6

This may be a shortcoming or bug to-do with access control, but maybe I'm missing something.

I've setup Drupal permissions and ACLs and they are working 100% except for one thing: users can only view the groups for which they explicitly have an ACL for. In other words, only users with CMS permission to "View all contacts" can view groups they themselves created.

Am I correct in assuming that this is a shortcoming, or is it a bug? Either way, what are y'alls suggestions for allowing users be able to create, edit and manage their own groups without giving them "View all contacts"? Is there a way to do it using hook_civicrm_aclWhereClause?

3 Answers 3

2

Yes, this is a shortcoming in the current acl system.

One possible workaround for this might be to implement the post hook on the civicrm_group object. The post hook can take the contactID of the person creating the group and add an ACL giving this person access to the group.

You can implement the above hook in an extension. Probably worth considering including this in core need on a setting

3
  • Thank Donald. I looked at the group object and none of the fields appeared to offer any permissions control more than what was on the create group form, so I think this is a dead end.
    – bdombro
    Commented Apr 23, 2015 at 21:46
  • You will need to use the post hook to create the relevant ACLs for that group. The group object does not have any permissioning fields. Commented Apr 25, 2015 at 3:26
  • Ohhhhh, I see what you are saying: create a new ACL for every new group. The downside is the the # of ACLs could go up quickly it there are a lot of groups, but good idea!
    – bdombro
    Commented Apr 26, 2015 at 7:28
1

I a temporary workaround until I have time to fix permissions. It hooks the create group form and prevents users from creating groups whom don't have permission to "edit all contacts".

function memberperms_civicrm_buildForm( $formName, &$form ) {
    if (strpos($formName, "AddToGroup")
        and
        !CRM_Core_Permission::check('edit all contacts')
    ) {

        // Display Error Message
        CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");

        // Redirect to civicrm home
        drupal_goto("civicrm"); 
    }
}
1
  • Hey @bdombro. Any update on this? How did you manage to solve it eventually? Do you know if there is any relevant functionality incorporated in newer CiviCRM versions? Thnx for you time! Commented Apr 17, 2019 at 17:02
0

This is old, but just in case anyone finds it, I think my Auto Group Extension solves this problem.

CiviCRM AutoGroup extension

This extension allows you to choose a set of groups which will be added to new contacts if the logged in contact is also in that group.

e.g. If Staff member Wilma is in the group 'Region: Birmingham' and Wilma adds a new contact, it can automatically add the new contact into 'Region: Birmingham' group.

Why this was created

If you are using Access Control Lists (ACLs) to restrict access based on groups, e.g. a client of ours has a regional model whereby staff in different regions only access contacts for that region, then it's annoyingly easy to add a contact and immediately lose access to it because you forgot to add them into your regional group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.