In my organization, everyone raises support through Civi's typical donation processing. Because everyone can view all of the records (both contact and transactional), it's easy for people to see how much support someone else has. Is there a way to hide or limit the ability for most employees from seeing the financial information of other employees but yet see their own transactions and transactions associated with our general fund? I could also work with a solution that limits an employee's ability to see the information associated with a different employee. I'm using Civi 5.0.0.
4
-
as a side note, 5.0.0 is unlikely to be secure so it could be more than just other employees seeing contribution data– petednz - fuzion ♦Commented Jan 22, 2019 at 3:26
-
so Employee A may raise funds from Contact F and Contact G. But similarly Employee B may also raise money from Contact G. And you want Employee B to not see the Contributions raised by Employee A? But they do need to see other data and the Contributions they raised from Contact G?– petednz - fuzion ♦Commented Jan 22, 2019 at 3:28
-
We're working on getting Civi updated and should have that in place in the next couple of weeks. But yes, the A, F, G, B example from above is essentially correct.– J. RolfsCommented Jan 22, 2019 at 16:22
-
Thank you to everyone for the suggestions. I'll look into these solutions .– J. RolfsCommented Jan 22, 2019 at 16:23
Add a comment
|
3 Answers
There are a number of ways you could do your latter option.
A/ set up Groups of Contact for each Employee - then add the Contacts who they should see be able to see - then set up CiviCRM ACLs and remove the permission to View All Contacts - then they will only see those in their Group
B/ use the Permissioned Relationships extension and use this to supply the Access Control via civicrm Relationships
answered Jan 22, 2019 at 3:39
I think Pete might be a bit optimistic. Granting permissions to see everything EXCEPT for a few folks is convoluted. In fact, I doubt it's possible to do what you're describing by ACLs except by excluding employees from viewing other employees' contacts at all (not just contributions).
I think you're looking at a custom extension to hide just contributions of fellow employees.
answered Jan 22, 2019 at 3:48
Depending how flexible your requirements are, you could get part way there with Financial Type ACLs. You need to enable them under Administer > CiviContribute > CiviContribute Component Settings > Enable Access Control by Financial Type.
Then arrange for these donations to have a financial type of say 'Employee Support' and limit most people's access to not include access to that type. That way, they can continue to see other types of contributions but not these ones.
However, that (I think, but not tested) will also prevent employees from seeing their own support contributions but you might be able to find ways around that with Reports.
