not "Edit my contact" is able to <strong>Edit</strong> a relative's contact (for which he has Dashboard access) even though he can only <strong>View</strong> his own contact.</p>
  
  <p>Can someone confirm that this isn't only on my installation? I cannot test this on the Demo site as there is no access to Drupal. </p>
  
  <p>Permissions<a href="https://i.sstatic.net/UuBIH.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/UuBIH.png" alt="Permissions"></a> User's Dashboard<a href="https://i.sstatic.net/1E7at.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/1E7at.png" alt="Contact&#39;s Dashboard"></a> User's CiviCRM Profile<a href="https://i.sstatic.net/4ZPzG.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/4ZPzG.png" alt="Contact&#39;s own profile"></a>The Spouse's Profile<a href="https://i.sstatic.net/TUDbh.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/TUDbh.png" alt="Spouse&#39;s Profile"></a>Spouse's Profile Edit Screen<a href="https://i.sstatic.net/UXzcm.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/UXzcm.png" alt="Edit Spouse&#39;s Profile"></a></p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-24T02:09:29.877Z
Comments.Text: Does the contact have a relationship to the spouse, and on that relationship settings does the contact have A to B edit permissions?
Comments.UserDisplayName: jackrabbithanna
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-24T02:23:07.393Z
Comments.Text: Yes, Mr. I'm testing can view and update information about Evan Andrews. However, in the CMS permissions a user cannot edit their contacts
Comments.UserDisplayName: Yossi
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-24T04:06:20.283Z
Comments.Text: If Mr. Testing has a relationship that connects him to Evan, and that relationship has an option to allow the contact special permission to edit the spouse. If you have the relationship on the Mr Testing contact and edit that relationship and the checkbox to allow to edit Evan is NOT checked, then it would definitely be a bug.  The whole point of that relationship option is to sometimes allow a contact to edit their spouses record. Go to the relationship tab of Mr. Testing, edit the spousal relationship, and put a screenshot up here. Also what other CiviCRM permissions does the auth user have
Comments.UserDisplayName: jackrabbithanna
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-24T04:18:04.680Z
Comments.Text: @jackrabbithanna, that would make sense if in the CMS permissions Mr. Testing had the permission to "edit my contacts" but he does not and that is why he cannot edit his own contact. It doesn't make sense to be able to edit the spouse's contact but not his own...
  The permission in relationship screen is indeed enabled and that is why you can see the spouse in the dashboard, otherwise Evan wouldn't be visible
Comments.UserDisplayName: Yossi
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-24T13:35:39.640Z
Comments.Text: There is no "edit my contacts" permission, only "edit my contact" . The behavior you describe makes sense to me, but I wonder if this is a change in behavior from earlier versions?
Comments.UserDisplayName: jackrabbithanna
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-24T18:02:19.473Z
Comments.Text: @YossiCrm - if you uncheck the permission to edit the spouse in the relationship, can the contact still edit the spouse?
Comments.UserDisplayName: cividesk
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-25T18:49:40.407Z
Comments.Text: @cividesk, No he cannot but he can't either see the contact. It doesn't seem right that he can either edit the related contact or not see it... There are 2 ways to edit the related contact. One by clicking on the name and the other to click "edit contact info" (see 2nd screenshot). the latter option is more concise and allows only for editing basic info rather than being able to see all fields and tags...
Comments.UserDisplayName: Yossi
Tags: <dashboard><security>
Title: Security Vulnerability in Dashboard CiviCRM 4.6 for Drupal 7
ThreadText: # Security Vulnerability in Dashboard CiviCRM 4.6 for Drupal 7
  
  (Asked by: username_0 on 2017-01-23)
  
  I am currently testing the dashboard feature before enabling it on a production site.
  There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and not "Edit my contact" is able to **Edit** a relative's contact (for which he has Dashboard access) even though he can only **View** his own contact.
  
  Can someone confirm that this isn't only on my installation? I cannot test this on the Demo site as there is no access to Drupal.
  
  Permissions[![Permissions](https://i.sstatic.net/UuBIH.png)](https://i.sstatic.net/UuBIH.png) User's Dashboard[![Contact's Dashboard](https://i.sstatic.net/1E7at.png)](https://i.sstatic.net/1E7at.png) User's CiviCRM Profile[![Contact's own profile](https://i.sstatic.net/4ZPzG.png)](https://i.sstatic.net/4ZPzG.png)The Spouse's Profile[![Spouse's Profile](https://i.sstatic.net/TUDbh.png)](https://i.sstatic.net/TUDbh.png)Spouse's Profile Edit Screen[![Edit Spouse's Profile](https://i.sstatic.net/UXzcm.png)](https://i.sstatic.net/UXzcm.png)
  
  **Tags:** dashboard, security
  
  > **Comments:**
  > **username_1**: Does the contact have a relationship to the spouse, and on that relationship settings does the contact have A to B edit permissions?  
  > **username_0**: Yes, Mr. I'm testing can view and update information about Evan Andrews. However, in the CMS permissions a user cannot edit their contacts  
  > **username_1**: If Mr. Testing has a relationship that connects him to Evan, and that relationship has an option to allow the contact special permission to edit the spouse. If you have the relationship on the Mr Testing contact and edit that relationship and the checkbox to allow to edit Evan is NOT checked, then it would definitely be a bug.  The whole point of that relationship option is to sometimes allow a contact to edit their spouses record. Go to the relationship tab of Mr. Testing, edit the spousal relationship, and put a screenshot up here. Also what other CiviCRM permissions does the auth user have  
  > **username_0**: @username_1, that would make sense if in the CMS permissions Mr. Testing had the permission to "edit my contacts" but he does not and that is why he cannot edit his own contact. It doesn't make sense to be able to edit the spouse's contact but not his own... The permission in relationship screen is indeed enabled and that is why you can see the spouse in the dashboard, otherwise Evan wouldn't be visible  
  > **username_1**: There is no "edit my contacts" permission, only "edit my contact" . The behavior you describe makes sense to me, but I wonder if this is a change in behavior from earlier versions?  
  > **username_2**: @YossiCrm - if you uncheck the permission to edit the spouse in the relationship, can the contact still edit the spouse?  
  > **username_0**: @username_2, No he cannot but he can't either see the contact. It doesn't seem right that he can either edit the related contact or not see it... There are 2 ways to edit the related contact. One by clicking on the name and the other to click "edit contact info" (see 2nd screenshot). the latter option is more concise and allows only for editing basic info rather than being able to see all fields and tags...  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-01-25. Score: 1
  
  You should look at the comment by username_2, and make sure that if you uncheck the setting on Evan's relationship record to be able to edit the spouse contact, that Evan can't edit the spouse record. If that works as expected then:
  
  Discussed this issue with CiviCRM Security Team. The consensus is that this is not a bug, more like a feature, or one way to look at it is that CiviCRM is just flexible/configurable in this manner. If you don't want to have the contact be able to their spouse from that form you either need to not enable the setting on the contact's relationship record to allow editing, or possibly use ACLs(Access Control Lists) or some custom code in an extension to modify this behavior.
  
  Also as a side note, the permissions "edit my contact" and "view my contact" when enabled for a Drupal user role can cause performance issues in installations with large numbers of contacts.
  
  > **Comments:**
  > **username_0**: It still doesn't make sense to me that there is either the option to edit the contact with full edit capability of all fields including all tags or nothing at all. Seems to me that one should be able to view relatives without necessarily editing especially since one is able to do view his own contact without edit capability. In addition, there are 2 links to edit the contact one as seen on the dashboard screenshot "edit contact info" which allows you to update basic info without seeing all the org's tags and you can click on the name to have full edit access as seen in image above.  
  > **username_0**: I'm happy to give you a login to my demo instance for you to take a look for yourself if you'd like  
  > **username_1**: yeah I'm not doubting you or necessarily disagreeing.  Its more like that it is what it currently is, some other people who contributed code to make what is there just happened to think the current way is the way it should be. Sometimes the line between "bug" and "feature" is a bit fuzzy and grey, and depends on your perspective. You can raise a issue at issues.civicrm.org , and make a PR against https://github.com/civicrm/civicrm-core/tree/4.6 for community evaluation. Its an open source community, and debates of this nature are a daily occurrence.  
  > **username_0**: I see. I guess I will stick to Drupal Views and Webforms for now.  
  > **username_1**: Views and Webforms are always a good idea....CivICRM Entity lets developers write custom access handlers for Drupal based view pages of CiviCRM data, see civicrm_entity.api.php for hook documentation  
  
  ---
  
  