CRM-21473: Add new permission to add contact notes and prevent users without edit contact permission to edit or delete notes

[omarabuhussein]

Overview

Add new permission to add contact notes and prevent users without edit contact permission to edit or delete notes

Before

Currently only users with ability to "edit" contact can see "add note" button in contact page notes tab, but if the add note link civicrm/contact/view/note?cid=CONTACT_ID&action=add was access directly by a user with no ability to "edit" the contact he will still be able to access the add note button, Also the user can still edit or delete the note by direct access using the URL.

Here is an example of user who only has "view all contacts" permission, this is how notes table will appear to him :

And while there is not way to add, delete or edit any note from UI, you can still do it if you know which URL to use, here are some examples for each case for the same user :

Add

Edit

Delete

After

Now only users with "edit" ability can edit or delete notes, and a new permission is added called "add contact notes" so the user either need the ability to "edit" the contact or the new "add contact notes" permission to be able to add note for the currently viewed user.

So back to our user with only "view all contacts" permission, the notes tab will still appear as before :

But now the user cannot even use direct access to add,edit or delete a note :

Add

Edit

Delete

But additionally, we can grant this user role "add contact notes" permission :

which will allow the user to add notes (only add, no edit or delete will be allowed) :

---

• CRM-21473: Adding new permission for adding notes and fixing existing issues with notes permissions

[eileenmcnaughton]

Looks promising - perhaps you could trade review with @jitendrapurohit on this one #11301 (which also looks like a fairly simple review job)

[omarabuhussein]

yup sure @eileenmcnaughton , will do it in the weekend

[jitendrapurohit]

@omarabuhussein @eileenmcnaughton Tested and confirmed adding, editing and deleting notes for a contact. This works as expected as shown in the list of screencast videos.

[eileenmcnaughton]

Merging based on @jitendrapurohit reivew

[jitendrapurohit]

@omarabuhussein Are you able to review #11301 as mentioned by Eileen above?

[omarabuhussein]

hey @jitendrapurohit , sorry I couldn't do it at weekend but I am on it currently.