How do I prevent a user from adding contacts to ACL groups?

Question

I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events.

What I am trying to figure out is how to prevent low-level users from adding themselves (or other contacts) to the CiviCRM group "NYC Team". (If a low level user can add themselves (or others) to the group "NYC Team" (and other Access Control type groups), it renders the ACLs to be ineffective.

Answer 1

With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.

If you need to add someone else to the group, just enable, add and disable again.

Heather.

Answer 2

There is a useful little CiviCoop extension called group-protect to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.

Answer 3

I think you'd need to use hooks to hide the ACL groups from the dropdowns. There's a forum post here that links to a module that does this - looks like it could be adapted into an extension to hide the groups from everyone but admins. It's a few years old, mind.

Answer 4

Set the view permission for the group so that users you don't want adding themselves or others to it can't see it.

Answer 5

CiviCRM has an option for groups in the group settings to make the group "Reserved". You can use this setting along with the CMS permission "CiviCRM: administer reserved groups" to limit who can edit a group.

For more information, here are some good docs: http://book.civicrm.org/user/current/organising-your-data/groups-and-tags/

Another way to control who can create groups is using hook_civicrm_buildForm and warning/redirecting the user to another page if they don't have certain permissions. See code snippet below.

function memberperms_civicrm_buildForm( $formName, &$form ) {
    if (strpos($formName, "AddToGroup")
        and
        !CRM_Core_Permission::check('edit all contacts')
    ) {

        // Display Error Message
        CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");

        // Redirect to civicrm home
        drupal_goto("civicrm"); 
    }
}