Webform: recommended permissions handling when using existing contact feature

Question

I'm wondering how other developers configure permissioning for webforms where related contacts are shown. Here's the setup:

• webform is configured to display two contacts -- the logged in user and a related org
• the "existing contact" element is used for both contacts. the issue arises for the related org contact
• we are using the static widget and the option to use contact id from url

However, when cid2=# is passed in the URL, it doesn't load the organization contact unless the logged in user has the "edit all contacts" permission. I understand I could flag the relationship as permissioned and use the relationship ACL extension, but I don't really want to universally grant the user the ability to edit the related contact -- just grant access in this webform. And I definitely don't want to grant the edit all contacts permission.

Any suggestions on ways to handle this? Should I just modify permissions via hooks on this form? It seems like this would be a common use case so I'm wondering if there's something in the webform integration that I'm missing.

Answer 1

Not that I'm aware of. Permissions in CiviCRM typically follow the logic "you either have permission to access this contact, or you don't." There isn't really a concept of having permission to access a contact on one form but not in other contexts.

A different approach would be to disable permission checks for the org field on that form, but only allow trusted users to access the form (who are not likely to abuse it by hacking other cids into the url).