0

I would like to limit access of some CiviCRM users, so they can only access contacts in certain smart groups. Meanwhile, I would like them to be able to edit Custom Fields.

I created a separate drupal role for these users.

Now, if I keep the Permission CiviCRM: edit all contacts, the user can access all contacts and edit all fields.

If I remove Permission: CiviCRM: edit all contacts and allow access to specific groups in ACL, the user can access contacts in these groups, but can't edit any fields including custom fields. (It is not possible to edit any fields even if I enable ACL for all, authenticated or specific role users to be able to edit custom groups.)

enter image description here

CiviCRM 4.7.14 on Drupal.

Improve this question
3
  • As Thomas has answered 'probably not possible', there may be a way you could work around by creating a profile in civiCRM or a webform in Drupal that just exposes the custom fields you want these users to have access to, as a way to further narrow the 'edit' permission.
    – Eli Lisseck
    Mar 6, 2017 at 13:45
  • Will the profile help, if I need the users to work inside the CiviCRM (e.g. create Actions for contacts - possible, edit Custom fields - impossible = bug of ACL?).
    – Aivars
    Mar 6, 2017 at 17:51
  • I see what you're saying now. I believe you're right, if users are already granted access to edit contacts in civiCRM, I don't believe that granularity of permissions exists right now. Someone else can feel free to correct me of course.
    – Eli Lisseck
    Mar 6, 2017 at 19:40

2 Answers 2

Reset to default
1

Your ACL allows to view and edit all custom fields sets. I guess you previously had CiviCRM: view all contacts to be able to see the contacts at all.

You still need to grant a view permission to access the contact or an edit permission to allow any modification to your desired set of contacts: ACL Edit Group Permission

I'm not aware that you can grant permission to edit custom fields without permission to edit the contact while using the UI.

Improve this answer
3
  • In fact I was not using drupal permission CiviCRM: view all contacts. Instead, I was using ACL which enabled specific role to view specific group. In this way the user could access the list of contacts (via direct link to smart group), but could not see contacts outside that list. The only problem is with giving the edit access to custom fields (or any fields) of only these contacts. Then I wonder if it is a bug that custom field edit does not work when configured as in my screenshot above.
    – Aivars
    Mar 6, 2017 at 17:20
  • 1
    You could alter that ACL to allow this role to edit this specific group. The note, as shown in your screenshot, already hints, that an ACL for custom data fields just allows the role to see those fields, with the same permissions as without this ACL.
    – Thomas Schüttler
    Mar 7, 2017 at 8:14
  • I thought ACL edit group means access to remove or add contacts to the group, not edit contact fields. This helps a lot, as long as there is no option to fine tune edit of specific custom fields.
    – Aivars
    Mar 7, 2017 at 14:15
1

I was keen to find out whether i can specify a user, given a WP role, can be limited to just a group of users and also just specific custom field groups for this group of users. On my system (CIVICRM 5.21.2/WP 5.4.2) i can do this by not allowing access to all records and to all custom data at the WordPress Permission for this WP role. Then i separately added an ACL to allow the Role to just access the specific Group, and added another ACL to allow the same Role to just access the specific Custom Field Group. This worked out for me.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.