Answers.Body: <p>I think the remark is for the installation of extensions. You are accessing the admin screen WITHIN the extension. You then rely solely on what the developer has checked within the extension, and apparently there is no permission checking in the extension. So you would have to add that if that is required?</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-28T11:03:02.197Z
Answers.Text: Thanks Erik. That makes sense. I'll look in to what it would involve to add these permissions and make a decision.
Answers.UserDisplayName: Katy J
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-28T11:29:44.730Z
Answers.Text: You would probably have to develop/customize the extension, add a CiviCRM permission and validate it @KatyJ. Let me know if you want it bad enough to need a helping hand :-)
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-23T12:39:42.103Z
Answers.LastActivityDate: 2015-04-23T12:39:42.103Z
Answers.UserDisplayName: ErikH - CiviCooP
Answers.Body: <p>I might be necro-ing a thread here, but it got my attention because the person who wrote this extension used to be my manager. The (indeed underlying CMS) permission required to access an extension page would be found in <code>xml/Menu/phonevalidator.xml</code> under the extension directory. You might want to investigate <code>hook_civicrm_permission</code>, and/or change the permission in said XML file.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-07-14T13:29:06.547Z
Answers.LastActivityDate: 2015-07-14T13:29:06.547Z
Answers.UserDisplayName: DaveFF
Body: <p>Cool little extension. I am about to trial it on a site. I'm new to extensions so am trying to work out how this is permissioned. On the wiki I see "At this time, permissions for extensions are not influenced by CiviCRM's ACL system so we need to rely on the underlying permissions of the CMS to allow or deny access to an extensions pages." I can't find any info on the specific extension page/post but from the wiki it seems like extensions are usable by anyone with the 'administer CiviCRM' permission and/or 'access Contact Dashboard'. BUT, I'm masquerading as a user with neither of these permissions, and I can still access the admin screen for this extension at mysite.org/civicrm/phonevalidator.</p>
  
  <p>Help appreciated. </p>
  
Tags: <extension><permissions>
Title: Extension: UK Phone Number Validator - permissions
ThreadText: # Extension: UK Phone Number Validator - permissions
  
  (Asked by: username_0 on 2015-04-23)
  
  Cool little extension. I am about to trial it on a site. I'm new to extensions so am trying to work out how this is permissioned. On the wiki I see "At this time, permissions for extensions are not influenced by CiviCRM's ACL system so we need to rely on the underlying permissions of the CMS to allow or deny access to an extensions pages." I can't find any info on the specific extension page/post but from the wiki it seems like extensions are usable by anyone with the 'administer CiviCRM' permission and/or 'access Contact Dashboard'. BUT, I'm masquerading as a user with neither of these permissions, and I can still access the admin screen for this extension at mysite.org/civicrm/phonevalidator.
  
  Help appreciated.
  
  **Tags:** extension, permissions
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-04-23. Score: 2
  
  I think the remark is for the installation of extensions. You are accessing the admin screen WITHIN the extension. You then rely solely on what the developer has checked within the extension, and apparently there is no permission checking in the extension. So you would have to add that if that is required?
  
  > **Comments:**
  > **username_0**: Thanks Erik. That makes sense. I'll look in to what it would involve to add these permissions and make a decision.  
  > **username_1**: You would probably have to develop/customize the extension, add a CiviCRM permission and validate it @username_0. Let me know if you want it bad enough to need a helping hand :-)  
  
  ---
  
  ### Answer by username_2 on 2015-07-14. Score: 0
  
  I might be necro-ing a thread here, but it got my attention because the person who wrote this extension used to be my manager. The (indeed underlying CMS) permission required to access an extension page would be found in `xml/Menu/phonevalidator.xml` under the extension directory. You might want to investigate `hook_civicrm_permission`, and/or change the permission in said XML file.
  
  
  ---
  
  