12

I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events.

What I am trying to figure out is how to prevent low-level users from adding themselves (or other contacts) to the CiviCRM group "NYC Team". (If a low level user can add themselves (or others) to the group "NYC Team" (and other Access Control type groups), it renders the ACLs to be ineffective.

9

With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.

If you need to add someone else to the group, just enable, add and disable again.

Heather.

3

There is a useful little CiviCoop extension called group-protect to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.

2

I think you'd need to use hooks to hide the ACL groups from the dropdowns. There's a forum post here that links to a module that does this - looks like it could be adapted into an extension to hide the groups from everyone but admins. It's a few years old, mind.

2

Set the view permission for the group so that users you don't want adding themselves or others to it can't see it.

  • How can I set the view permission for a specific group? – Graham Sep 18 '15 at 16:56
0

CiviCRM has an option for groups in the group settings to make the group "Reserved". You can use this setting along with the CMS permission "CiviCRM: administer reserved groups" to limit who can edit a group.

For more information, here are some good docs: http://book.civicrm.org/user/current/organising-your-data/groups-and-tags/

Another way to control who can create groups is using hook_civicrm_buildForm and warning/redirecting the user to another page if they don't have certain permissions. See code snippet below.

function memberperms_civicrm_buildForm( $formName, &$form ) {
    if (strpos($formName, "AddToGroup")
        and
        !CRM_Core_Permission::check('edit all contacts')
    ) {

        // Display Error Message
        CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");

        // Redirect to civicrm home
        drupal_goto("civicrm"); 
    }
}
  • Please see most recent edit where I offer a workaround with hook_civicrm_buildForm. – bdombro Apr 23 '15 at 21:50
  • 2
    From my testing, it appears that making a group "Reserved" does not prevent a user from adding himself to the group. (The Group Settings dialog itself says "If reserved, only users with 'administer reserved groups' permission can disable, delete, or change settings for this group. The reserved flag does NOT affect users ability to add or remove contacts from a group.") – Martin_ATS Jun 7 '18 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.