9
With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.
If you need to add someone else to the group, just enable, add and disable again.
Heather.
8
You didn't specify which CMS you're using but between your CMS permissioning and Civi ACLs, that should be possible. See here for some info: http://book.civicrm.org/user/initial-set-up/permissions-and-access-control/
Just a thought to consider though... if you want to present particular sets of data to your board members in a simplified way, creating Views ...
7
This is a bug already reported at https://issues.civicrm.org/jira/browse/CRM-15371.
Managing tags needs its own permission rather than requiring "administer CiviCRM" permission. Anyone interested in getting started on core programming will likely find this a good one to begin with.
7
A few years after the question was asked ... the answer is yes!
Financial ACL's were added a while back but the docs have not been updated yet.
Go to Administer > CiviContribute > CiviContribute Component Settings, and tick Enable Access Control by Financial Type.
Go to your CMS permissions to grant access to each financial type by role.
See ...
6
I've posted an advisory now: CIVI-SA-2015-008: Access bypass in CiviCRM 4.6.7
CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.
The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “...
6
I had a similar problem (CiviCRM 4.6) and solved it as follows:
The price sets kind of belong to the event component, and therefore they require not only "regular" CiviCRM permissions, but also access CiviEvent. Since the CiviEvent component wasn't enabled, the permissions weren't there, and the admin user didn't have them.
After enabling CiviEvent and ...
5
While it's more work to set up, I think you'd be very well served by taking advantage of multi-site capabilities of CiviCRM, especially in conjunction with the excellent Multi-site Permissioning extension. That said - I'm very nervous recommending these tools to someone who hasn't set up CiviCRM before! It takes a fair amount of web development know-how to ...
answered Apr 15 '15 at 20:23
Jon G - Megaphone Tech
31.8k1 gold badge23 silver badges85 bronze badges
5
Good question!
It adds fields to the relationship_type form - & the methodology for that broke in 4.5 I believe. So, I believe that if you install the github version Related permissions on 4.6 the relationship type form is likely to, at the very least, need testing. The added fields are the ones that force particular relationship types to always be ...
5
Evan from IMBA here. Sorry for replying in a new answer, I don't have the required 50 points of reputation to comment in reply specifically to Lizz Trudeau's answer. I just watched the video Jason (my predecessor) gave at CiviCon 2012, and it gives a really solid overview of how we've tackled this and for the most part we're still set up this way. We've made ...
5
The ACLs in CiviCRM are only additive. So assuming a user doesn't have the "View All Contacts" or "Edit All Contacts" permissions (which overrides all ACLs), the default is that a user can view zero contacts.
So to answer your second question: If you grant the user permission to access contacts in Group A, all contacts in Group A are accessible to the user ...
answered Sep 20 '15 at 1:59
Jon G - Megaphone Tech
31.8k1 gold badge23 silver badges85 bronze badges
5
Currently the event needs to be active to use (preview) it.
If you have an event listing page, you can uncheck Public event. That way users only see the event if you create a link to it. You should be safe in temporarily making it active for testing.
This is the same Question/Answer as: Testing event registration
5
I've posted a preliminary fix in JIRA.
Joseph
5
This is a core bug and Eileen has send a PR for the fix. Will you be able to try by applying the patch from here?
If the patch works for you than please comment your test result on PR so that it will speed up process of merging into core and having it available in next release.
Cheers
Pradeep
4
IMHO it seems like you really need a consultant for this stuff. Hopefully an organization of your size (400 chapters with an unknown # of people per chatper) has budget for help.
But let me offer a few bits of advice:
the "corresponded Organisation Group" as you put it CAN be a smart group, thus people (not admins) can self-select their own groups when ...
4
Two ideas come to mind:
If you're more of a federated organization where it would be natural for your members' contacts to be in your database, you could set up a multisite installation.
You could offer an easy way for them to launch their own CiviCRM. You might manage them using Aegir, or if that's more responsibility than you want, you could even just ...
4
What I figured out is that when inserting the shortcode in mode "view" the URL is http://yoursite.com/civicrm/?page=CiviCRM&q=civicrm/profile/view&reset=1&force=1&gid=14 (which it will prompt you with an error) but the working URL is http://yoursite.com/civicrm/?page=CiviCRM&q=civicrm/profile&reset=1&force=1&gid=14 which ...
4
I can't really see the use case where "Edit All Contacts" should be required for adding a tag. I think this is something that should be changed. So the solution is to submit a patch or ask a developer to do so.
Now, I'm not part of the CiviCRM core team - but I do submit patches like this one on behalf of my clients. I'm pretty slammed, but I'll make you ...
answered Oct 7 '15 at 17:09
Jon G - Megaphone Tech
31.8k1 gold badge23 silver badges85 bronze badges
4
You need to turn on "Access all custom data" for anonymous users for a lot of very popular features (e.g. custom fields for anonymous users in profiles and webform_civicrm) to work. Someone else can contradict me, but I'm reasonably certain this has no impact on security unless a) anonymous users also have access to contact records, or b) you have custom ...
answered Jan 15 '16 at 20:13
Jon G - Megaphone Tech
31.8k1 gold badge23 silver badges85 bronze badges
4
Yes, CiviCRM can do all of these things. It is also a very flexible system with a number of extensions that provide additional functionality that you may need in future.
To get a better idea of what CiviCRM can do I would suggest that you read the user guide and try the one of the demo sites.
4
I wish i would have seen this question earlier, I can certainly help you out.
checkout civicrm_entity.api.php in the civicrm_entity module
I don't believe the controller is checking the ACL's when loading an entity. We may be able to add 'check_permissions' => True to the call there in civcirm_entity_controller.inc CivicrmEntityController::loadEntites... ...
4
Events
The API kernel broadcasts an authorise event.
Core permission check listener
The main API permission check subscriber will respond to the event by:
$apiRequest = $event->getApiRequest();
if ($apiRequest['version'] < 4) { /* blah */ }
elseif ($apiRequest['version'] == 4) {
if (!$apiRequest->getCheckPermissions()) {
$event-&...
4
Yes - I've done this several times. Many organizations with a chapter/branch format do this, such as IMBA, Wikimedia Foundation, the Australian Green Party, and many others.
There are several different approaches you can take.
The "easy" approach is just to use built-in ACLs. Create groups of "staff" and "members" for each chapter, using parent/child ...
answered Nov 9 '17 at 16:27
Jon G - Megaphone Tech
31.8k1 gold badge23 silver badges85 bronze badges
4
This will allow to view/edit a custom data field set for every contact the user has view/edit permissions.
Despite the option named Edit there is currently no difference to View, as descibed in the note. Whether you can actually edit it depends on the ability to edit the contact.
There is a CMS-based permission CiviCRM: edit my contact to edit your own ...
4
As per Erik's suggestion I created a new condition.
It will be included in the next version of civirules (2.12).
If you would like to get it before the official release of the new version you can always get it from the civirules repo https://lab.civicrm.org/extensions/civirules .
The new condition is called "Contact added by Contact (not) in Group(s)" and ...
3
It will depend on how much of the setting up you (a superadmin) will take care of, eg will you add 'their' payment processors and perhaps set up their Membership pages, to avoid the risk of 'them' doing that step themselves and setting an incorrect payment processor on their membership page etc.
Multisite does add the ability/complexity so that each sub-org ...
3
Similar issue is filed here for which I've submitted a PR at https://github.com/civicrm/civicrm-core/pull/6366
Hope you can see Groups permitted by ACL now:)
Update : If you can also see the groups not configured for mailing list, please upgrade to the latest CiviCRM version.
3
Ugh. This kind of bug is really hard to diagnose. Good call on noticing that memcache caches this behavior.
Are you on some kind of host with really aggressive caching by default? WPEngine, for example, has caused big problems.
If not, you should report this on issues.civicrm.org. My hunch is that caching/retrieval of the query for visiting the contact ...
3
I suspect this is because acl permissions is not consistently applied across all aspects of civicrm. In this case the API permission check is a lot more granular.
At this point, I suspect your options are to either live with the status quo and/or (ask your developer if you have one to) take a look at the code to see if you can improve the API to make the ...
3
It should be possible in WordPress also. WP + Civi has the same capabilities as drupal and joomla.
Deny ACLs are not part of the UI. You can implement them via a hook. Check:
https://civicrm.org/blog/lobo/implementing-a-custom-acl-system-in-civicrm
(search for VIP contacts)
3
There is a useful little CiviCoop extension called group-protect to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.
Only top voted, non community-wiki answers of a minimum length are eligible
