Answers.Body: <p>The problem lies with the API permission to the StateProvince entity.  Civi event users do not have access to this entity via the API. (I'm not sure why this is)</p>
  
  <p>To fix this I created a custom drupal module with the civi hook: <a href="https://docs.civicrm.org/dev/en/master/hooks/hook_civicrm_alterAPIPermissions/" rel="nofollow noreferrer">mymodule_civicrm_alterAPIPermissions</a></p>
  
  <pre>
  mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions) {
  
  $permissions['state_province'] = array(
      'get' => array(
        'access CiviCRM',
        'access CiviEvent',
        'edit all events',
      ),
    );
  }
  </pre>
  
  <p>Which gives CiviEvent users access to this entity via the API.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-15T15:01:37.703Z
Answers.LastActivityDate: 2017-05-15T15:50:52.407Z
Answers.LastEditDate: 2017-05-15T15:50:52.407Z
Answers.UserDisplayName: chirps
Body: <p>We are using CiviCRM with Drupal 7.54 and we just upgraded to CiviCRM 4.7.19.  After the upgrade, when I go to an event (Event->Manage Events->[some event]->location) with a user who has 'access CiviEvent' permissions and try to go to the location tab I receive this error:</p>
  
  <pre>CiviCRM_API3_Exception: "Authorization failed to join onto StateProvince api in parameter loc_block_id.address_id.state_province_id.name"
  
  #0 sites/all/modules/civicrm/CRM/Event/BAO/Event.php(1889): civicrm_api3("Event", "get", (Array:5))
  #1 sites/all/modules/civicrm/CRM/Event/Form/ManageEvent/Location.php(172): CRM_Event_BAO_Event::getLocationEvents()
  #2 sites/all/modules/civicrm/CRM/Core/Form.php(564): CRM_Event_Form_ManageEvent_Location->buildQuickForm()
  #3 sites/all/modules/civicrm/CRM/Core/QuickForm/Action/Display.php(92): CRM_Core_Form->buildForm()
  #4 sites/all/modules/civicrm/packages/HTML/QuickForm/Controller.php(203): CRM_Core_QuickForm_Action_Display->perform(Object(CRM_Event_Form_ManageEvent_Location), "display")
  #5 sites/all/modules/civicrm/packages/HTML/QuickForm/Page.php(103): HTML_QuickForm_Controller->handle(Object(CRM_Event_Form_ManageEvent_Location), "display")
  #6 sites/all/modules/civicrm/CRM/Core/Controller.php(351): HTML_QuickForm_Page->handle("display")
  #7 sites/all/modules/civicrm/CRM/Utils/Wrapper.php(113): CRM_Core_Controller->run()
  #8 sites/all/modules/civicrm/CRM/Core/Invoke.php(283): CRM_Utils_Wrapper->run("CRM_Event_Form_ManageEvent_Location", "Event Location", (Array:0))
  #9 sites/all/modules/civicrm/CRM/Core/Invoke.php(84): CRM_Core_Invoke::runItem((Array:14))
  #10 sites/all/modules/civicrm/CRM/Core/Invoke.php(52): CRM_Core_Invoke::_invoke((Array:4))
  #11 sites/all/modules/civicrm/drupal/civicrm.module(448): CRM_Core_Invoke::invoke((Array:4))
  #12 includes/menu.inc(527): civicrm_invoke("event", "manage", "location")
  #13 index.php(20): menu_execute_active_handler()
  #14 {main}
  </pre>
  
  <p>We upgraded from 4.7.15 so one of the upgrades implemented a permission check for</p>
  
  <p>CRM_Event_BAO_Event::getLocationEvents()</p>
  
  <p>Located in CRM/Event/BAO/Event.php</p>
  
  <pre> $events = array();
      $ret = array(
        'loc_block_id',
        'loc_block_id.address_id.name',
        'loc_block_id.address_id.street_address',
        'loc_block_id.address_id.supplemental_address_1',
        'loc_block_id.address_id.supplemental_address_2',
        'loc_block_id.address_id.supplemental_address_3',
        'loc_block_id.address_id.city',
        'loc_block_id.address_id.state_province_id.name',
      );
  
      $result = civicrm_api3('Event', 'get', array(
        'check_permissions' => TRUE,
        'return' => $ret,
        'loc_block_id.address_id' => array('IS NOT NULL' => 1),
        'options' => array(
          'limit' => 0,
        ),
      ));</pre>
  
  <p>Now I am able to access the tab with the permission 'administer CiviCRM' but not with just 'access CiviEvent'.  This is problematic because many of my CiviEvent users can't complete their event postings.</p>
  
  <p>When I comment out the this field </p>
  
  <pre>'loc_block_id.address_id.state_province_id.name'</pre> 
  
  <p>in the return array ($ret) it passes permissions.  I'm wondering if something is wrong with the join in the API, or if there's a permission I need to set somewhere.</p>
  
  <p>Also when I go to the API explorer and reproduce the API call above, I receive the same error.</p>
  
  <p>I'm wondering if this is a bug in core or maybe something on my end.  Any help to find a way around this permission failure would awesome.</p>
  
  <p>Thanks!</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-15T16:47:48.073Z
Comments.Text: This is an excellent analysis of what amounts to a new bug.  Thank you for detailing the workaround.  Would you be willing to file a bug on issues.civicrm.org?  If not I can try to find a minute later this week.  Thanks!
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-15T17:34:03.950Z
Comments.Text: @JonG Thanks, I've filed the bug report. https://issues.civicrm.org/jira/browse/CRM-20581
Comments.UserDisplayName: chirps
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-05-15T18:41:17.137Z
Comments.Text: I had created https://issues.civicrm.org/jira/browse/CRM-20582. I think this is probably the same thing. You just slightly beat me out by 1.
Comments.UserDisplayName: Randy Tobias
Tags: <civievent><issues>
Title: CiviCRM_API3_Exception: "Authorization failed to join onto StateProvince api in parameter loc_block_id.address_id.state_province_id.name"
ThreadText: # CiviCRM_API3_Exception: "Authorization failed to join onto StateProvince api in parameter loc_block_id.address_id.state_province_id.name"
  
  (Asked by: username_0 on 2017-05-12)
  
  We are using CiviCRM with Drupal 7.54 and we just upgraded to CiviCRM 4.7.19.  After the upgrade, when I go to an event (Event->Manage Events->[some event]->location) with a user who has 'access CiviEvent' permissions and try to go to the location tab I receive this error:
  CiviCRM_API3_Exception: "Authorization failed to join onto StateProvince api in parameter loc_block_id.address_id.state_province_id.name"
  
  #0 sites/all/modules/civicrm/CRM/Event/BAO/Event.php(1889): civicrm_api3("Event", "get", (Array:5))
  #1 sites/all/modules/civicrm/CRM/Event/Form/ManageEvent/Location.php(172): CRM_Event_BAO_Event::getLocationEvents()
  #2 sites/all/modules/civicrm/CRM/Core/Form.php(564): CRM_Event_Form_ManageEvent_Location->buildQuickForm()
  #3 sites/all/modules/civicrm/CRM/Core/QuickForm/Action/Display.php(92): CRM_Core_Form->buildForm()
  #4 sites/all/modules/civicrm/packages/HTML/QuickForm/Controller.php(203): CRM_Core_QuickForm_Action_Display->perform(Object(CRM_Event_Form_ManageEvent_Location), "display")
  #5 sites/all/modules/civicrm/packages/HTML/QuickForm/Page.php(103): HTML_QuickForm_Controller->handle(Object(CRM_Event_Form_ManageEvent_Location), "display")
  #6 sites/all/modules/civicrm/CRM/Core/Controller.php(351): HTML_QuickForm_Page->handle("display")
  #7 sites/all/modules/civicrm/CRM/Utils/Wrapper.php(113): CRM_Core_Controller->run()
  #8 sites/all/modules/civicrm/CRM/Core/Invoke.php(283): CRM_Utils_Wrapper->run("CRM_Event_Form_ManageEvent_Location", "Event Location", (Array:0))
  #9 sites/all/modules/civicrm/CRM/Core/Invoke.php(84): CRM_Core_Invoke::runItem((Array:14))
  #10 sites/all/modules/civicrm/CRM/Core/Invoke.php(52): CRM_Core_Invoke::_invoke((Array:4))
  #11 sites/all/modules/civicrm/drupal/civicrm.module(448): CRM_Core_Invoke::invoke((Array:4))
  #12 includes/menu.inc(527): civicrm_invoke("event", "manage", "location")
  #13 index.php(20): menu_execute_active_handler()
  #14 {main}
  
  We upgraded from 4.7.15 so one of the upgrades implemented a permission check for
  CRM_Event_BAO_Event::getLocationEvents()
  Located in CRM/Event/BAO/Event.php
   $events = array();
      $ret = array(
        'loc_block_id',
        'loc_block_id.address_id.name',
        'loc_block_id.address_id.street_address',
        'loc_block_id.address_id.supplemental_address_1',
        'loc_block_id.address_id.supplemental_address_2',
        'loc_block_id.address_id.supplemental_address_3',
        'loc_block_id.address_id.city',
        'loc_block_id.address_id.state_province_id.name',
      );
  
      $result = civicrm_api3('Event', 'get', array(
        'check_permissions' => TRUE,
        'return' => $ret,
        'loc_block_id.address_id' => array('IS NOT NULL' => 1),
        'options' => array(
          'limit' => 0,
        ),
      ));
  Now I am able to access the tab with the permission 'administer CiviCRM' but not with just 'access CiviEvent'.  This is problematic because many of my CiviEvent users can't complete their event postings.
  When I comment out the this field 
  'loc_block_id.address_id.state_province_id.name'
  in the return array ($ret) it passes permissions.  I'm wondering if something is wrong with the join in the API, or if there's a permission I need to set somewhere.
  Also when I go to the API explorer and reproduce the API call above, I receive the same error.
  I'm wondering if this is a bug in core or maybe something on my end.  Any help to find a way around this permission failure would awesome.
  Thanks!
  
  **Tags:** civievent, issues
  
  > **Comments:**
  > **username_1**: This is an excellent analysis of what amounts to a new bug.  Thank you for detailing the workaround.  Would you be willing to file a bug on issues.civicrm.org?  If not I can try to find a minute later this week.  Thanks!  
  > **username_0**: @JonG Thanks, I've filed the bug report. https://issues.civicrm.org/jira/browse/CRM-20581  
  > **username_2**: I had created https://issues.civicrm.org/jira/browse/CRM-20582. I think this is probably the same thing. You just slightly beat me out by 1.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2017-05-15. Score: 2
  
  The problem lies with the API permission to the StateProvince entity.  Civi event users do not have access to this entity via the API. (I'm not sure why this is)
  To fix this I created a custom drupal module with the civi hook: mymodule_civicrm_alterAPIPermissions
  
  mymodule_civicrm_alterAPIPermissions($entity, $action, &$params, &$permissions) {
  
  $permissions['state_province'] = array(
      'get' => array(
        'access CiviCRM',
        'access CiviEvent',
        'edit all events',
      ),
    );
  }
  
  Which gives CiviEvent users access to this entity via the API.
  
  
  ---
  
  