CiviCRM Community Forums (archive)

I thought we had been over this ground but nothing in notes confirms that.

I am wanting to use standard ACLs within a multi-org so that on an L2 site we can set up an ACL Group with a Role that gives them permission to view/edit only a particular set of contacts as defined by a Smart Group.

I have just configured such an ACL on a standard (non-multi-org) and two different multi-org installations (ie completely unrelated developments).

The ACL works on the non-multi-org (as would be expected but proved to me that I set things up correctly) but it fails on both of the multi-org installations.

Can someone please confirm that they are using ACLs eg for an L2 and that it is working?

I mean contact with just Access to CiviCRm drupal permission can edit other domain's contacts

We have been using multisites with ACLs provided via the ACL hook.

We edited this function in the multisite code to call our function


function multisite_civicrm_aclWhereClause( $type, &$tables, &$whereTables, &$contactID, &$where ) {

   if ( ! $contactID ) {
        return;
    }
    require_once 'CRM/Core/BAO/Domain.php';
    $groupID    = CRM_Core_BAO_Domain::getGroupId( );
    $childOrgs  = _multisite_get_all_child_groups( $groupID );

    if ( !empty($childOrgs) ) {
        $groupTable = 'civicrm_group_contact';
        $tables[$groupTable] = $whereTables[$groupTable] =
            "LEFT JOIN {$groupTable} multisiteGroupTable ON contact_a.id = multisiteGroupTable.contact_id";

        $where = "(multisiteGroupTable.group_id IN (" . implode(',', $childOrgs) . ") AND multisiteGroupTable.status IN ('Added') ";
        if (module_exists(fuzion_civicrm_tabs_acl)){
         $where .= fuzion_civicrm_tabs_acl_civicrm_aclWhereClause( $type, $tables, $whereTables, $contactID, $where, 1 );
      }
      $where .= ")";
    }
}