2

We manage a site for a charity working with victims of domestic violence.

They work in 5 separate locations , and the organisation's preference is for staff working in a given area only to be able to access contact records (for staff and clients) in that area.

(In the past they have had to deal with relatives of offenders who have become staff members in different locations in order to access victim's details from their system).

Initially they worked across 3 locations and ACL's worked fine. As there work expanded and more projects came on line, the number of ACL roles and number of extra groups to give access to has expanded. Additionally some staff work across more than one project/ ACL role.

Intermittently the ACL rules fail, and staff members can see fewer contacts within a group than are in it. ie. Location Contact group has 729 members, when Staff Member A views that group from a find contacts search she see's 149 contacts.

(I've checked this using the Drupal Masquerade module).

It seems to me that multiple ACL roles are conflicting with one another, and restricting the number of contacts the staff member can view.

I've fixed this in the past, by deleting ACLs and rebuilding from scratch. Eventually this falls over and we need to do that again.

Has anyone experienced anything like this?

Any ideas what may be causing this intermittent problem?

Drupal 7.39 Civi 4.4.21

Improve this question
4
  • Have you seen this? issues.civicrm.org/jira/browse/CRM-18127. was just talking with a client about how their ACL were not working, and then suddently they started again while he was testing. Have you tried clearing caches?
    – petednz - fuzion ♦
    Commented Mar 9, 2016 at 19:31
  • No, I hadn't seen it. It's not quite the same. If I search for a group in Find Contacts, as admin, I see 1-1059 group members. If I search masquerading as Staff Member I see 1-149 group members, but can access all that I see. And, yes we've tried clearing cache.
    – Craig Almond
    Commented Mar 10, 2016 at 16:18
  • wonders aloud if this has any similarity with other situations we have seen where Smart Groups have become malformed (broken) which can cause the group cache build to be interupted
    – petednz - fuzion ♦
    Commented Mar 10, 2016 at 20:44
  • As in staff member adds client to smart group?
    – Craig Almond
    Commented Mar 11, 2016 at 11:41

1 Answer 1

Reset to default
1

Craig - I can't comment on why you might have conflicting ACLs, but want to mention the Permissioned Relationships as ACLs which we built and contributed to provide another solution for multi-level permissioning. You can read about it via the link, but it may suit your need and deals easily with the situation of Staff Member Q needing to access the contacts in two regions, but giving Q a relationship with Region A and Region B, and therefore seeing all those contacts that the Region A and B have permission to access.

Improve this answer
1
  • Hi Pete, Yeah, I'd thought of configuring households to be projects, but guess it would work as well if they were an organisation sub-type. I looked at this last year but with the amount of custom data to reconfigure I think the site would need to come off line for a week to rebuild everything. And the client didn't want down time. May have to bite the bullet on that in some way though.
    – Craig Almond
    Commented Mar 9, 2016 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.