2

I am using some multi-record custom data sets and they are working well. I have been able to import records, use them in reports, use them in searches, add/edit and delete records. All seems to work fine for me except the authorization.

I have simple permissions - 1) Edit everything and 2) View Only. However, the multi-record custom data sets are open for update (add/edit/delete) for the view only users. The view only users cannot edit any other aspect of a contact yet they can do anything to a custom data set.

I have tried refining the permissions using ACLs for the custom data sets with the same result.

Is there something I can do to make the multi-record custom data sets not open for change?

We are using Drupal and CiviCRM 4.6

2

Probably not the answer you were hoping for :-(, but confirming that is a current limitation. ACL's for custom data do not distinguish between View & Edit. On the New ACL screen, when you set the type of data to custom data, a message is shown:

NOTE: For Custom Data ACLs, the 'View' and 'Edit' operations currently do the same thing. Either option grants the right to view AND / OR edit custom data fields (in all groups, or in a specific custom data group). Neither option grants access to administration of custom data fields.

It would be a useful enhancement to fix that, but you can't do what you want without writing code.

If you just want to deter some people from changing the data then adding a bit of jQuery to disable options would be fairly simple. That is not secure since a user can bypass it.

For a more robust approach, you could try hook_civicrm_validateForm.

  • It is already in Jira, see issues.civicrm.org/jira/browse/CRM-16303 – Kainuk - CiviCooP Jan 16 '17 at 8:51
  • Forget the advanced CiviCRM ACL. The basic Content Management System (CMS) Access Control does not work! Are you saying even the basic Drupal Access Control cannot prevent the editing of multi-record custom data sets? – Ron Gridley Jan 16 '17 at 11:20
  • Yes - if you look at the available Drupal permissions there is 'access all custom data' but not a separate 'edit' permission. The Access Control system does work, but it may not do what you would like it to. You can change that if it is important to you: as an Open Source product, it grows by people encountering things they want to improve and sponsoring those changes. – Aidan Jan 17 '17 at 10:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.