1

I created a simple permission structure where a group of CiviCRM users ("Group A") has write access to a group of contacts ("Group B"). (Every logged in user has read access.)

When a contact is now added to "Group B", users of "Group A" see the edit button on the contact and can add/remove the contact to/from groups on the contact detail page. When removing the contact from "Group B", the edit button disappears. So far, everything as expected.

But when using the actions menu from the search results, users can add/remove group assignments of a contact which is not in "Group B".

Isn't this an inconsistency in the permission system? Or am I missing something? How to avoid group membership changes of contacts which are not in "Group B" by users which are in "Group A"?

I'm using the newest CiviCRM version 5.63.1 under WordPress.

2
  • So users in group A are permitted to see contacts that are not in group B? i.e. they can see contacts in group C?
    – Andy Clark
    Jul 14, 2023 at 13:15
  • Yes, every logged in user has read access to all contacts.
    – Schorschii
    Jul 15, 2023 at 9:28

1 Answer 1

1

I think it is quite possible that the bulk group add and remove doesn't implement ACLs, which should prevent this. If you can replicate the issue on the wpmaster demo, then you should post an issue on Gitlab.

1
  • Thanks. I created an issue on Gitlab.
    – Schorschii
    Jul 15, 2023 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.