CiviCRM Community Forums (archive)

Hi there,

we ran into a problem where the ACL in CiviCRM does not seem to permit this type of restriction in a CiviCRM 3.1.5 and Durpal 6.19 installation:

• Attach custom data group to an individual contact as a tab (or inline)
• Store sensitive information in custom data fields
• Allow "view" of custom data group to only authorized staff members who belong to "caseworker" CiviCRM group
• Disallow and "hide" from view custom data group for all non-authorized staff members who don't belong to "caseworker" group

The boring intermediate steps of setting up a ACL role, assigning a group to that ACL role, adding the staff member to that group have been done, but the result is that the custom data group is visible to all users regardless of access restrictions.

We've turned off the Drupal permission settings for these items:

• profile listings
• profile listings and forms
• access all custom data

While these Drupal permissions are enabled for the staff member login:

• view all contacts

Any pointers on how to get this to work, i.e. restrict view of sensitive information to a subset of the staff logins belonging to a specific group?

Many thanks in advance,

Alan

the wiki documentation is editable by users. wanna make the appropriate changes

i know that logged in users pick up all the permissions of auth users. i was not aware (or forgot) that they also pick it from anon users.

on the other hand i'm not sure when u'll give anon users more access than auth users

lobo