0

I have observed the following behaviour during testing an ACL-Setup. Could anyone let me know if this is the expected behaviour and if there are any more or less particular plans to change that in the future?

A user is only granted access (via ACL) to a limited group of contacts - that seems to work fine. The user will also be able to create groups via the CiviCRM UI - that makes sense too.

However the user won't be able to add contacts visible to them to the group they just created unless an administrator creates another ACL Permission explicitly for that group.

For me the expected result would have been that the user can add visible contacts to any CiviCRM Group (unless maybe it is an acl-group). I think that was also the behaviour in earlier CiviCRM Versions (I am currently testing on 5.51.1). I suspect that something was changed in CiviCRM Core because users used to be able to add themselves to ACL-groups thus escalating privileges.

In short I would be happy to get some feedback on:

  • Is this a bug or a feature?
  • Is there any documentation / information on the (changed) behaviour described here? Such as adding CMS-permissions to add contacts to regular groups, ACL groups etc...
  • Are there any plans to further change / adapt / extend the behaviour of ACLs in CiviCRM?
3

1 Answer 1

0

If you are using groups as the criteria for your ACLs, this extension might help to make the process more intuitive: https://civicrm.org/extensions/autogroup-helper-for-group-based-acl-environments

I tend to use either custom fields for the ACL criteria, or addresses, and then use ACL hooks to programmatically implement the ACLs (if you have more than a dozen 'groups', then managing the ACLs using the admin interface is a lot of clicking to setup).

Although if you use custom fields or addresses for ACLs, then you also have to make sure that group/regional-admins cannot change those values so that they can access other groups (ex: using a 'post' hook that will throw an error if an invalid update is attempted, and monitoring changes to those values).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.