Access all custom data vs ACL hide custom field set

[Vicki B]

Drupal 6, CiviCRM v. 4.4.7

We created an ACL group to allow only certain staff to view/edit a custom field set. But, we need to give everyone (including anonymous users) Drupal permission "access all custom data" in order to collect data in custom fields for events and memberships. The Drupal permission overrides CiviCRM's access control.

Has anyone come up with a solution to this? Thanks.

[Erik Hommel]

Hi Vicki,

would you be able to collect the data in a Drupal Webform using the Webform - CiviCRM integration module?
Erik

[e_mason]

Erik:

Vicki's install is running above CiviCRM 4.3 (4.4.7)  on D6 so Webform isn't an option at this point. 

Alternately all the relevant contacts could be placed in a group with an ACL ... unfortunately this has some negative effects (such as inability of contacts to edit/update their own record).

Eliot

[Michael McAndrew]

"we need to give everyone (including anonymous users) Drupal permission "access all custom data" in order to collect data in custom fields for events and memberships."

Have you thought about creating a CiviCRM ACL to give everyone access to those custom fields you are using in the events and membership forms?

That might mean that you don't have to give anonymouse users the Drupal permission to access all custom data.

[Erik Hommel]

Had not spotted that Eliot :-)

[Vicki B]

Thanks for all the ideas.

Anonymous users need access to custom fields for event registration, membership and donations, so adding all contacts to a new ACL group won't include them.

Webform - CiviCRM integration sounds like the way to go; we'll be moving to Drupal 7 next year (early, I hope) and I'll try that. Do you know if it will work? Or will "access all custom data" still need to be allowed for all site visitors?

[Erik Hommel]

Vicki, I expect you will be able to create all you want with the Webform CiviCRM integration module and will not need the 'access all custom data' anymore.

[Michael McAndrew]

adding all contacts to a new ACL group won't include them

Not 100% what you mean by this but just to clarify, I wasn't suggesting adding all contacts to a new ACL group won't include them, I was suggesting create an ACL that gives anonymous users acccess to the custom data you want them to access.

[Vicki B]

You can add anonymous users to an ACL group? How would you do that, since they aren't contacts in CiviCRM?

[Michael McAndrew]

Go to http://dmaster.demo.civicrm.org/civicrm/acl?reset=1 and click Add ACL.

I've filled in the attached screen as an example.

PS. Not sure if you noticed but I did hedge my bets a little when I replied the first time saying "That *might* mean that you don't have to give anonymouse users the Drupal permission to access all custom data." since I haven't tried this myself, but I do think it is worth some experimenting since, sometimes those ACLs can be fiddly to set up and hard to understand, but once you get them right they do what you want.  Specifically, you might want to experiment with what 'Operation' you grant them before working out which one is required.  Choosing 'All' as an experiment to start, then restricting further based on what you need is probably the way to go.

Please let me know if this does work out for you or not since I'm interested myself.

Thanks!

[e_mason]

Michael:

Wow - that's kinda hidden.  I did the same thing but tried to start from creating a group (cuz all ACLs need a group, right?).  Totally missed the "Everyone" in the ACL.

We'll work through this and report back.

[Michael McAndrew]

How did it go?

[e_mason]

Well, it hasn't yet. Vacation is getting in the way of working through that issue.

[Michael McAndrew]

Happy thanksgiving! Any joy yet?!

[e_mason]

Fired up the local environment and the Andrew solution works there.

Specifically:
1) Disable Drupal permissions to "Access Custom Data"
2) create two custom data groups "Public" and "Private"
3) create ACLs - the Public data is "Everyone" and "Edit"; the Private data is "Authorized" and "Edit"
4) attach a field from each group to a profile, load the profile.

The Private and Public data is visible to Authorized users, and in another browser an Anonymous user only sees the Public field.

Now to roll this out on a production site.  The rub is that with 26 custom groups that's a lot of ACL clicking!  Too bad the ACL doesn't allow for multi-select!

Now we just have to figure out a user permission issue....  I'll ask that later today.