4

This may be a shortcoming or bug to-do with access control, but maybe I'm missing something.

I've setup Drupal permissions and ACLs and they are working 100% except for one thing: users can only view the groups for which they explicitly have an ACL for. In other words, only users with CMS permission to "View all contacts" can view groups they themselves created.

Am I correct in assuming that this is a shortcoming, or is it a bug? Either way, what are y'alls suggestions for allowing users be able to create, edit and manage their own groups without giving them "View all contacts"? Is there a way to do it using hook_civicrm_aclWhereClause?

2

Yes, this is a shortcoming in the current acl system.

One possible workaround for this might be to implement the post hook on the civicrm_group object. The post hook can take the contactID of the person creating the group and add an ACL giving this person access to the group.

You can implement the above hook in an extension. Probably worth considering including this in core need on a setting

  • Thank Donald. I looked at the group object and none of the fields appeared to offer any permissions control more than what was on the create group form, so I think this is a dead end. – bdombro Apr 23 '15 at 21:46
  • You will need to use the post hook to create the relevant ACLs for that group. The group object does not have any permissioning fields. – Donald Lobo Apr 25 '15 at 3:26
  • Ohhhhh, I see what you are saying: create a new ACL for every new group. The downside is the the # of ACLs could go up quickly it there are a lot of groups, but good idea! – bdombro Apr 26 '15 at 7:28
1

I a temporary workaround until I have time to fix permissions. It hooks the create group form and prevents users from creating groups whom don't have permission to "edit all contacts".

function memberperms_civicrm_buildForm( $formName, &$form ) {
    if (strpos($formName, "AddToGroup")
        and
        !CRM_Core_Permission::check('edit all contacts')
    ) {

        // Display Error Message
        CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");

        // Redirect to civicrm home
        drupal_goto("civicrm"); 
    }
}
  • Hey @bdombro. Any update on this? How did you manage to solve it eventually? Do you know if there is any relevant functionality incorporated in newer CiviCRM versions? Thnx for you time! – Vassilis Chryssos Apr 17 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.