Answers.Body: <p>The two places "Edit All Events" is defined as necessary is in the page callbacks in the <a href="https://github.com/civicrm/org.civicrm.volunteer/blob/master/xml/Menu/Volunteer.xml#L19" rel="nofollow noreferrer">router XML</a> on lines 19 and 27.</p>
  
  <p>You should be able to change those, then do a cache clear with menu rebuild to change the permissions.</p>
  
  <p>Since CiviVolunteer is so AJAX-heavy, I'm pretty sure that's the right answer.  You can probably just remove the "Edit All Events" permission.  However, the better long-term answer is to do an event-level permission check in the PHP, because it's not uncommon for someone to grant permission to edit only some events via an extension.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-10-23T21:27:38.093Z
Answers.LastActivityDate: 2019-10-23T21:27:38.093Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>I have found out that the Volunteer tab within CiviEvent needs 'edit_all_events'. However, I do not want people editing events they did not create.</p>
  
  <p>Where in the code could I find and adjust this permission? I'm looking here <a href="https://github.com/civicrm/org.civicrm.volunteer/blob/master/volunteer.php" rel="nofollow noreferrer">https://github.com/civicrm/org.civicrm.volunteer/blob/master/volunteer.php</a> but have not found it.</p>
  
  <p>I do have permissions set so this same user role can create and manage civivolunteer projects but it would be best if they were created with the event as the associated entity.</p>
  
  <p>Relevant CiviEvent Permissions:</p>
  
  <ul>
  <li>CiviEvent: access CiviEvent </li>
  <li>CiviEvent: edit event participants  </li>
  </ul>
  
  <p>Relevant CiviVolunteer Permissions</p>
  
  <ul>
  <li>CiviVolunteer: edit own volunteer projects  </li>
  <li>CiviVolunteer: create volunteer projects  </li>
  <li>CiviVolunteer: edit volunteer project relationships</li>
  </ul>
  
  <p>With these, the user get permission denied:
  <a href="https://i.sstatic.net/rTRgb.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/rTRgb.png" alt="enter image description here"></a></p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-10-23T14:24:46.733Z
Comments.Text: This might be a question you can ask on the github page of civivlunteer. That way it is usually easier to discuss improvements on the code and incorporate them.
Comments.UserDisplayName: Jaap Jansma - CiviCooP
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-10-23T15:28:57.880Z
Comments.Text: Posted: https://github.com/civicrm/org.civicrm.volunteer/issues/524. I had thought SE might reach a larger audience.
Comments.UserDisplayName: Andy Burns
Tags: <civievent><civivolunteer>
Title: Change the permissions to access Volunteer tab in CiviEvent
ThreadText: # Change the permissions to access Volunteer tab in CiviEvent
  
  (Asked by: username_0 on 2019-10-17)
  
  I have found out that the Volunteer tab within CiviEvent needs 'edit\_all\_events'. However, I do not want people editing events they did not create.
  
  Where in the code could I find and adjust this permission? I'm looking here <https://github.com/civicrm/org.civicrm.volunteer/blob/master/volunteer.php> but have not found it.
  
  I do have permissions set so this same user role can create and manage civivolunteer projects but it would be best if they were created with the event as the associated entity.
  
  Relevant CiviEvent Permissions:
  
  * CiviEvent: access CiviEvent
  * CiviEvent: edit event participants
  
  Relevant CiviVolunteer Permissions
  
  * CiviVolunteer: edit own volunteer projects
  * CiviVolunteer: create volunteer projects
  * CiviVolunteer: edit volunteer project relationships
  
  With these, the user get permission denied:
  [![enter image description here](https://i.sstatic.net/rTRgb.png)](https://i.sstatic.net/rTRgb.png)
  
  **Tags:** civievent, civivolunteer
  
  > **Comments:**
  > **username_1**: This might be a question you can ask on the github page of civivlunteer. That way it is usually easier to discuss improvements on the code and incorporate them.  
  > **username_0**: Posted: https://github.com/civicrm/org.civicrm.volunteer/issues/524. I had thought SE might reach a larger audience.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2019-10-23. Score: 2 | Accepted answer
  
  The two places "Edit All Events" is defined as necessary is in the page callbacks in the [router XML](https://github.com/civicrm/org.civicrm.volunteer/blob/master/xml/Menu/Volunteer.xml#L19) on lines 19 and 27.
  
  You should be able to change those, then do a cache clear with menu rebuild to change the permissions.
  
  Since CiviVolunteer is so AJAX-heavy, I'm pretty sure that's the right answer. You can probably just remove the "Edit All Events" permission. However, the better long-term answer is to do an event-level permission check in the PHP, because it's not uncommon for someone to grant permission to edit only some events via an extension.
  
  
  ---
  
  