systopia / de.systopia.donrec

CiviCRM Donation Receipts Extension
GNU Affero General Public License v3.0
15 stars 26 forks source link

Prevent exposing donrec custom_value data to user: "I now have two DonationReceipts tabs on my contact" #203

Open bjendres opened 3 months ago

bjendres commented 3 months ago

There are two (hidden) multi value custom groups that store the information about issued receipts at the contribution and at the contact*. If somebody hits the edit button on these in the UI (which wasn't possible before) the

The problem is, that this overrides the style parameter in the civicrm_custom_group table back to the default (Tab), where it should be empty (i.e. hidden).

If this happens to you, you can simple set he style to NULL again, but you'll have to do that in the DB.

To prevent this from happening, we should implement the post_hook and make sure that these groups' style will always be null.

*) Nowadays you'd implement this as a custom entity, but those were different times :)

jensschuppe commented 3 months ago

NULL does not seem to be an option this field can purposefully be set to … While I'm not sure how to "properly" hide the group from being displayed on the contact summary page, I'd say the correct thing to do would be to make the custom group have is_reserved set to TRUE as this prevents the group from appearing in the Custom Fields UI at all, so that no changes can be made to the Custom Group settings in the first place.

Also, those groups/fields (and Option Groups) should be made managed entities, basically making the \CRM_Donrec_DataStructure class obsolete.