Contact Field List Configuration Issue

[msmith119]

I have my Member Records Module set to "Contacts". I edited the fields that show in this list using a "List Configuration".
This list configuration is set to "Give Permission to use configuration for all members".

The default fields show like this:
No. - First Name - Surname

Default Field View.png (10.33 KiB) 450 mal betrachtet

My list configuration shows like this:
No. - First Name - Surname - Group Assignment - Booking Reference - Payment Status - Last Modified

My List Configuration Custom View.png (22.54 KiB) 450 mal betrachtet

The issue i have:z
- When viewing the Member Records List as an Admin or Role with "Edit profile of all contacts" permission, you can see my list configuration.
- When viewing the Member Records List as a role that does not have "Edit profile of all contacts" permission, they can only see the default fields.

Is there a way to allow all members to see my list configuration & fields, without giving people edit access to membership records?

Thanks in advance,
Matthew

[msmith119]

After about 7 hours of investigation work and troubleshooting source code, I finally managed to find the root cause of my issue. Not sure if this is an intended feature or if it is a bug, but definitely was a game changer for me if I couldn't get it working.

I provided allot of detail here, so if your stuck for time, I highlighted the important sections with a Red Star (*)

Issue: *

• Contacts module restricts configured contact list fields to only users with "rol_edit_user" permission

Environment:

• Version: 5.0.10 & 5.0.11

• Module: Contacts

• File: adm_program/modules/contacts/contacts.php

Problem Summary:*

• Users who can view (not edit) profiles and profile field data are only shown first name and surname in the Contacts module unless they have the rol_edit_user access "Edit profile of all contacts".

• This creates an inconsistency where users can view profile information on profile pages but are prevented from seeing the same information in the Contacts list, when admins have created custom "List Configurations" to show more user fields on the contacts list page.

Route Cause:*

In Contacts.php the following logic is present:

Code: Alles auswählen

if ($gCurrentUser->isAdministratorUsers()) {
    ... // Admin functionality
} else {
    $contactsListConfig->setModeShowOnlyNames();
}

isAdministratorUsers() resolves to:

Code: Alles auswählen

checkRolesRight('rol_edit_user')

Therefore any user without the global "Edit profile data of all contacts" (rol_edit_user) permission is forced into:

Code: Alles auswählen

$contactsListConfig->setModeShowOnlyNames();

which removes all configured contact list fields, giving you only the firstname and surname.

Impact:
Users who can legitimately view profile information:

• Can access profile pages.

• Can view profile field data.

• Can access the Contacts module.

but cannot view the same information within the Contacts list unless they are granted a global edit permission.

This effectively ties list visibility to edit rights, which would pose a security risk for those who want to prioritise data accessibility over data editing security.

Verification:
Commenting out the following line of code, resolves the issue:

Code: Alles auswählen

modules/contacts/contacts.php:115:        $contactsListConfig->setModeShowOnlyNames();

Meaning it shows as:

Code: Alles auswählen

[code]if ($gCurrentUser->isAdministratorUsers()) {
    ... // Admin functionality
} else {
   // $contactsListConfig->setModeShowOnlyNames();
}

After doing so:

• Profile visibility remains unchanged.

• Contact editing rights are not granted.

• Create/Edit/Delete administrative functions remain restricted.

• Existing administrator permission checks continue to function.

This indicates the issue is isolated to the Contacts list display logic rather than profile security or role permissions.

Suggested Review/Developer Intervention:*

1. Please review the reasoning for the code "modules/contacts/contacts.php:115:" and if it can be removed completly in future updates?

2. Please consider alternative configurations, depending on why you put this code in there, such as:

• using profile-view permissions and profile-field visibility rules to determine which contact list columns are shown, rather than requiring "rol_edit_user" to unlock the configured contact list.

• adding an extra permission under roles to "Show all List fields", without granting extra access

• Or consider adding a new role permission "View all list fields" that allows them to see all fields in the contacts module specified by the List configuration features

Steps to Reproduce:

1. Create a user role that:

• View role Memberships: Logged in user

• View profiles of role members: Logged in user

• Leader: No additional rights

• Default list: System-wide default list

• Only Permission: View member lists of all roles and all member profiles

2. Configure a contact list (Groups & Roles > Configure Lists) containing custom profile fields.
3.Log in as a user with the role created above.
4. Open the Contacts Module

Actual Result:

• Profile pages display all permitted profile fields correctly.

• The Contacts module displays only: First Name & Surname

• Configured profile fields are hidden.

Expected Result:

• If a user has permission to view profile data and visible profile fields, the Contacts list should display the configured contact list fields according to the existing profile visibility rules.

• Visibility of list data should not require the global contact editing permission.

Thanks for your time,
Matthew Smith

[fasse]

Hi Metthew,

to view data of all members within the contacts module you must have access to view all member data. Therefore the role should have at least the right View member lists of all roles and all member profiles .

Do you have tested the result if a member has this setting?

Best
Fasse