0

I maintain our organization Wordpress website and want to set up an online membership registration. On the development site Wordpress is at 4.8.6 and we recently upgraded to Civi 5.0.0, but I recall having these problems on earlier versions.

I set up a contribution page with a profile for collecting contact data and custom fields. Problem is that the links "Not Site Tester-1, or want to do this for a different person? " appear on top of the form, indicating that the user is showing higher permission level than they should, no matter what I have tried. I have stripped the setup down the minimum here:

  1. User is logging into the site with only the Wordpress role "Anonymous".
  2. "Anonymous" Wordpress role has only "Profile Create" and "Make Online Contribution" actions checked in Civi's Wordpress access control.
  3. User's Civi contact belongs to a single group without any CiviCRM role or ACLs.
  4. Profile linked from contribution page is active for CiviContribute only.

With permissions stripped down this far the user cannot view or set the custom data fields of the profile, but the contact information remains part of the presented form. When the user clicks "do this for a different person", on the blank form presented he can enter another contact email and modify that user's contact record.

While testing I use Chrome for development and then bring up clean IE 11 browser with no cookies, cache, or history (InPrivate mode), or open a Chrome incognito window for site testing.

Where else should I look, or what's the best way to track down where the extra permissions are coming from? Could other Wordpress roles (there are several custom roles) be interfering with access checks?

  • Are you saying an anonymous/incognito visitor to the public facing version of the Contribution page sees "Not Site Tester-1, or want to do this for a different person? ". Or do you mean logged in WP Users? If you mean the latter then each WP User should be seeing their user name' in that line. is that what they are seeing? – petednz - fuzion Apr 22 '18 at 19:39
  • 1
    After further thought and experimentation I don't think the system is behaving unexpectedly. When a truly anonymous site visitor accesses the contribution page, there is no header line "Not xxx, or want to do this for a different person." because the system does not have a contact ID for the current user. If there is a contact ID available, either because the user has logged in to the site, or because the user has a checksum token, then the header line is present. If the user clicks on the header, they get a blank for to fill out, just as if they were coming in truly anonymous. – PhilF Apr 25 '18 at 17:02
  • 1
    I'm going to expand on this in another posting about the potential database integrity issue if you use emailed checksum tokens that require "profile create" and maybe "access custom data" permissions for anonymous users. – PhilF Apr 25 '18 at 17:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.