6

I would like to confirm this statements regarding permissions, ACL and groups (Wordpress 4.7.1, civicrm 4.7.15)

  1. Permission to edit contacts (ACL or general), allows user to assign contacts to ANY group
  2. As 1 is true, user can add himself to another group and thus obtain its ACL related permissions

This is a serious issue for us as it hinders the flexible security management ACL provides. I would like to evaluate viability of a feature to solve this problem. I see two approaches:

  1. A general permission (not ACL related, in wordpress related to wordpress user role) which would control assignment to control access groups (this will be enough for our organization)
  2. As 1, combined with ACL permissions (p.e. denied general permission but allowed assignment to certain control access groups through ACL)

I would be capable to work in any of this approaches (1 in first phase, then 2) but I am not yet very familiar with civicrm code structure. Can you point out the possible problems and difficulties of implementation of these features? Is there any related isssue in Jira?

Thank you

  • I ran into the same issue. It's rather insane behaviour if you ask me. – Nuoji Feb 2 '18 at 10:23
0

Permissions control is not related to Civi groups. It is controlled by WordPress user roles as you suggest for #1 fix. You should have no trouble from a security management stand point to set it up so staff cannot assign themselves to other roles.

You might want to add this plugin for better control. https://www.role-editor.com/

  • Ok, maybe my question was not clear enough: - Permission control is related to Civi (access control) groups when using ACL - Possible permissions: "permission to change own group" or "assign user to control access groups" is not included in civicrm (wordpress)role-related permission set (phase #1 will change that) - Problem described is not related to user changing his/her own role but changing his own access control group and (through it) its ACL related permissions – Daniel Martínez Feb 17 '17 at 10:55
  • There is a difference between WordPress User (create/edit/delete) and Civi Contacts (create/edit/delete). If you follow my answer above--Your Admin Role has access to WP User create/edit/delete (they are the only ones that can set Civi ACLs). You create your other Roles that need access to edit Civi contacts without WP User access and they cannot assign themselves to other ACL groups. Maybe my User Roles look different because I use the above mentioned plugin. – Iowa Boy Apr 26 '17 at 2:52
  • Even if WP user does not have WP user-related perms, it can change its contact's own groups in the CRM database, giving him civi permissions related to those groups (i.e. "London manager" can assign himself to group "Paris manager" giving him access to Paris contacts) – Daniel Martínez May 10 '17 at 12:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.