0

Using Wordpress 5.4.1 with Civi 5.24.3.

We have a smart group used for ACL which prevents the core "Edit" button being shown on the contact summary.

There is also an ACL entry for a group of contacts to view/edit a custom data group.

However, contacts that are not in the ACL for the smart group are able to add and edit custom data (for all contacts, regardless of their ACL group).

How can I use ACLs to prevent a contact view and editing custom data for contacts who are not in their ACL group?

If I add the required ACL entry to give access to the custom data group, this allows them to edit ALL contacts' custom data, which seems contrary to the documentation.

0

Can you try applying the PR changes to your current version of civi? you will need to apply it manually as the pr is closed and is very old. If you will apply it manually than it may give you conflicts errors.

| improve this answer | |
  • Hi @pradpnayak I've applied those changes manually to the version 5.24.3 codebase and it does work on restricting the edit links for tables, but sadly the "Add new record" button is always hidden for everyone, so not even an admin can add values. Would this be something relativly easy to fix? – Darren May 7 at 15:39
  • @pradpnayak I've reverted the code in the template file: templates/CRM/Profile/Page/MultipleRecordFieldsListing.tpl so the button is always shown. If a user without permissions clicks the button, they receive an error which I think is acceptable behaviour. But it would be great to simply not show it. – Darren May 7 at 15:48
  • @pradpnaya sadly we now have a bug where the Contact Summary Layout extension is no longer changing the layout for contacts the user doesn't have permissions to edit (But they do have view permissions). – Darren May 7 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.