Multi-Record Custom Data Set - Permissions (View/Edit)

Question

I am using some multi-record custom data sets and they are working well. I have been able to import records, use them in reports, use them in searches, add/edit and delete records. All seems to work fine for me except the authorization.

I have simple permissions - 1) Edit everything and 2) View Only. However, the multi-record custom data sets are open for update (add/edit/delete) for the view only users. The view only users cannot edit any other aspect of a contact yet they can do anything to a custom data set.

I have tried refining the permissions using ACLs for the custom data sets with the same result.

Is there something I can do to make the multi-record custom data sets not open for change?

We are using Drupal and CiviCRM 4.6

Answer 1

Probably not the answer you were hoping for :-(, but confirming that is a current limitation. ACL's for custom data do not distinguish between View & Edit. On the New ACL screen, when you set the type of data to custom data, a message is shown:

NOTE: For Custom Data ACLs, the 'View' and 'Edit' operations currently do the same thing. Either option grants the right to view AND / OR edit custom data fields (in all groups, or in a specific custom data group). Neither option grants access to administration of custom data fields.

It would be a useful enhancement to fix that, but you can't do what you want without writing code.

If you just want to deter some people from changing the data then adding a bit of jQuery to disable options would be fairly simple. That is not secure since a user can bypass it.

For a more robust approach, you could try hook_civicrm_validateForm.