Answers.Body: <p>It depends on the context and the definition of non-admin users. </p>
  
  <p>If, for example, your context is a small organisation with a small number of users I would say it is safe to do so. You could generally agree with each other that everybody is responsible for the events they have created which is usually the case anyway. </p>
  
  <p>But if you have hunderds of users who might edit other events the it might be something which is not really helpfull for your situation. Then you might think about other solutions for creating and managing events because manage own events is missing from the permission settings.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-23T12:55:25.080Z
Answers.LastActivityDate: 2015-04-23T12:55:25.080Z
Answers.UserDisplayName: Jaap Jansma - CiviCooP
Answers.Body: <p>For Drupal 9/10, you need to add an event handler, something like</p>
  <pre><code>function mymodule_entity_type_build(&amp;$entity_info) {
    if (isset($entity_info['civicrm_event'])) {
      $entity_info['civicrm_event']-&gt;setHandlerClass('access', 'Drupal\mymodule\Access\EventAccessControlHandler');
    }
  }
  </code></pre>
  <p>And add a new handler class at <code>src/Access/EventAccessControlHandler.php</code></p>
  <pre><code>&lt;?php
  
  namespace Drupal\mymodule\Access;
  
  use Drupal\civicrm_entity\CivicrmEntityAccessHandler;
  use Drupal\Core\Entity\EntityInterface;
  use Drupal\Core\Session\AccountInterface;
  use Drupal\Core\Access\AccessResult;
  
  class EventAccessControlHandler extends CivicrmEntityAccessHandler {
  
    /**
     * {@inheritdoc}
     */
    protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
      $eventId = $entity-&gt;id();
  
      // Check if this event is created by the logged in user.
      $isOwner = \Civi\Api4\Event::get(FALSE)
        -&gt;addWhere('created_id', '=', 'user_contact_id')
        -&gt;addWhere('id', '=', $eventId)
        -&gt;execute()
        -&gt;count();
      if (!empty($isOwner)) {
        $permissions = ['edit my events']; // New custom permission added in permissions.yml
        return AccessResult::allowedIfHasPermissions($account, $permissions, 'OR');
      }
  
      return parent::checkAccess($entity, $operation, $account);
    }
  
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-03-21T11:32:46.220Z
Answers.LastActivityDate: 2024-03-21T11:32:46.220Z
Answers.UserDisplayName: jitendra - fuzion
Answers.Body: <p>It really depends on your specific circumstance. Do you trust the users that will be editing these events? If not, then No.</p>
  
  <p>If your website has open registration, certainly don't assign that permission to the default Drupal role. It would be helpful to know more about your use case.</p>
  
  <p>If you NEED an "edit own events" permission, it wouldn't be too difficult to create that permission with just a little PHP.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-25T22:25:24.107Z
Answers.Text: (Yikes, hitting 'return' as well as 'shift-return' saves the comment-- that's odd behavior, so I'm editing my comment now with no line breaks (nope, can't edit it 'cause you can only edit for 5 minutes and I'm too slow)), It is a very small set of users (@user3853493), but it does have open registration and is about a politically controversial subject, so someone unfriendly might want to mess around. Sadly, PHP is not one of my strong points, but yes, I would love "just a little PHP" to enable an "edit own event" permission. How might I obtain such code?
Answers.UserDisplayName: webpotato
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-25T22:44:17.187Z
Answers.Text: Oh! And no, not I won't be setting that for the default (anonymous) Drupal user, rather it's for an "autheniticated" Drupal role that we give certain content creation permissions to. But apparently, setting "edit all events" for that role by itself does not do the trick. Yes, a wrench icon appears on the event display page, and clicking that link takes the user to the page where they should be able to edit the event, but without the "Access CiviCRM" permission set for that role, nothing enabling editing the event appears. (cont.)
Answers.UserDisplayName: webpotato
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-25T22:44:48.190Z
Answers.Text: With that permission set for that role, the CiviCRM menu bar appears and, in my case, only "Events" shows on that bar, however, the drop down from that includes:Dashboard
  Find Participants
  Event Reports
  New Event
  Manage Events
  Event Templates
  New Price Set
  Manage Price Sets, I'm not sure how functional all that is, but as you can see, having that little snippet of PHP to allow for "edit own events" would be handy.
Answers.UserDisplayName: webpotato
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-23T13:07:14.120Z
Answers.LastActivityDate: 2015-04-23T13:07:14.120Z
Answers.UserDisplayName: Squishus Tyrannicus
Body: <p>Drupal gives me only one choice in its listing of CiviCRM permissions to assign to a Drupal role related to the editing of CiviEvents, namely "<strong>Edit all events</strong>". I'm nervous assigning this permission and would rather restrict the permission to "<strong>Edit <em>own</em> events</strong>." </p>
  
  <p>Other CiviCRM functions show the normal sequence of permissions which include ones like "Edit own manual batches." Is it safe to assign "Edit all events" to non-admin users?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-15T04:36:58.320Z
Comments.Text: Just wondering if anyone else has developed the code needed to address this issue. I am working with a larger Organization that has many branches and will have MANY events. We definitely want people to be able to manage and edit their own events but not others at all. If someone has worked this out would sure love the help since I don't have the code skills, and this seems like a pretty important permission option.
Comments.UserDisplayName: user6070
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-22T15:10:05.613Z
Comments.Text: That really depends on who the non-admin users are and whether you trust them.
Comments.UserDisplayName: Graham
Tags: <civievent><drupal><permissions>
Title: Is it safe to assign "Edit all events" to non-admin users?
ThreadText: # Is it safe to assign "Edit all events" to non-admin users?
  
  (Asked by: username_0 on 2015-04-22)
  
  Drupal gives me only one choice in its listing of CiviCRM permissions to assign to a Drupal role related to the editing of CiviEvents, namely "**Edit all events**". I'm nervous assigning this permission and would rather restrict the permission to "**Edit *own* events**."
  
  Other CiviCRM functions show the normal sequence of permissions which include ones like "Edit own manual batches." Is it safe to assign "Edit all events" to non-admin users?
  
  **Tags:** civievent, drupal, permissions
  
  > **Comments:**
  > **username_2**: That really depends on who the non-admin users are and whether you trust them.  
  > **username_1**: Just wondering if anyone else has developed the code needed to address this issue. I am working with a larger Organization that has many branches and will have MANY events. We definitely want people to be able to manage and edit their own events but not others at all. If someone has worked this out would sure love the help since I don't have the code skills, and this seems like a pretty important permission option.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_3 on 2015-04-23. Score: 2
  
  It depends on the context and the definition of non-admin users.
  
  If, for example, your context is a small organisation with a small number of users I would say it is safe to do so. You could generally agree with each other that everybody is responsible for the events they have created which is usually the case anyway.
  
  But if you have hunderds of users who might edit other events the it might be something which is not really helpfull for your situation. Then you might think about other solutions for creating and managing events because manage own events is missing from the permission settings.
  
  
  ---
  
  ### Answer by username_4 on 2024-03-21. Score: 2
  
  For Drupal 9/10, you need to add an event handler, something like
  
  ```
  function mymodule_entity_type_build(&$entity_info) {
    if (isset($entity_info['civicrm_event'])) {
      $entity_info['civicrm_event']->setHandlerClass('access', 'Drupal\mymodule\Access\EventAccessControlHandler');
    }
  }
  
  ```
  
  And add a new handler class at `src/Access/EventAccessControlHandler.php`
  
  ```
  <?php
  
  namespace Drupal\mymodule\Access;
  
  use Drupal\civicrm_entity\CivicrmEntityAccessHandler;
  use Drupal\Core\Entity\EntityInterface;
  use Drupal\Core\Session\AccountInterface;
  use Drupal\Core\Access\AccessResult;
  
  class EventAccessControlHandler extends CivicrmEntityAccessHandler {
  
    /**
     * {@inheritdoc}
     */
    protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
      $eventId = $entity->id();
  
      // Check if this event is created by the logged in user.
      $isOwner = \Civi\Api4\Event::get(FALSE)
        ->addWhere('created_id', '=', 'user_contact_id')
        ->addWhere('id', '=', $eventId)
        ->execute()
        ->count();
      if (!empty($isOwner)) {
        $permissions = ['edit my events']; // New custom permission added in permissions.yml
        return AccessResult::allowedIfHasPermissions($account, $permissions, 'OR');
      }
  
      return parent::checkAccess($entity, $operation, $account);
    }
  
  }
  
  ```
  
  
  ---
  
  ### Answer by username_5 on 2015-04-23. Score: 2
  
  It really depends on your specific circumstance. Do you trust the users that will be editing these events? If not, then No.
  
  If your website has open registration, certainly don't assign that permission to the default Drupal role. It would be helpful to know more about your use case.
  
  If you NEED an "edit own events" permission, it wouldn't be too difficult to create that permission with just a little PHP.
  
  > **Comments:**
  > **username_0**: (Yikes, hitting 'return' as well as 'shift-return' saves the comment-- that's odd behavior, so I'm editing my comment now with no line breaks (nope, can't edit it 'cause you can only edit for 5 minutes and I'm too slow)), It is a very small set of users (@user3853493), but it does have open registration and is about a politically controversial subject, so someone unfriendly might want to mess around. Sadly, PHP is not one of my strong points, but yes, I would love "just a little PHP" to enable an "edit own event" permission. How might I obtain such code?  
  > **username_0**: Oh! And no, not I won't be setting that for the default (anonymous) Drupal user, rather it's for an "autheniticated" Drupal role that we give certain content creation permissions to. But apparently, setting "edit all events" for that role by itself does not do the trick. Yes, a wrench icon appears on the event display page, and clicking that link takes the user to the page where they should be able to edit the event, but without the "Access CiviCRM" permission set for that role, nothing enabling editing the event appears. (cont.)  
  > **username_0**: With that permission set for that role, the CiviCRM menu bar appears and, in my case, only "Events" shows on that bar, however, the drop down from that includes:Dashboard Find Participants Event Reports New Event Manage Events Event Templates New Price Set Manage Price Sets, I'm not sure how functional all that is, but as you can see, having that little snippet of PHP to allow for "edit own events" would be handy.  
  
  ---
  
  