CiviCRM Community Forums (archive)

Welcome! Congrats on your first post in this forum

There are 2 levels of permissions in CiviCRM - there are site-wide permissions (which give different users blanket permissions like "access CiviCRM" or "administer Groups") and then there are ACLs. I think the latter is what you are looking for. You can read about it more here: http://book.civicrm.org/user/current/initial-set-up/permissions-and-access-control/

Once you've read that feel free to come back with more specific questions and we'll do our best to answer them.

I'm hoping someone with more experience using nuanced ACLs will chime in here, but my understanding of the system is that Civi ACLs are not granular enough to do what you are asking. Mainly they are used to restrict access to an entire contact, not just one field for that contact.
I might be able to come up with a custom code snippet or two that could get you more-or-less what you're asking, but maybe someone out there has a better idea before we go down that road...

As an FYI to anyone else with the same issue: I've found a solution, although it is extremely clunky and ugly.

As a first step, I cloned the subscriber role to a  couple custom wordpress roles: 'limited', 'viewer', and 'editor' in my wordpress themes folder in the file functions.php
//load wordpress site after making this change, then swap limited for viewer, and load again, repeat...
add_action('init', 'cloneRole');
function cloneRole()
{
    global $wp_roles;
    if ( ! isset( $wp_roles ) )
        $wp_roles = new WP_Roles();

    $adm = $wp_roles->get_role('subscriber');
    //Adding a 'new_role' with all admin caps
    $wp_roles->add_role('limited', 'Limited', $adm->capabilities);
}

Next, navigate to CiviCRM » Administer CiviCRM » Access Control >> Wordpress Access Control.

Remove all permissions from all users (for a fresh slate), you will still be able to administrator the site since you should be on a wordpress 'administrator' role or above.

Next, starting with the limited role, i only granted access to the Civi 'categories' such as CiviCRM CiviEvent CiviContribution, etc... if you do not grant these your ACLs inside CiviCRM will do nothing.
I copied the same permissions to the viewer and editor roles and added functionality above that.

For the viewer role I added the ability to view most types of data.

For the editor role I added the ability to edit/delete/modify most types of data.


Next, I created custom Access Control Groups inside CiviCRM tailored to specific needs.

For example, if I wanted to have someone see only basic contact information and nothing else (no events etc...), I could assign them to the 'limited' wordpress role, and assign their account to the access group 'Contact Viewers Access Group' which I would assign to the acl role 'basic contact viewers' with the ACL 'basic contact viewers' 'view' 'all groups' or a specific subgroup if I wanted to limit the scope of their view rights even more.

If I wanted to allow someone to view custom data but not edit it, I would assign them to the 'viewer' wordpress role which I had default given access to custom data.
If you wanted to restrict the custom data that a user could view, you would assign them to the 'limited' wp role, and grant them an ACL to 'view/edit' that custom data
but because you had not given them the explicit right to edit contact data they would not be able to edit the custom data, only view it.
It doesnt really make sense but it works, the most important thing to remember is that you need to
grant access to all major categories to a wp role if you want to be able to create ACLs that do anything in that category.
eg. even if you create an ACL granting an wp 'limited' rights to view events they will not be able to do this unless they have access to  CiviEvent but you do not need to specify view event info as the ACL will cover this.

If this all sounds confusing it is because it is, it takes some experimentation but strictly speaking:

users will not be able to edit unless specified under wp access control
users will not be able to view unless granted 'category access' (exceptions are custom data fields and other non CiviCRMxxx categories)

Using these rules you should get a head start and be able to get pretty granular with your controls, it may take 7 different specific ACLs but it is possible.
I do wish there was a more streamlined process for this, but for all of you out there in a similar predicament, fine tuned control is possible with patience.

Best of luck,

V


**EDIT:Sorry for the terrible formatting, I was in a rush.