I maintain our organization Wordpress website and want to set up an online membership registration. On the development site Wordpress is at 4.8.6 and we recently upgraded to Civi 5.0.0, but I recall having these problems on earlier versions.
I set up a contribution page with a profile for collecting contact data and custom fields. Problem is that the links "Not Site Tester-1, or want to do this for a different person? " appear on top of the form, indicating that the user is showing higher permission level than they should, no matter what I have tried. I have stripped the setup down the minimum here:
- User is logging into the site with only the Wordpress role "Anonymous".
- "Anonymous" Wordpress role has only "Profile Create" and "Make Online Contribution" actions checked in Civi's Wordpress access control.
- User's Civi contact belongs to a single group without any CiviCRM role or ACLs.
- Profile linked from contribution page is active for CiviContribute only.
With permissions stripped down this far the user cannot view or set the custom data fields of the profile, but the contact information remains part of the presented form. When the user clicks "do this for a different person", on the blank form presented he can enter another contact email and modify that user's contact record.
While testing I use Chrome for development and then bring up clean IE 11 browser with no cookies, cache, or history (InPrivate mode), or open a Chrome incognito window for site testing.
Where else should I look, or what's the best way to track down where the extra permissions are coming from? Could other Wordpress roles (there are several custom roles) be interfering with access checks?