1

I'm obviously missing something...

Wordpress / civicrm 5.4

I have a contribution / membership renewal page to allow members to renew. They need to log in before veiwing the page It presents them with their contact info via a profile and allows them to change any incorrect info and then asks them to select their membership type and pay. All seems to work great!

Except for the link that says 'want to do this for someone else?' If they click on this and happen to know the email address of another member seems they can rewrite all their contact info?!

I don't seem to be able remove this link.

The above is obviously bonkers. But what am i doing wrong please? Is the 'do for different person' link removable? Is it not possible to limit the ability of members to update info to their own records? Is there a permission I need to set somewhere? Or do I just need to separate out the processes for making contribution from the process for maintaining contact info?

thank you:)

2

Have you tested this as a regular user and not as an admin or higher-level user? There should be a set of permissions that define whether or not users can edit their accounts, the accounts of others, etc. Make sure "edit all contacts" is only select for the appropriate role(s).

Here's what they look like in Drupal, for an idea:

enter image description here

  • 1
    The question is wordpress related and I agree with Christia but you should find out how set permissions in wordpress. I dont know how to do that. Have a look at the documentation: docs.civicrm.org/user/en/latest/initial-set-up/… – Jaap Jansma - CiviCooP Aug 23 '18 at 7:38
  • thanks both, from what I can see it seems like it is not a good idea to expose profile fields in contribution pages as they can be easily overwritten. i'll look into permissions too though to see if it can limited. – dgk112 Aug 23 '18 at 15:22
  • having profile fields on Contribution pages is totally fine - you just need to sort out your permissions so the average user cannot fill in the form 'as someone else' – petednz - fuzion Aug 23 '18 at 21:25
1

I do not know if you can achieve this with configuration. However, it can be coded. The idea is that section you want to hide is marked with a unique css class crm-not-you-message.

Create an extension (see https://docs.civicrm.org/dev/en/latest/extensions/).

Create a file in the extension with the name <extensiondir>/templates/CRM/Contribute/Form/Contribution/Main.extra.tpl

Add the following code to the file

{literal}
  <!-- ui removing link -->
  <script type="text/javascript">
     CRM.$('.crm-not-you-message').hide();
  </script>
{/literal}

This code is appended (due to workings of the CiviCRM extension) to the page. The CRM.$ function selects the elements and hides it.

  • thanks for this. could you clarify please will this 'hide' the link as in just making it not visible? will it still be in the page source code? – dgk112 Aug 23 '18 at 15:23
  • It is still visible in the page source code. So it prevents mischief of the general user but does not make the page safe for more users that can code. That can be also done but is more complicated. – Kainuk - CiviCooP Aug 23 '18 at 17:43
  • ok - thank you Kainuk for your help:) – dgk112 Aug 23 '18 at 18:02
0

Editing the ACL configuration does a good job of handling broad, role-based problems of anonymous users accidentally or deliberately overwriting data in a profile, (eg. Unwanted links "do this for different person" on membership signup page and How to delete "Not you or want to join..for a different person"?. Hiding the code from display is one way of solving the problem that stems from what I think is a design feature that may work well for many but in some cases like this, is sub-optimal. The message tends to appear for authenticated users, and the feature is illustrated by this help dialog for 'What to do upon duplicate match' in advanced settings for the relevant profile settings page:

If you are using the profile as a contact signup and editing form - this option controls what happens if the data matches an existing contact record. Using this option user can update the matching record or create a duplicate record or otherwise he will get a 'duplicate record' warning, and their input will not be saved.

However, it goes on to say:

This setting is ignored if the profile is embedded in an online > contribution, member signup or event registration form. In this case a contact match always results in the transaction being linked to the matching contact.

So, the message combined with the default "Individual Strict Duplicate Matching Rule" (match on email address) gives rise to a concern with existing contact data being over-written by authenticated visitors with many ACL's.

The solution given is as follows:

...if you NEVER want anonymous input to match (i.e. always create a new contact record) - edit that rule and set the 'weight threshold' higher than 10. You will then need to run Find Duplicates periodically using a different rule, and merge any duplicate records with their associated passports, contributions, etc.

For smaller outfits this seems like a fair bit of admin overhead, so if this is a concern I suggest setting up your own custom Main.tpl template file here:

[civicrm.root]/custom_templates/CRM/Contribute/Form/Contribution/Main.tpl

At around line 75 remove the link so it just leaves: {ts 1=$display_name}Welcome %1{/ts}.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.