Hi,

I think there's something wrong with the authorization of events.

How I think it now works:

1.    A WordPress user has a profile Amelia Employee. This WordPress user is connected to an Amelia Employee (only WP users with the profile Employee can be connected).

2.    The user can see / edit events if he is added to this specific event as an Amelia Employee.

3.    In the general settings of Amelia, role settings, the switch should be on ‘Edit their events’. 

When these settings are active, users can see and edit events. If this switch is off, they can see it, but not edit is.

But when it’s on, and I change the roles of the profile Amelia Employee and delete all roles, they can still edit and see events. When it’s off, and I add roles to another profile of this user, they still can’t edit and or see events.

So, the roles are not taken into account. Only the profile name and the switch.

I've two types of employees I want to authorize:

* an editor: change, edit, delete an event, export the attendees 

* reader: only read the event and export the attendees.

But I can’t…

I understand you build something and won’t ask people to install a user role editor. But… when an employee is added to an event, the switch is off, they should (only) be able to read the event and export the attendees. And when I add the edit roles to another profile and add them to an employee, they should be able to edit the event.

So can you please add a check on the authorization roles when the switch is off? 

Hi Liza,

Thanks for your reply. I've edited the roles, but it doesn't work. It would have been a nice solution. 

This is what I did:

* manage their events: ON

* in the event added the employee

* edited the employee role: deleted all write and delete authorisation. Only read authorisation is activated.

But they can still edit en delete the events, add and delete customers to the event. Etc.

Best regards!

Hi Liza,

The employees access their bookings on the back-end. I (already) have a special test user with the role Amelia Employee. I edited that role to simply these:

• amelia_read_custom_fields
• amelia_read_events
• amelia_read_menu
• read

That test user is tested in an other browser, cookies deleted, etc. And still able to edit the events, customers of that event, etc. :(

Hi Aleksandar,

Thanks for checking. But... I don't understand. Why is this the solution?

I've removed all editing authorisation of the employee-role, but they can still edit it. They should only read the event and export the data (including the custom fields).

Kind regards,

Gerbert

Hi Aleksandar,

Thanks again for checking, reviewing etc. I really appreciate it!

I got the tip of your colleague to strip the employee profile into only reading, for a reading-user. And edit the manager profile, if needed, for a reading and writing-user. That was fine with me. 

But...

I think there's something wrong programmed in the authorisation.

This is how it is:

* To connect an event to an employee, the user should have an employee profile. OK

* An event is connected with the Employee profile, to prevent editing events that are not theirs. OK

* In the main settings a switch makes an event editable for the employee. THAT'S KINDA WEIRD. IF YOU SEE IT LIKE A 'MASTER' SETTING, THEN OK. 

* If the user has an employee profile, all authorisation roles, like reading and writing are not taken into account. The user can view and edit, at all times. THATS NOT OK. WHY DO THESE ROLES EXIST IF THEY DON'T WORK? ALSO IF THE 'MASTER SWITCH' IS OFF, THEN THEY STILL DON'T WORK, THEY WON'T ALLOW USERS TO EDIT THE EVENT.

I think that if the actual roles are taken into account, when opening the event (the same way you open the event to edit it), users of this plugin can edit it exactly like they need. I really hope you think so too. Please let me know. And when it's written in code, so I can make some people happy 🙃 Including me, then I don't need to export all the event data, but they can do it theirselves. 

Hi Aleksandar,

In this case I referred not to custom fields authorisation, but to these roles:

* amelia_read_events

* amelia_write_events

If I delete the 'write' -role,  a user can still edit the event. I think that's wrong. 

BR,

Gerbert

Hi Aleksandar,

Yes, that's the 'switch' I was talking about. But. Here's the problem.

If the setting is on: they can manage their events, even if I delete the role amelia_write_events. They can read, write settings, see, edit and export participants and view the custom fields. 

If the setting is off: they can't manage their events, even if they have the role amelia_write_events. They can't open the event to see the participants.

So, the role amelia_write_events is not taken into account. Ever.

The setting is fine with me and helps non technical clients to edit the authorisation in a easy way. If only the role amelia_write_events was also taken into account, then it's all solved. Then:

If the setting is on: they can manage their events, unless I delete the role amelia_write_events. Then they can still open it, read it, and still see the participants. And export the data.

Thanks again for your help, analytics etc!

Best Regards,

Gerbert

Hi Ivana,

Good to hear it was automatic. I tried to explain in my post of August 13, 2021 at 8:01am that editing the backend roles would have been the solution, but the roles are not taken into account. Please read that post for more information ;)

Best Regards,

Gerbert