Answers.Body: <p>This issue was a bug that has been fixed. For reference purposes you can see the issue <a href="https://issues.civicrm.org/jira/browse/CRM-18239" rel="nofollow">here</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-05-05T06:13:12.400Z
Answers.LastActivityDate: 2016-05-05T06:13:12.400Z
Answers.UserDisplayName: petednz - fuzion
Body: <p>We think we have found a bug in the core CiviCRM related to user permissions.</p>
  
  <p>If we give a role (eg authenticated) only the "CiviCRM: view my contact" permission. They have NO other CiviCRM permissions. Then as that user we go to our CiviCRM contact record (we did this by typing in the path as have provided no way to get there ie <a href="http://demo.fuzion.co.nz/civicrm/contact/view?reset=1&amp;cid=230" rel="nofollow noreferrer">http://demo.fuzion.co.nz/civicrm/contact/view?reset=1&amp;cid=230</a>). On that page you get a EDIT button, which allows you to edit your contact details, and you are able to save these changes. I would assume this button should only be available if the role is given the "CiviCRM: edit my contact" permission.</p>
  
  <p>We are on Drupal 7.43 and CiviCRM 4.6.14.</p>
  
  <p>This is not the same issue as <a href="https://civicrm.stackexchange.com/questions/7151/permissions-view-my-contact-and-edit-my-contact-do-not-seem-to-work">https://civicrm.stackexchange.com/questions/7151/permissions-view-my-contact-and-edit-my-contact-do-not-seem-to-work</a> as I checked without the "CiviCRM: view my contact" they get access denied on the page.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-03-15T04:21:58.373Z
Comments.Text: Reported in JIRA https://issues.civicrm.org/jira/browse/CRM-18239
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-05-04T14:04:33.090Z
Comments.Text: Thanks for having reported this issue. I'm voting to close this question because it's a bug report and it has been logged in JIRA.
Comments.UserDisplayName: samuelsov
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-05-05T06:12:23.163Z
Comments.Text: but isn't leaving question for others to find if they have the same issue useful to them? do you mean you want to close (delete) it, or lock it?
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-05-05T06:13:40.807Z
Comments.Text: i added an answer - in case that gives it more validity to stay around for posterity ;-)
Comments.UserDisplayName: petednz - fuzion
Tags: <permissions>
Title: Should "CiviCRM: view my contact" permission result in user being able to edit themselves in CiviCRM
ThreadText: # Should "CiviCRM: view my contact" permission result in user being able to edit themselves in CiviCRM
  
  (Asked by: username_0 on 2016-03-15)
  
  We think we have found a bug in the core CiviCRM related to user permissions.
  
  If we give a role (eg authenticated) only the "CiviCRM: view my contact" permission. They have NO other CiviCRM permissions. Then as that user we go to our CiviCRM contact record (we did this by typing in the path as have provided no way to get there ie <http://demo.fuzion.co.nz/civicrm/contact/view?reset=1&cid=230>). On that page you get a EDIT button, which allows you to edit your contact details, and you are able to save these changes. I would assume this button should only be available if the role is given the "CiviCRM: edit my contact" permission.
  
  We are on Drupal 7.43 and CiviCRM 4.6.14.
  
  This is not the same issue as <https://civicrm.stackexchange.com/questions/7151/permissions-view-my-contact-and-edit-my-contact-do-not-seem-to-work> as I checked without the "CiviCRM: view my contact" they get access denied on the page.
  
  **Tags:** permissions
  
  > **Comments:**
  > **username_1**: Reported in JIRA https://issues.civicrm.org/jira/browse/CRM-18239  
  > **username_2**: Thanks for having reported this issue. I'm voting to close this question because it's a bug report and it has been logged in JIRA.  
  > **username_1**: but isn't leaving question for others to find if they have the same issue useful to them? do you mean you want to close (delete) it, or lock it?  
  > **username_1**: i added an answer - in case that gives it more validity to stay around for posterity ;-)  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-05-05. Score: 1
  
  This issue was a bug that has been fixed. For reference purposes you can see the issue [here](https://issues.civicrm.org/jira/browse/CRM-18239)
  
  
  ---
  
  