[Vtigercrm-developers] calendars don't follow role permissions

[Alex Hall]

The other IT guy here came up with an idea. We made the calendar display models get the subordinates of the current user, then only show the events belonging to the users in that subordinates list. So far, this has worked.

> On Apr 19, 2018, at 11:16, nilay khatri <nilay.spartan at gmail.com> wrote:
> 
> Hi Alex,
> 
> were you able to figure out a solution for this?
> 
> 
> 
> On Wed, Apr 4, 2018 at 8:07 PM, Alex Hall <ahall at autodist.com <mailto:ahall at autodist.com>> wrote:
> Hi all,
> One major bug we've run into is calendars. We have users set to sync VT with Google calendars, but the views don't follow the rules. With organizations, contacts, and all other modules, managers can see sales reps' data, but reps can't see other reps' data. This is how it should be, so our roles are working.
> 
> However, calendars don't follow this at all. If events are public, all reps can see events from all other reps, despite the roles not allowing for it. If events are private, managers can't see those events for their reps like they need to be able to.
> 
> I've looked into this, and found only one suggested fix. It failed, and is for V6 anyway. Since then, the other IT guy and I have been tracing through VT's source, trying to add things to make it work how we want. We're thinking of getting all subordinate users for the current user, then adding each as an OR in the query that gets the events. This fails because the addCondition call inserts the user ID, but not the string, such as 'current_user_id'. Thus, our query ends up with "and = 1" instead of "and current_user_id = 1".
> 
> I have no idea if this is even the right way to do it, and I haven't yet worked out how to get the string in the query. I'll also need to include all subordinate IDs in a big parenthesized group, since each is separated by OR, but I can't get groups in queryGenerator.php to work how I thought they would.
> 
> Does anyone have any suggestions for how this is supposed to work? What could I do to make events behave how every other module does? Is this problem by design, or a very long-standing bug? If I'm on the right track with the fix, why would queryGenerator->addCondition fail to add the string I pass in as the first parameter? Thanks for any help or suggestions.
> 
> -- 
> Alex Hall
> Automatic Distributors, IT department
> ahall at autodist.com <mailto:ahall at autodist.com>
> 
> _______________________________________________
> http://www.vtiger.com/ <http://www.vtiger.com/>
> 
> _______________________________________________
> http://www.vtiger.com/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.vtigercrm.com/pipermail/vtigercrm-developers/attachments/20180420/2fe849ee/attachment-0001.html>