Answers.Body: <p>We ended up using a hook as suggested. Anyone interested in how we did it can take a look at the <a href="https://github.com/systopia/de.boell.civicrm.uimods/blob/a0273fbe9959f71002b14a95e4376d64ee6e2a2b/CRM/Uimods/AdjustPagePermissions.php" rel="nofollow noreferrer">code</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-23T07:26:29.623Z
Answers.LastActivityDate: 2018-05-23T07:26:29.623Z
Answers.UserDisplayName: Fabian
Answers.Body: <p>I don't know an intended way to alter the permissions directly.</p>
  
  <p>However, you can play around with disallowing the simple mailing event reports altogether for unprivledged users and restrict access for users to the regular reports as you need it.</p>
  
  <p><code>SELECT * FROM civicrm_menu where path = 'civicrm/mailing/report/event';</code></p>
  
  <p>e.g. altering <code>access_arguments</code> from <code>a:2:{i:0;a:1:{i:0;s:15:"access CiviMail";}i:1;s:3:"and";}</code> to <code>a:2:{i:0;a:1:{i:0;s:18:"administer CiviCRM";}i:1;s:3:"and";}</code> will only allow admins to view any of the event reports.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T12:58:10.223Z
Answers.Text: Thank's for the feedback. Does that mean that the permission to view those pages is indeed "access CiviMail"?
Answers.UserDisplayName: Fabian
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T13:07:30.013Z
Answers.Text: By default, yes.
Answers.UserDisplayName: Thomas Schüttler
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-04T06:40:12.837Z
Answers.Text: Thank you for the input - will get back to this once I have news.
Answers.UserDisplayName: Fabian
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T12:01:58.483Z
Answers.LastActivityDate: 2018-01-03T12:01:58.483Z
Answers.UserDisplayName: Thomas Schüttler
Answers.Body: <p>I think you can bypass using <a href="https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_permission_check/" rel="nofollow noreferrer">permission_check</a> hook.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T12:53:38.583Z
Answers.Text: Thanks I do not think that works as the documentation says "This hook is implemented for forms (eg Add, Edit) but not yet for reports and viewing of objects like Activities on the Contact Summary page as of 4.7.17"
Answers.UserDisplayName: Fabian
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T13:26:02.303Z
Answers.Text: It does get called on all pages now. I think no one bothered to update the documentation once it was fixed for other pages. Please give a try.
Answers.UserDisplayName: Pradeep Nayak
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T13:26:21.887Z
Answers.Text: That should work, but i think you would lack the context in the hook to distinguish between accessing CiviMail and accessing the event reports in CiviMail.
Answers.UserDisplayName: Thomas Schüttler
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T13:27:37.250Z
Answers.Text: You can use $_REQUEST to check the required parameters.
Answers.UserDisplayName: Pradeep Nayak
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-04T06:40:19.110Z
Answers.Text: Thank you for the input - will get back to this once I have news.
Answers.UserDisplayName: Fabian
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-01-03T12:43:32.157Z
Answers.LastActivityDate: 2018-01-03T12:43:32.157Z
Answers.UserDisplayName: Pradeep Nayak
Body: <p>If one sends out a mailing using CiviCRM, one can access an overview of the mailing's result from the mailings menu (see screenshot). From this summary you will also be able to access more detailed information, including the unique opens (see screenshot).</p>
  
  <p>As this information can be considered quite sensitive in regard to data protection, I would like to restrict access to it to certain users/roles. I tried editing the permissions of all relevant mailing reports I could find.</p>
  
  <p>However, it turns out that this information does not seem to be based on CiviCRM'S report function. Even If restrict user's access to any report functions, the detailed mailing information can still be viewed.</p>
  
  <p>Hence my questions are:</p>
  
  <ul>
  <li>Which permission is actually relevant for opening pages such as
  civicrm/mailing/report/event?reset=1&amp;event=opened&amp;mid=XYZ&amp;distinct=1
  ?</li>
  <li>Is there any way to restrict access to this information without
  denying users to use CiviMail at all?</li>
  </ul>
  
  <p>Tested on CiviCRM 4.7.18 and Drupal 7.54.</p>
  
  <p><a href="https://i.sstatic.net/bhHQj.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/bhHQj.png" alt="Summary Screen"></a>
  <a href="https://i.sstatic.net/0A3rz.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/0A3rz.png" alt="Detailed Information"></a></p>
  
Tags: <civimail><permissions>
Title: How to restrict access to CiviMail's reports, e.g. click rates
ThreadText: # How to restrict access to CiviMail's reports, e.g. click rates
  
  (Asked by: username_0 on 2017-12-14)
  
  If one sends out a mailing using CiviCRM, one can access an overview of the mailing's result from the mailings menu (see screenshot). From this summary you will also be able to access more detailed information, including the unique opens (see screenshot).
  
  As this information can be considered quite sensitive in regard to data protection, I would like to restrict access to it to certain users/roles. I tried editing the permissions of all relevant mailing reports I could find.
  
  However, it turns out that this information does not seem to be based on CiviCRM'S report function. Even If restrict user's access to any report functions, the detailed mailing information can still be viewed.
  
  Hence my questions are:
  
  * Which permission is actually relevant for opening pages such as
    civicrm/mailing/report/event?reset=1&event=opened∣=XYZ&distinct=1
    ?
  * Is there any way to restrict access to this information without
    denying users to use CiviMail at all?
  
  Tested on CiviCRM 4.7.18 and Drupal 7.54.
  
  [![Summary Screen](https://i.sstatic.net/bhHQj.png)](https://i.sstatic.net/bhHQj.png)
  [![Detailed Information](https://i.sstatic.net/0A3rz.png)](https://i.sstatic.net/0A3rz.png)
  
  **Tags:** civimail, permissions
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2018-05-23. Score: 0 | Accepted answer
  
  We ended up using a hook as suggested. Anyone interested in how we did it can take a look at the [code](https://github.com/systopia/de.boell.civicrm.uimods/blob/a0273fbe9959f71002b14a95e4376d64ee6e2a2b/CRM/Uimods/AdjustPagePermissions.php).
  
  
  ---
  
  ### Answer by username_1 on 2018-01-03. Score: 2
  
  I don't know an intended way to alter the permissions directly.
  
  However, you can play around with disallowing the simple mailing event reports altogether for unprivledged users and restrict access for users to the regular reports as you need it.
  
  `SELECT * FROM civicrm_menu where path = 'civicrm/mailing/report/event';`
  
  e.g. altering `access_arguments` from `a:2:{i:0;a:1:{i:0;s:15:"access CiviMail";}i:1;s:3:"and";}` to `a:2:{i:0;a:1:{i:0;s:18:"administer CiviCRM";}i:1;s:3:"and";}` will only allow admins to view any of the event reports.
  
  > **Comments:**
  > **username_0**: Thank's for the feedback. Does that mean that the permission to view those pages is indeed "access CiviMail"?  
  > **username_1**: By default, yes.  
  > **username_0**: Thank you for the input - will get back to this once I have news.  
  
  ---
  
  ### Answer by username_2 on 2018-01-03. Score: 1
  
  I think you can bypass using [permission\_check](https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_permission_check/) hook.
  
  > **Comments:**
  > **username_0**: Thanks I do not think that works as the documentation says "This hook is implemented for forms (eg Add, Edit) but not yet for reports and viewing of objects like Activities on the Contact Summary page as of 4.7.17"  
  > **username_2**: It does get called on all pages now. I think no one bothered to update the documentation once it was fixed for other pages. Please give a try.  
  > **username_1**: That should work, but i think you would lack the context in the hook to distinguish between accessing CiviMail and accessing the event reports in CiviMail.  
  > **username_2**: You can use $_REQUEST to check the required parameters.  
  > **username_0**: Thank you for the input - will get back to this once I have news.  
  
  ---
  
  