Calendar does not respect security roles in regard to Meetings (SuiteCRM 7 Only) #5240

New issue

Open

opened 2026-02-20 16:31:50 -05:00 by deekerman · 2 comments

deekerman commented

2026-02-20 16:31:50 -05:00

Owner

Originally created by @pstevens71 on GitHub (Aug 9, 2024).

Issue

Calendar does not respect security roles in regard to Meetings (SuiteCRM 7 Only). I've tested both SutieCRM 7 and SuiteCRM 8 and 8 works as expected. If the user does not have access to the meeting record it does not show. However, in SuiteCRM 7 the meeting record shows regardless of the security role.

Possible Fix

??? not sure yet, going to compare the files in 8 vs 7.

Steps to Reproduce the Issue

1.Add a user to a security role (user A)
2.Limit the user role to see meetings "Owner" listview, and records.
3.Get another user to add a meeting (user B)
4. The first user A can see user B's meetings in the calendar, but if you try to open the meeting, you get the popup, but the meeting info fails 500.
...

Context

Obviously, security roles should be respected in the shared calender view. If the installation decision is to have meetings private, and only accessible by the user, then this should be respected in the calendar view.

Version

7.14.3

What browser are you currently using?

Chrome

Browser Version

No response

Environment Information

PHP 8.1

Operating System and Version

Centos 7 WHM/Cpanel

Originally created by @pstevens71 on GitHub (Aug 9, 2024). ### Issue Calendar does not respect security roles in regard to Meetings (SuiteCRM 7 Only). I've tested both SutieCRM 7 and SuiteCRM 8 and 8 works as expected. If the user does not have access to the meeting record it does not show. However, in SuiteCRM 7 the meeting record shows regardless of the security role. ### Possible Fix ??? not sure yet, going to compare the files in 8 vs 7. ### Steps to Reproduce the Issue ```bash 1.Add a user to a security role (user A) 2.Limit the user role to see meetings "Owner" listview, and records. 3.Get another user to add a meeting (user B) 4. The first user A can see user B's meetings in the calendar, but if you try to open the meeting, you get the popup, but the meeting info fails 500. ... ``` ### Context Obviously, security roles should be respected in the shared calender view. If the installation decision is to have meetings private, and only accessible by the user, then this should be respected in the calendar view. ### Version 7.14.3 ### What browser are you currently using? Chrome ### Browser Version _No response_ ### Environment Information PHP 8.1 ### Operating System and Version Centos 7 WHM/Cpanel

deekerman added the

Type: Bug

Priority:Important

Status: Team Investigating

Severity: Moderate

labels

2026-02-20 16:31:50 -05:00

deekerman commented

2026-02-20 16:31:51 -05:00

Author

Owner

@SuiteBot commented on GitHub (Aug 9, 2024):

This issue has been mentioned on SuiteCRM. There might be relevant details there:

https://community.suitecrm.com/t/calendar-not-subject-to-security-roles-suitecrm-7/93655/4

@SuiteBot commented on GitHub (Aug 9, 2024): This issue has been mentioned on **SuiteCRM**. There might be relevant details there: https://community.suitecrm.com/t/calendar-not-subject-to-security-roles-suitecrm-7/93655/4

deekerman commented

2026-02-20 16:31:52 -05:00

Author

Owner

@SinergiaCRM commented on GitHub (Jan 8, 2026):

Hi @gemartin21, @johnM2401, any news on this?

It seems there was some unfinished patch github.com/SuiteCRM/SuiteCRM@b2f9811e22/modules/Calendar/CalendarActivity.php (L276-L285) but reverted as expensive.

It might run faster if the Security groups conditions are applied directly in the queries of this function github.com/SuiteCRM/SuiteCRM@b2f9811e22/include/utils/activity_utils.php (L45) . But we haven't tested it yet.

@SinergiaCRM commented on GitHub (Jan 8, 2026): Hi @gemartin21, @johnM2401, any news on this? It seems there was some unfinished patch https://github.com/SuiteCRM/SuiteCRM/blob/b2f9811e22027c05a95dc5709f0eb9db94abdbfc/modules/Calendar/CalendarActivity.php#L276-L285 but reverted as expensive. It might run faster if the Security groups conditions are applied directly in the queries of this function https://github.com/SuiteCRM/SuiteCRM/blob/b2f9811e22027c05a95dc5709f0eb9db94abdbfc/include/utils/activity_utils.php#L45 . But we haven't tested it yet.