On my webform, I enabled 2 contacts. Contact 1 has 'Existing user' enabled and set to 'static' and default value is 'current user'. Contact 2 has 'Existing user' enabled and set to 'drop down' and default value is 'relationship to contact 1' relationship = 'child of'.

My goal is that contact 1 can go to that form and select one of his children and fill out the form. The form doesn't respect the filter and displays all civicrm contacts in the drop down menu.

I also tried setting default values to use filters and set the filter to contact type to= campers, I also enabled the 'Enforce Permissions'. The drop down still displays all civicrm contacts for contact 1 even though he only has permissions to edit his/her child.

enter image description here enter image description here

2 Answers 2


Figured it out thanks to @Colemanw.

The relationship permissions are only for dashboard access and do not act as ACL permissions.

I installed this extension which transforms relationship permissions into ACL permissions. Now it is simple, I simply enable the 'Enforce Permission' option in the'Existing User' field and the drop down only shows the intended contacts.


  • Hi @Yossi - are you having users (parents) logged in - or are you using cid and cs tokens in the URL? Aug 31, 2016 at 3:45
  • I am having them log in
    – Yossi
    Aug 31, 2016 at 3:46
  • I'm trying to just use cid and cs for an event with guests type registration - have you ever tried that w/ permissions? Aug 31, 2016 at 3:54
  • IIRC, that wont work if "enforce permissions" is enabled.
    – Yossi
    Aug 31, 2016 at 4:05
  • Yep - found it: drupal.org/node/2406823 Aug 31, 2016 at 4:18

This doesn't answer your question specifically, but we create this exact functionality through Views and a Webform. The view does most of the heavy lifting.

We create a CiviCRM contact view, we use a contextual filter for the current user, add contact id for the child and render it in a table that displays the child's name and an Edit Now link to the Webform with a url of node/1?cid1=[id].

In our case, we use households as the relationship (that's why there are quite a few relationships), but it would be easier if you only had to use Child of.

On the webform, I only have one contact (the child) and it is set to static.

enter image description here

  • 1
    Cool. If someone changes the [id] in the URL would it show the contact represented by new Id? That still might be a security issue.
    – Yossi
    Nov 25, 2015 at 14:12
  • It would, but I would keep testing with the 2 contacts on the webform and playing with the relationship stuff on the webform component for the child. I have it open in a colorbox so they don't actually see the url.
    – pmoz
    Nov 25, 2015 at 14:47
  • I want to display all contacts who Relationship≠"Paired with". The view creates a table row for every relationship, so I end up with 3 rows per contact, it does remove the row with Relationship="Paired with" but I want the whole contact to disappear. Any ideas?
    – Yossi
    Nov 25, 2015 at 23:27
  • Not certain I understand.
    – pmoz
    Nov 26, 2015 at 0:59
  • 1
    if i understand you can 'group by' in your table, and use Contact A for that field, then you should just see the names of the 3x Contact B underneath
    – petednz - fuzion
    Nov 26, 2015 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.