Body: <p>I am recreating Views in Drupal 9 (well, 10 now!). Using CiviCRM 5.66 with Drupal Webform and the webform civicrm module etc.</p>
  <p>On my Drupal 7 site I have a Staff ACL group that has 'Edit' rights to see and make changes to certain groups of contacts. We lock down who can see what in this manner, giving classes of users the right to see what they need to see (and edit).</p>
  <p>My Drupal 7 View displays amongst other things, the display name and links to these certain groups of contacts.  I recreated exactly the same View, but on testing, the data for these same contacts was not displayed when I was logged in with restricted rights:</p>
  <p><a href="https://i.sstatic.net/UigRh.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/UigRh.png" alt="Blank data for School/Group and Host farm contacts" /></a></p>
  <p>After quite a bit of sleuthing, I have managed to track this down to an issue with the permissions and ACLs.</p>
  <p>Dispite the restricted User having the rights to Edit a contact (and therefore view it), they must also have a Drupal Role that has the</p>
  <pre><code>CiviCRM: view all contacts
  View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.
  </code></pre>
  <p>permission in order to display those contacts:</p>
  <p><a href="https://i.sstatic.net/Fzur7.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Fzur7.png" alt="Data displays with overly permissive permissions" /></a></p>
  <p>For us this permission is overly permissive. I assume this is an issue rather than the intended behaviour? There is no issue with Drupal 7 Views/Webform/CiviCRM and so I guess this issue is with the integration layer?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-10-20T01:41:39.640Z
Comments.Text: are you using civicrm_entity - you don't say you are but you do need it for civi Views.
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-10-20T08:34:47.410Z
Comments.Text: Hi Peter yes I am.  Views has always worked well over the years for these sorts of things, but this is a showstopper so I'll have to recreate in SearchKit. I suspect it is a bug so presumably report it in CiviCRM Entity?
Comments.UserDisplayName: ChumKui
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-10-23T13:26:58.583Z
Comments.Text: Have added an issue on civicrm_entity:
  https://www.drupal.org/project/civicrm_entity/issues/3395618
Comments.UserDisplayName: ChumKui
Tags: <permissions><drupal-views>
Title: Drupal 9/10 Views requires 'View All Contact' permission even if 'Edit' ACL exists
ThreadText: # Drupal 9/10 Views requires 'View All Contact' permission even if 'Edit' ACL exists
  
  (Asked by: username_0 on 2023-10-19)
  
  I am recreating Views in Drupal 9 (well, 10 now!). Using CiviCRM 5.66 with Drupal Webform and the webform civicrm module etc.
  On my Drupal 7 site I have a Staff ACL group that has 'Edit' rights to see and make changes to certain groups of contacts. We lock down who can see what in this manner, giving classes of users the right to see what they need to see (and edit).
  My Drupal 7 View displays amongst other things, the display name and links to these certain groups of contacts.  I recreated exactly the same View, but on testing, the data for these same contacts was not displayed when I was logged in with restricted rights:
  
  After quite a bit of sleuthing, I have managed to track this down to an issue with the permissions and ACLs.
  Dispite the restricted User having the rights to Edit a contact (and therefore view it), they must also have a Drupal Role that has the
  CiviCRM: view all contacts
  View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.
  
  permission in order to display those contacts:
  
  For us this permission is overly permissive. I assume this is an issue rather than the intended behaviour? There is no issue with Drupal 7 Views/Webform/CiviCRM and so I guess this issue is with the integration layer?
  
  **Tags:** permissions, drupal-views
  
  > **Comments:**
  > **username_1**: are you using civicrm_entity - you don't say you are but you do need it for civi Views.  
  > **username_0**: Hi Peter yes I am.  Views has always worked well over the years for these sorts of things, but this is a showstopper so I'll have to recreate in SearchKit. I suspect it is a bug so presumably report it in CiviCRM Entity?  
  > **username_0**: Have added an issue on civicrm_entity: https://www.drupal.org/project/civicrm_entity/issues/3395618  
  
  ---
  
  ## 0 answers
  
  