User can add themselves to any group

Question

There are a couple of posts, listed below, already on this topic - but I'd like to follow up:

SUMMARY

I can create an ACL role and limit access to a custom field group - which is seemingly wonderful. Data that should not be visible to everyone is not.

BUUUT any user (with the ability to edit a contact) can add users to an ACL group. I feel it renders ACL roles/restrictions pointless. (We have users who need to be able to edit a contact, to adjust contact information and such but shouldn't be privy to all the custom data in the system.)

How do I prevent a user from adding contacts to ACL groups?

Permissions, ACL and Groups

QUESTION Does anyone have feedback on the Group Protect extension? It looks very promising but the notes indicate it's a work in progress from early 2016. Or is anyone taking a different avenue to prevent users from adding themselves to ACL groups?

Answer 1

As you have noted, the big problem with the ACL group system is the lack of control around adding to groups. I've used the Group Protect extension previously and it does the job.

Answer 2

The ability to add groups to a contact depends on the visibility of groups for the user. The cms permissions "view all contacts" and "edit all contacts" grant visibility to all groups in the system.

You need to remove the cms permissions "view all contacts" and "edit all contacts" for this role and add an acl for each civicrm group that the contact should be able to view or edit. This way you can set permissions to edit/view contacts and restrict the visibility of groups.

Answer 3

We have found that limiting users in this way works well for access purposes, however, we have also found that users limited to groups in this way can create a contact that has no group. If they don't add a group, then they loose the ability to see or edit the contact they tried to add. Often, they then add the contact again. (and sometimes again).

Also, when adding a contact through Cases->New Case->New Organisation, it is not possible to add a group on that 'easy-add' screen.

It then takes an admin to login and add the group that the user forgot to add.

We can see no way of making the selection of a group compulsory (or a default) when a user adds a contact on the Contacts-->New Organisation screen.

We have treated this as a 'user coaching opportunity', emphasising that if they don't choose the right group, it's going to take extra time to get the data in, as they'll have to contact an admin to get the group added. At least all our users now know what to do if they forget to put a contact in the right group.

We also insist that a user creates an organisation before adding a case, so that the organisation is in the correct group.

Just thought I should mention these small issues we have found, and their work-rounds to hopefully save someone else the pain of working it out. Hope it helps.