If I create a profile for search/listings, and provide access to that profile to some class of users, the profile results will include all contacts matching the search criteria, even though the current user doesn't have view or edit access to many of those contacts.

  1. Create a simple search/listings profile with only the ContactID field.
  2. Make this profile available to a contact group including user Mary (via ACLs and/or CMS permissions)
  3. Log in as Mary.
  4. As Mary, access CiviCRM back-office area, use the standard Find Contacts search with no criteria to display all visible contacts; observe X results, where X is the number of contacts whom Mary can view considering ACLs, permissioned relationships, etc.
  5. As Mary, access the search/listings profile from step 1, and submit with no criteria to display all possible results; observe Y results, where Y is the total number of contacts in the system. I.e., Mary can see everyone in the CRM through this profile.

How can I configure this profile so that it only returns the X contacts that Mary actually has permission to view?

  • There are a few CMS permissions related to profiles including "CiviCRM: profile listings" and "CiviCRM: profile listings and forms" which have the warning "Give to trusted roles only, this permission has privacy implications". Does Mary have those permissions? Does removing those permissions provide the result you want? – Aidan Jul 9 '20 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.