3

As I understand it I can use CiviCRM's Access Control Lists to to control the groups that users can see and work with. But I'm not clear on a few points about this:

If a user does not have the permission to see a given group (for example in a list of groups) can they still see and work with the contacts in that group? Or to put it another way, when the ACL refers to a "group of contacts" does the permission that is granted by the ACL apply to the group, or the contacts within that group, or both?

And following on from that, if a contact is in two groups, and a user has permission to view one group but not the other, can the user see the contact at all?

Improve this question

1 Answer 1

Reset to default
5

The ACLs in CiviCRM are only additive. So assuming a user doesn't have the "View All Contacts" or "Edit All Contacts" permissions (which overrides all ACLs), the default is that a user can view zero contacts.

So to answer your second question: If you grant the user permission to access contacts in Group A, all contacts in Group A are accessible to the user - even if they're in Group B, which the user doesn't have access to.

This, in turn, should answer your first question - the ACL applies to the contacts in a group.

Improve this answer
4
  • 1
    Thanks for this @jon-g. A quick follow up to clarify: if the user cannot access contacts in Group A, can they see Group A listed in a listing of groups, or is the group hidden from them?
    – Graham
    Commented Sep 20, 2015 at 8:34
  • 1
    Generally speaking, the group is hidden from them - though I've seen instances where this wasn't the case. E.g. from Civi 4.6.0 to 4.6.6, the groups would still appear when selecting groups to do a mailing.
    – Jon G - Megaphone Tech
    Commented Sep 20, 2015 at 18:35
  • I am using Civi 4.6.10 and though some users are not given access to some groups, they can still see all groups listed in search /civicrm/contact/search?reset=1
    – Kboy
    Commented Nov 20, 2015 at 13:09
  • @ Jon G, I am using Civi 4.6.10 and though some users are not given access to some groups, they can still see all groups listed in search /civicrm/contact/search?reset=1. Is there anyway to hide group listing from the search? If the group is listed it means than user can still search for contacts in a group that they are not supposed to access if a contact exists in two groups (A and B) considering user has access to GroupA, will see contact in group B, only difference is that clicking on the contact's group tab doesn't show Group B.
    – Kboy
    Commented Nov 20, 2015 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.