Allowing group management to users with limited permissions

Question

This may be a shortcoming or bug to-do with access control, but maybe I'm missing something.

I've setup Drupal permissions and ACLs and they are working 100% except for one thing: users can only view the groups for which they explicitly have an ACL for. In other words, only users with CMS permission to "View all contacts" can view groups they themselves created.

Am I correct in assuming that this is a shortcoming, or is it a bug? Either way, what are y'alls suggestions for allowing users be able to create, edit and manage their own groups without giving them "View all contacts"? Is there a way to do it using hook_civicrm_aclWhereClause?

Answer 1

Yes, this is a shortcoming in the current acl system.

One possible workaround for this might be to implement the post hook on the civicrm_group object. The post hook can take the contactID of the person creating the group and add an ACL giving this person access to the group.

You can implement the above hook in an extension. Probably worth considering including this in core need on a setting

Answer 2

I a temporary workaround until I have time to fix permissions. It hooks the create group form and prevents users from creating groups whom don't have permission to "edit all contacts".

function memberperms_civicrm_buildForm( $formName, &$form ) {
    if (strpos($formName, "AddToGroup")
        and
        !CRM_Core_Permission::check('edit all contacts')
    ) {

        // Display Error Message
        CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");

        // Redirect to civicrm home
        drupal_goto("civicrm"); 
    }
}

Answer 3

This is old, but just in case anyone finds it, I think my Auto Group Extension solves this problem.

CiviCRM AutoGroup extension

This extension allows you to choose a set of groups which will be added to new contacts if the logged in contact is also in that group.

e.g. If Staff member Wilma is in the group 'Region: Birmingham' and Wilma adds a new contact, it can automatically add the new contact into 'Region: Birmingham' group.

Why this was created

If you are using Access Control Lists (ACLs) to restrict access based on groups, e.g. a client of ours has a regional model whereby staff in different regions only access contacts for that region, then it's annoyingly easy to add a contact and immediately lose access to it because you forgot to add them into your regional group.