CiviCRM Community Forums (archive)

Someone please correct me if I'm wrong but I'm working with 3.0.4 standalone in an effort to understand the ACL system that exists.

My goal is to allow authenticated users ability to edit contacts but NOT to be able to assign/remove users to/from the access level groups.

When editing a contact in the groups tab, the "add to group" select does not show access level groups. But when searching and using the "Add Contacts to Group" or "Remove Contacts from Group" bulk options, my authenticated user can add/remove access level groups and there fore adding them selves as admins.

3 default roles - Any, Administrator, Authenticated

My ACL's
Role   Operation   Type of Data   Which Data   Description   Enabled?   
Authenticated   View   Group   All Contacts-sm   Edit all contacts - smart group


Core ACL's
Any Role - access CiviMail subscribe/unsubscribe pages, register for events, profile listings and forms, make online contributions, access all custom data

Authenticated - register for events, profile listings and forms, make online contributions, access all custom data, access CiviMail subscribe/unsubscribe pages, access CiviCRM, view event info



What am I missing? Or is this a bug?

Thanks,

gotMoxie