CiviCRM Webform - enforce ACL permissions

Question

I'm building a webform to create activities against existing contacts. I want to make it so that the user completing this webform about an existing contact can only use it on contacts that are legitimately accessible to them via the ACL. Otherwise you get a message saying no and you can't fill in the form.

Obvs I could do this in a hook, but I bet it's functionality that other people would love.

So rather than fumble and hack around, I'm asking the community, where in webform_civicrm would be the best place for this to go? Any other tips/advice/general suggestions?

Thanks,

Answer 1

Have you seen this extension:

https://civicrm.org/extensions/relationship-permissions-acls

It makes the permission flag on a relationship work like a true ACL.

But then perhaps you don't have relationships to work with?

So: - create a relationship between your Primary Contact and the Contacts he/she has access to [e.g. Counselor and the kids in the Youth Program] - via webform_civicrm and the additional extension above you can pull in all a Counselor's Contacts on a webform -> with enforce permissions true - don't allow the Counselor to create new contacts - and lock a Contact's fields; that way the activity can only be created if the Counselor has the necessary permissions to view that contact.

To make the form not accessible to certain users who don't have the necessary permissions in CiviCRM (ACL) -> put your ACL allow users into a CiviCRM Group -> then use GroupRole Sync module to assign these users automatically to a Role when they login -> then configure your form such that only users with that role are allowed to Submit the form.