I'm a bit stumped on permissions. I'm trying to create a user role that can
- See and edit any user
- See and edit custom fields for the user
- NOT see or edit activities for any user
- NOT see any financial information for any user
I tried this combination of settings:
- CiviCRM: view all contacts : CHECKED
- CiviCRM: view all activities : NOT CHECKED
- CiviCRM: Delete activities : NOT CHECKED
- CiviCRM: access CiviCRM backend and API : CHECKED
- CiviCRM: access Contact Dashboard : CHECKED
This arrangement seems to allow the user to see all contacts but also all activities on all contacts.
If I remove "CiviCRM: view all contacts" then the user can see no contacts at all, and no activities.
I don't really understand why "view all contacts" gives access to see activities when the activity permissions are turned off. That seems counterintuitive.
And I can't find a combination of permissions that allows a user to see/edit all users, but not see/edit any activities.
Suggestions?
(CiviCRM 5.8.2 on Drupal 7. I'm aware a security update is needed to CiviCRM.)
