1

I don't believe that I am accomplishing a task correctly, and I'm afraid that I've opened things up too much.

I have given Subscriber level WordPress users access to CiviCRM: access CiviCRM. This allows access to the Dashboard: https://example.org/civicrm/?page=CiviCRM&q=civicrm/user&reset=1

Once there, then they can see and edit their donations, but only after giving access to CiviContribute: edit contributions.

The Dashboard seems to be a very useful feature, but I feel like I'm giving too much access in the ACL's. With the above scenario, if I have access to the back end of Civi, I can now search for other people and change their contributions also, right? How should I be doing this? I feel like I'm missing something in the documentation, but can't seem to hit the right keywords.

Wordpress 4.2.2, CiviCRM 4.7.3

  • I'm wondering if I have a bigger issue. Should a user with Subscriber access be able to visit the dashboard link above without any extra rights given once they have logged in? – G H Mar 3 '16 at 21:39
  • Update: This particular piece of the issues looks like a problem with a WooCommerce plugin conflict. – G H Mar 4 '16 at 16:59
2

Is it possible to sign up as a subscriber without admin approval? If so remove the access CiviCRM permission right now!!! There is no way that with a publicly available account that I should be able to get any level of access to CiviCRM.

Apologies if I misunderstood and all subscribers need to be approved. Your case may be an instance where you want a custom portal - lots of orgs do this. Even then, they generally (is my understanding) allocate what can and can't be accessed without the access CiviCRM permission.

John

  • Ok. That's what I was afraid of. So, a custom portal sounds interesting. However, I'm not finding much on how to get started. Got any leads? – G H Mar 3 '16 at 15:27
  • Additionally, there seems to be a disconnect between documentation and actuality in this area. The docs say that WordPress users should be created automatically through the profile, but you are saying they need to be approved, which makes sense. Did I miss something, or am I just seriously confused again? – G H Mar 3 '16 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.