4

I am trying to restrict a set of users to edit specific fields. The fields I want to restrict are all custom fields (but it would also be useful to restrict edit privileges on standard address fields).

I am going round in circles on Wordpress user accounts/permissions, ACL roles, profiles, groups etc.

So essentially i want some fields editable, others view only.

4

Unfortunately I don't think this is possible through the UI. As far as I know the ACLs for custom fields only have a combined view/edit permission - it's both, or nothing. Similarly I don't think it's possible to hide address data out of the box.

If you wanted to stop them viewing the custom fields altogether, you could turn off their access to custom data, then create ACLs for any custom fields you do want them to see:

  1. Assign the users to a particular role within WordPress. By users, I mean the WordPress users - so the usernames they use to log into the website.
  2. Go to WordPress Access Control and make sure they don't have the 'access all custom data' permission
  3. Create a new group in Civi with the type 'Access Control'. Add the Civi record of all the above users to it (Each user login should have an associated record in Civi)
  4. Go to 'Users and Permissions' -> 'Access Control' -> 'Manage Roles' and create a new role. For example, we have 'Office users', 'Home users' etc.
  5. Go to 'Access Control' -> 'Assign Users to Roles' and assign the group from #3 to the role in #4. You could add multiple groups to this role if you wanted.
  6. Go to 'Access Control' -> 'Manage ACLs' and add an ACL. Use the role from #4, the Operation 'Edit', the type of data 'A set of custom data fields', then select the appropriate custom fields.
  7. Remember that these users will only be able to access the custom fields that you specifically allow them to on this screen. So you may need to create multiple ACLs, and create new ACLs when you create new custom fields in future.

It's probably worth playing around with ACLs just to check there's no way to set a view-only permission, just in case the functionality is there but the UI hasn't caught up.

It might be possible using permission hooks, though - I'll leave that for someone better informed than me.

  • This is the correct answer. You can write an extension/have someone write it for you. You can also submit this to the Paid Issue Queue (civicrm.org/paid-issue-queue) - I think this is an excellent example of a feature that could benefit from the paid issue queue! – Jon G - Megaphone Tech Jul 29 '15 at 21:11
0

check out this documentation: http://book.civicrm.org/user/current/initial-set-up/permissions-and-access-control/

If you want to restrict edit privileges of standard address field, you might have to set the fields in a profile

  • Unfortunately, this doesn't solve the problem, because of this in-UI warning: NOTE: For Custom Data ACLs, the 'View' and 'Edit' operations currently do the same thing. Either option grants the right to view AND / OR edit custom data fields (in all groups, or in a specific custom data group). Neither option grants access to administration of custom data fields. – Jon G - Megaphone Tech Jul 29 '15 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.