CiviCRM 3.4.1 ACL Is Now Ignored When Calling API Via PHP in Content Template

I've posted this over in CiviCRM forums but I'm thinking that if Gregory Heller or someone similar sees this post, he/they might be able to help.

I've just upgraded to CiviCRM 3.4.1. I am wondering if that's what caused what I'm describing here.

If you refer to

Re: Trying to print CiviCRM_Address fields for Contact Refernce Via a NODE
(http://forum.civicrm.org/index.php/topic,19637.msg81734.html#msg81734)

You will see that at one point I found a solution for printing CiviCRM fields in a content node by adding php to the content template that reference api.php the civicrm_api() "get" function.

I got this working for anonymous users WITHOUT giving them access to "View ALL contacts" in Drupal Permissions by creating a "Public Sports Data" group and then adding sports contacts to it (coaches and facilities).

Two things definitely are working:

1. the fields print in the content node when logged in as anyone with "view all contacts" privileges - but this was not necessary before today.

2. the ACL rules in CiviCRM are WORKING when an anonymous user accesses the CiviCRM contact page directly:

   • e.g. http://soncnv.webfactional.com/civicrm/contact/view?reset=1&cid=4

They cannot see all contacts, but CAN see the Contacts in the Public Sports Data Group. So on the CiviCRM side, the ACL and group are set up and connected properly.

So specifically, it seems that - maybe- the api has changed and no longer provides information using ACL rules but only Drupal permissions? Which, I'm pretty sure was not the case in 3.3.6.

Since an Admin user always sees the CiviCRM data perfectly, and so does any user were I set "see all contacts", it's definitely an issue of Drupal Permissions now overriding the CiviCRM ACL, but ONLY within a a content node, or template, or php.

I've cleared EVERY cache- site cache, views cache.

What I NEED to do is to show contact data in a Drupal node because I don't want anonymous users to go to /civicrm/contact/view?reset=1 because those screens expose WAY too much data that we don't need site visitors to see.

[b]** ANY HELP APPRECIATED GREATLY.[/b]

If you want the full code for reference, please see:
http://forum.civicrm.org/index.php/topic,19637.msg81734.html#msg81734

THANKS! Merci Beaucoup.

For you people not on CiviCRM Forums, here's the code and longer story:

Part one: The initial issue:

The Special Olympics holds training/practices for the athletes. The practices get posted and placed on a calendar, as do competitions. This is not a problem in Drupal. However, the Practice node content page should list the location ADDRESS, not just the name. With the current accessiblity of CiviCRM in the node, I ONLY can get a contact reference, which displays ONLY the name of the location on the Practice screen. Also it's a link to the CiviCRM contact screen and I don't really want that screen exposed to Anonymous users because of the secondary tabs and extra information that's exposed.

So the Practice Listing reads like this:

Oakland Aquatics

Sport
Aquatics

Head Coach
Coach To Be Announced <--link to CiviCRM contact (not desired but not an issue in this case)

Practice Location
Live Oak Memorial Pool <--link to CiviCRM contact (not desired)

Dates

Repeats every week until Tue Jun 21 2011 except Mon Mar 28 2011.
Sat, 03/26/2011 - 10:00am
Sat, 04/02/2011 - 10:00am
Sat, 04/09/2011 - 10:00am
Sat, 04/16/2011 - 10:00am
Sat, 04/23/2011 - 10:00am
Sat, 04/30/2011 - 10:00am
Sat, 05/07/2011 - 10:00am
Sat, 05/14/2011 - 10:00am
Sat, 05/21/2011 - 10:00am
Sat, 05/28/2011 - 10:00am
Sat, 06/04/2011 - 10:00am
Sat, 06/11/2011 - 10:00am
Sat, 06/18/2011 - 10:00am

And it SHOULD show the address also, like this, ideally:

Oakland Aquatics

Sport
Aquatics

Head Coach
Coach To Be Announced

Practice Location
Live Oak Memorial Pool
1055 MacArthur Boulevard
Oakland, CA 94610

Dates

Repeats every week until Tue Jun 21 2011 except Mon Mar 28 2011.
Sat, 03/26/2011 - 10:00am
Sat, 04/02/2011 - 10:00am
Sat, 04/09/2011 - 10:00am
Sat, 04/16/2011 - 10:00am
Sat, 04/23/2011 - 10:00am
Sat, 04/30/2011 - 10:00am
Sat, 05/07/2011 - 10:00am
Sat, 05/14/2011 - 10:00am
Sat, 05/21/2011 - 10:00am
Sat, 05/28/2011 - 10:00am
Sat, 06/04/2011 - 10:00am
Sat, 06/11/2011 - 10:00am
Sat, 06/18/2011 - 10:00am

PART Two- the Initial Solution:

Finally, here is the complete code I needed in Contemplate (Content Template, in the Body), to:

A. Pull in CiviCRM address info for contacts
B. Remove the node links to CiviCRM to prevent anonymous users from clicking over there
C. ALSO get the State information from "Constant"

<?php

if ( ! civicrm_initialize( ) ) {

       return;
}

require_once 'api/api.php';

$xcoach_id = $node->field_headcoach[0]['contact_id'];
$xcoach = civicrm_api("Contact","get", array ('version'=>'3', 'contact_id'=> $xcoach_id));

?>

<div class="field field-type-nodereference field-field-prac-sport">
   <h3 class="field-label" style="margin-bottom:0px; padding-bottom: 0px;">
      Sport</h3>
   <div class="field-items">
      <div class="field-item style="font-size: 13px;">
         <?php print $node->field_prac_sport[0]['view'] ?></div>
   </div>
</div>
<div class="field">
   <h3 class="field-label" style="margin-bottom:0px; padding-bottom: 0px;">
      Head Coach</h3>
   <div class="field-items">
      <div class="field-item style="font-size: 13px;">
         <?php print $xcoach['values'][$xcoach_id]['display_name']; ?></div>
   </div>
</div>
<div class="field">
   <h3 class="field-label" style="margin-bottom:0px; padding-bottom: 0px;">
      Practice Location</h3>
   <div class="field-items">
     
<div class="field-item style="font-size: 13px;">

<?php

$contid = $node->field_prac_location[0]['contact_id'];

$xloc_contact = civicrm_api("Contact","get", array ('version'=>'3', 'contact_id'=> $contid));

print $xloc_contact['values'][$contid]['display_name'];
?>

<br>

<?php

$results=civicrm_api("Address","get", array ('version'=>'3', 'contact_id'=> $contid));

$temp_id=$results['id'];

$tmp_state = civicrm_api('constant','get', array('version'=> '3', 'name'=> 'stateProvinceAbbreviation'));

$xstate_abbrev = $tmp_state['values'][$results['values'][$temp_id]['state_province_id']];

print $results['values'][$temp_id]['street_address']."\n";

if ($results['values'][$temp_id]['supplemental_address_1']) { print $results['values'][$temp_id]['supplemental_address_1'];};

?>
<br />
<?php print $results['values'][$temp_id]['city'].", ".$xstate_abbrev."".$results['values'][$temp_id]['postal_code']."\n"; ?>
</div>
   </div>
</div>

<div class="field field-type-date field-field-prac-dates">
   <h3 class="field-label style="margin-bottom:0px; padding-bottom: 0px;">
      Dates</h3>
   <div class="field-items">
      <?php
                  
                  foreach ((array)$node->field_prac_dates as $item) {
?>

<div class="field-item">

<?php print $item['view'] ?></div>

<?php } ?>
      </div>
     
</div>