How to remove the link 'do this for different person?' on a contribution / membership renewal page

Question

I'm obviously missing something...

Wordpress / civicrm 5.4

I have a contribution / membership renewal page to allow members to renew. They need to log in before veiwing the page It presents them with their contact info via a profile and allows them to change any incorrect info and then asks them to select their membership type and pay. All seems to work great!

Except for the link that says 'want to do this for someone else?' If they click on this and happen to know the email address of another member seems they can rewrite all their contact info?!

I don't seem to be able remove this link.

The above is obviously bonkers. But what am i doing wrong please? Is the 'do for different person' link removable? Is it not possible to limit the ability of members to update info to their own records? Is there a permission I need to set somewhere? Or do I just need to separate out the processes for making contribution from the process for maintaining contact info?

thank you:)

Answer 1

Have you tested this as a regular user and not as an admin or higher-level user? There should be a set of permissions that define whether or not users can edit their accounts, the accounts of others, etc. Make sure "edit all contacts" is only select for the appropriate role(s).

Here's what they look like in Drupal, for an idea:

Answer 2

I do not know if you can achieve this with configuration. However, it can be coded. The idea is that section you want to hide is marked with a unique css class crm-not-you-message.

Create an extension (see https://docs.civicrm.org/dev/en/latest/extensions/).

Create a file in the extension with the name <extensiondir>/templates/CRM/Contribute/Form/Contribution/Main.extra.tpl

Add the following code to the file

{literal}
  <!-- ui removing link -->
  <script type="text/javascript">
     CRM.$('.crm-not-you-message').hide();
  </script>
{/literal}

This code is appended (due to workings of the CiviCRM extension) to the page. The CRM.$ function selects the elements and hides it.

Answer 3

Editing the ACL configuration does a good job of handling broad, role-based problems of anonymous users accidentally or deliberately overwriting data in a profile, (eg. Unwanted links "do this for different person" on membership signup page and How to delete "Not you or want to join..for a different person"?. Hiding the code from display is one way of solving the problem that stems from what I think is a design feature that may work well for many but in some cases like this, is sub-optimal. The message tends to appear for authenticated users, and the feature is illustrated by this help dialog for 'What to do upon duplicate match' in advanced settings for the relevant profile settings page:

If you are using the profile as a contact signup and editing form - this option controls what happens if the data matches an existing contact record. Using this option user can update the matching record or create a duplicate record or otherwise he will get a 'duplicate record' warning, and their input will not be saved.

However, it goes on to say:

This setting is ignored if the profile is embedded in an online > contribution, member signup or event registration form. In this case a contact match always results in the transaction being linked to the matching contact.

So, the message combined with the default "Individual Strict Duplicate Matching Rule" (match on email address) gives rise to a concern with existing contact data being over-written by authenticated visitors with many ACL's.

The solution given is as follows:

...if you NEVER want anonymous input to match (i.e. always create a new contact record) - edit that rule and set the 'weight threshold' higher than 10. You will then need to run Find Duplicates periodically using a different rule, and merge any duplicate records with their associated passports, contributions, etc.

For smaller outfits this seems like a fair bit of admin overhead, so if this is a concern I suggest setting up your own custom Main.tpl template file here:

[civicrm.root]/custom_templates/CRM/Contribute/Form/Contribution/Main.tpl

At around line 75 remove the link so it just leaves: {ts 1=$display_name}Welcome %1{/ts}.