1

I'm working on a CiviCRM system which has volunteers who we need to restrict access to specific contact information.

I've created a group for the Volunteers as well as a group (called Private Contacts) for those people whose contact information needs to be hidden. I also created an ACL for Volunteers and a Group for Volunteers and placed the Volunteers into the Group. I also setup an ACL allowing them to view Contacts in All Groups.

The result is the Volunteers are getting full access to all the contact information for the users in the Private Contact group.

So far, all I can see are ways to enable access to things (like enabling access to View the groups) but I can't see how to restrict access to anything.

Is there a setting that I am missing?

For example, if I want to hide the mailing address or cell phones for the volunteer users. Or, better yet, if the volunteer users were not able to view the list of contacts that are part of the Private Group.

Improve this question
2
  • have you also confirmed what CMS roles and permissions they have. sounds like you need to restrict things there.
    – petednz - fuzion ♦
    Feb 11, 2022 at 2:36
  • I created a CMS role called 'volunteer' though I'm not sure what capabilities I would need to alter in order to restrict their access to the 'Private Group'
    – flantascience
    Feb 15, 2022 at 15:05

1 Answer 1

Reset to default
2

So far, all I can see are ways to enable access to things (like enabling access to View the groups) but I can't see how to restrict access to anything.

Yes - that's the key to understanding these permissions. A user starts with no permission and is granted bits of access via the CMS permissions and ACL's.

If a user should have access to all contacts you will normally grant that via the 'CiviCRM: view all contacts' CMS permission - and in a simple setup where all users see all contacts then all users will have that permission.

So if you want your Volunteers not to view those in the Private Group, you need to remove the 'CiviCRM: view all contacts' CMS permission from the Volunteers and then grant them access to all contacts except those in Private Group. You also need to make sure that non-volunteers can access Private Group contacts, so you may want your Volunteers to be a different CMS role from non-volunteers.

That is awkward and a better way of handling the scenario you describe would be useful.

Improve this answer
1
  • Unfortunately, following this approach, every time a new group is created, there will be an extra step of going to add access to the new group to the non-volunteers access control. This is not desirable because access control is more of an admin privilege and will make things difficult for an average user.
    – flantascience
    Feb 15, 2022 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.