I'm building a webform to create activities against existing contacts. I want to make it so that the user completing this webform about an existing contact can only use it on contacts that are legitimately accessible to them via the ACL. Otherwise you get a message saying no and you can't fill in the form.

Obvs I could do this in a hook, but I bet it's functionality that other people would love.

So rather than fumble and hack around, I'm asking the community, where in webform_civicrm would be the best place for this to go? Any other tips/advice/general suggestions?


  • 1
    I'm confused by this question. Webform-CiviCRM does by default respect ACLs. When you add an "Existing Contact" field it will not allow users to select anyone they don't have permission to see. Am I missing something?
    – Coleman
    Mar 6, 2017 at 21:16
  • The webform is only regarding one existing contact. So I want the whole form not to be accessible if that contact isn't. @Coleman
    – JohnFF
    Mar 7, 2017 at 9:52
  • You could use the "block unknown users" in the webform-civicrm "options" tab.
    – Coleman
    Mar 7, 2017 at 16:05
  • The user will always be known - it's making sure they can't use the webform to update the contact unless they have ACL access.
    – JohnFF
    Mar 7, 2017 at 17:53
  • 1
    I've added how you could give specific users with specific ACLs access (or not) to your webform. Mar 9, 2017 at 13:31

1 Answer 1


Have you seen this extension:


It makes the permission flag on a relationship work like a true ACL.

But then perhaps you don't have relationships to work with?

So: - create a relationship between your Primary Contact and the Contacts he/she has access to [e.g. Counselor and the kids in the Youth Program] - via webform_civicrm and the additional extension above you can pull in all a Counselor's Contacts on a webform -> with enforce permissions true - don't allow the Counselor to create new contacts - and lock a Contact's fields; that way the activity can only be created if the Counselor has the necessary permissions to view that contact.

To make the form not accessible to certain users who don't have the necessary permissions in CiviCRM (ACL) -> put your ACL allow users into a CiviCRM Group -> then use GroupRole Sync module to assign these users automatically to a Role when they login -> then configure your form such that only users with that role are allowed to Submit the form.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.