0

I would like to limit access of some CiviCRM users, so they can only access contacts in certain smart groups. Meanwhile, I would like them to be able to edit Custom Fields.

I created a separate drupal role for these users.

Now, if I keep the Permission CiviCRM: edit all contacts, the user can access all contacts and edit all fields.

If I remove Permission: CiviCRM: edit all contacts and allow access to specific groups in ACL, the user can access contacts in these groups, but can't edit any fields including custom fields. (It is not possible to edit any fields even if I enable ACL for all, authenticated or specific role users to be able to edit custom groups.)

enter image description here

CiviCRM 4.7.14 on Drupal.

  • As Thomas has answered 'probably not possible', there may be a way you could work around by creating a profile in civiCRM or a webform in Drupal that just exposes the custom fields you want these users to have access to, as a way to further narrow the 'edit' permission. – Eli Lisseck Mar 6 '17 at 13:45
  • Will the profile help, if I need the users to work inside the CiviCRM (e.g. create Actions for contacts - possible, edit Custom fields - impossible = bug of ACL?). – Aivars Mar 6 '17 at 17:51
  • I see what you're saying now. I believe you're right, if users are already granted access to edit contacts in civiCRM, I don't believe that granularity of permissions exists right now. Someone else can feel free to correct me of course. – Eli Lisseck Mar 6 '17 at 19:40
1

Your ACL allows to view and edit all custom fields sets. I guess you previously had CiviCRM: view all contacts to be able to see the contacts at all.

You still need to grant a view permission to access the contact or an edit permission to allow any modification to your desired set of contacts: ACL Edit Group Permission

I'm not aware that you can grant permission to edit custom fields without permission to edit the contact while using the UI.

  • In fact I was not using drupal permission CiviCRM: view all contacts. Instead, I was using ACL which enabled specific role to view specific group. In this way the user could access the list of contacts (via direct link to smart group), but could not see contacts outside that list. The only problem is with giving the edit access to custom fields (or any fields) of only these contacts. Then I wonder if it is a bug that custom field edit does not work when configured as in my screenshot above. – Aivars Mar 6 '17 at 17:20
  • 1
    You could alter that ACL to allow this role to edit this specific group. The note, as shown in your screenshot, already hints, that an ACL for custom data fields just allows the role to see those fields, with the same permissions as without this ACL. – Thomas Schüttler Mar 7 '17 at 8:14
  • I thought ACL edit group means access to remove or add contacts to the group, not edit contact fields. This helps a lot, as long as there is no option to fine tune edit of specific custom fields. – Aivars Mar 7 '17 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.