WordPress Access Control for Events

[gzimmerman]

I'm running WP401 and Civi452.
I have a Profile that Creates a new WP user and contact and adds this user to a group(access control) called "Registered Construction Volunteers".  This profile has questions(with safety info that must be read and watched)that must be answered with a Yes for Liability reasons.
We have Events (type="Build") for which only Authenticated users can register.  I used the "Authenticated" role and assigned the "Registered Construction Volunteers" group to it.  I then created an ACL called "Event Registration" using the Role "Authenticated", Operation "Edit", Type of Data "Events", and the Event "Test Event" and it is enabled!    I then went to the Wordpress Access Control and unchecked the boxes for the "CiviEvent: register for events".   I started to add users/contacts to the database(some without the profile being completed and some completing the profile) and tested.  I found that any Authenticated user could register for the event regardless of them being in the "Registered Construction Volunteers" Group.   If my thinking is correct, only the Contacts in that Group should be allowed to Register for the Event, right?   Please let me know your thoughts on how to allow only contacts in the group to register for specific events.
THANKS.

[KilakwaBT]

One approach you may want to try is to use the WordPress Members plugin to restrict access to the pages with the registration. You would need to create a Role for your 'Build' group in WordPress & create page(s) for the event(s) you want to restrict access to with the registration form. Then set permission to that page for users with the 'Build' role. This approach utilizes WordPress access permissions to restrict access to the registration and prevents anonymous user access and registrations.

Hope it helps

BT

 

[Dave Greenberg]

Gary - Just spent some time testing this on the WordPress 4.5 demo and it seems to be working as expected.

I think your problem is that you should not use the pre-configured Authenticated role (that's means ANY logged in user). You should create a special ACL Role (Construction Volunteers) from Manage Roles, and then assign your group to that role.  As noted, under Wordpress Access Control, remove 'register for events' from any non-admin roles.

One possible source of confusion is that there is some caching for the ACLs. This means that if you add, modify or disable ACLs - then you may need to run the URL for clearing caches in order to see the effect of the change (e.g. <your site>/wp-admin/admin.php?page=CiviCRM&q=civicrm/menu/rebuild&reset=1)

I can get you a temporary admin login on the WP demo if you want to try things out there.

[gzimmerman]

Dave,
THANKS for the reply.  Sorry for the delay in getting back to you.... busy week last week.
 I have a test site I will try your suggestion on!
Stay tuned....

[gzimmerman]

Dave,
I'm screaming for joy at the top of my lungs!!!  Do you hear me!   I finally got this figured out.   I don't know why it took me so long!
I know I'm not the smartest and I don't think I'm the dumbest!    The piece I was missing that I needed to have an exact match with the WordPress Role when I created the  ACL Role in Civi.   THANKS A MILLION for your help!  ITS GREATLY APPRECIATED!