CiviCRM Community Forums (archive)

Hi everybody,

I have a simple question that I haven't been able to figure out myself. For our online contact database, we would like to structure access rights as follows:

• outside users can only sign up and modify their profile (on Drupal) without accessing civicrm
• inside users can access civicrm to view and add contacts (under "Search", "Contacts" and "Events")
• team leaders can access civicrm to view and add contacts; they also have administrative rights for "their" contacts and can access "Mailings"
• site administrators can do everything

We have worked with a combination of Drupal access rights and civicrm ACLs. For the management of contacts, this has worked quite well. However, we would also like to limit user rights of "mailings". Specifically, team leaders should only be able to send messages to "their" contacts; i.e. the people belonging to a specified group (according to the ACL). Currently, however, they can send emails to everybody included in a group of type "mailing list".

Thanks for your ideas on how to approach this problem.

Denis

The critical group is "team leaders" who should have some administrative rights in CiviCRM, especially related to "mailings". As mentioned, we used a combination of Drupal user rights and CiviCRM ACL's (all via the user interface; what is the alternative?). Here is what we did (assume that a "team leader" should control the group "subset" of which s/he is a member him/herself):

• create a group "administrator civicrm" in the Drupal "Permissions"
• allow users of type "administrator civicrm" to access CiviMail, among others (see attachment)
• create group "subset" of type "access control"
• create ACL role "limited"
• give ACL role "limited" edit rigths on group "subset"
• assign ACL role "limited" to members of "subset"

This procedure worked well in order to limit editorial rights; e.g. members of group "limited" with "administrator civicrm" access rights cannot delete contacts (as specified in the Drupal access rights) and only modify information of "their" contacts (i.e. members of the group "limited").

Quickly on your questions:

1. Powered by CiviCRM 3.0.1; Drupal: 6.14; Server Apache/2.2.11 (Unix) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i mod_jk/1.2.27 PHP/5.2.8 mod_apreq2-20051231/2.6.0 mod_perl/2.0.4 Perl/v5.10.0

2. I will look into this; for this problem, it shouldn't make a difference

3. This is correct; I changed Drupal permission to prevent people in limited role to "view all contacts", which indeed takes away those groups from mailings that are not specified in the ACL. However, this is not what I am looking for: people with restricted rights should be able to see all contacts, but their rights to modify or email contacts should be limited to the groups specified in the ACL. This works for "editorial rights" (so people can only edit "their" contacts"), but unfortunately not for the mailings

4. Not sure if my IT skills are good enough to follow your thinking (I'm not a programmer); "group.php" contains the code that you highligthed; should I do something with this? (sorry for my ignorance) The entire trail of code of "buildQuickForm" is below.

Thanks,
Denis



public function buildQuickForm( )
    {
        require_once 'CRM/Mailing/PseudoConstant.php';
       
        //get the context
        $context = $this->get( 'context' );
        $this->assign( 'context', $context );
       
        $this->add( 'text', 'name', ts('Name Your Mailing'),
                    CRM_Core_DAO::getAttribute( 'CRM_Mailing_DAO_Mailing', 'name' ),
                    true );
       
        //get the mailing groups.
        $groups =& CRM_Core_PseudoConstant::group('Mailing');

        $mailings =& CRM_Mailing_PseudoConstant::completed();
        if (! $mailings) {
            $mailings = array();
        }

        // run the groups through a hook so users can trim it if needed
        require_once 'CRM/Utils/Hook.php';
        CRM_Utils_Hook::mailingGroups( $this, $groups, $mailings );
       
        //when the context is search add base group's.
        if ( $context == 'search' ) {
            //get the static groups
            $staticGroups = CRM_Core_PseudoConstant::staticGroup( false, 'Mailing' );
            $this->add( 'select', 'baseGroup',
                        ts( 'Base Group' ),
                        array(''=>ts( '- select -' )) + $staticGroups,
                        true );
        }
       
        $inG =& $this->addElement('advmultiselect', 'includeGroups',
                                  ts('Include Group(s)') . ' ',
                                  $groups,
                                  array('size' => 5,
                                        'style' => 'width:240px',
                                        'class' => 'advmultiselect')
                                  );
       
        //as we are having hidden smart group so no need.
        if ( $context != 'search' ) {
            $this->addRule( 'includeGroups', ts('Please select a group to be mailed.'), 'required' );
        }
       
        $outG =& $this->addElement('advmultiselect', 'excludeGroups',
                                   ts('Exclude Group(s)') . ' ',
                                   $groups,
                                   array('size' => 5,
                                         'style' => 'width:240px',
                                         'class' => 'advmultiselect')
                                   );

        $inG->setButtonAttributes ('add'   , array('value' => ts('Add >>'   )));
        $outG->setButtonAttributes('add'   , array('value' => ts('Add >>'   )));
        $inG->setButtonAttributes ('remove', array('value' => ts('<< Remove')));
        $outG->setButtonAttributes('remove', array('value' => ts('<< Remove')));
       
        $inM =& $this->addElement('advmultiselect', 'includeMailings',
                                  ts('INCLUDE Recipients of These Mailing(s)') . ' ',
                                  $mailings,
                                  array('size' => 5,
                                        'style' => 'width:240px',
                                        'class' => 'advmultiselect')
                                  );
        $outM =& $this->addElement('advmultiselect', 'excludeMailings',
                                   ts('EXCLUDE Recipients of These Mailing(s)') . ' ',
                                   $mailings,
                                   array('size' => 5,
                                         'style' => 'width:240px',
                                         'class' => 'advmultiselect')
                                   );
       
        $inM->setButtonAttributes ('add'   , array('value' => ts('Add >>'   )));
        $outM->setButtonAttributes('add'   , array('value' => ts('Add >>'   )));
        $inM->setButtonAttributes ('remove', array('value' => ts('<< Remove')));
        $outM->setButtonAttributes('remove', array('value' => ts('<< Remove')));

        require_once 'CRM/Contact/Page/CustomSearch.php';
        $urls =
            array( '' => ts('- select -'),
                   -1 => ts( 'CiviCRM Search' ) ) +
            CRM_Contact_Page_CustomSearch::info( );
           
        $this->addFormRule( array( 'CRM_Mailing_Form_Group', 'formRule' ));
       
        //FIXME : currently we are hiding save an continue later when
        //search base mailing, we should handle it when we fix CRM-3876
        $buttons = array( array ( 'type'      => 'next',
                                  'name'      => ts('Next >>'),
                                  'spacing' => '&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;',
                                  'isDefault' => true   ),
                          array ( 'type'      => 'submit',
                                  'name'      => ts('Save & Continue Later') ),
                          array ( 'type'      => 'cancel',
                                  'name'      => ts('Cancel') ),
                          );
       
        if ( $context == 'search' ) {
            $buttons = array( array ( 'type'      => 'next',
                                      'name'      => ts('Next >>'),
                                      'spacing' => '&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;',
                                      'isDefault' => true   ),
                              array ( 'type'      => 'cancel',
                                      'name'      => ts('Cancel') ),
                              );
        }
        $this->addButtons( $buttons );
       
        $this->assign('groupCount', count($groups));
        $this->assign('mailingCount', count($mailings));
    }

Okay; thanks for all your help. I thought I had overseen something, but I guess my plans require a bit more work than expected. Hasn't this issue been raised before?

Again, thanks for the quick support.

Denis