Answers.Body: <p>As you have noted, the big problem with the ACL group system is the lack of control around adding to groups.  I've used the Group Protect extension previously and it does the job.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-09-03T12:31:49.343Z
Answers.Text: But this extension doesn't work for 5.4.1 - it resulted in a solid database error - I had to remove it get going again.
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-06T15:21:23.437Z
Answers.Text: @AndyClark did you see that a few days ago Jon made a commit to the project. It might work in 5.x now! https://github.com/CiviCooP/org.civicoop.groupprotect/commit/510a44159d6c96cbff5271558f2525ea5496e673 (I won't be able to test for another week or so.)
Answers.UserDisplayName: RayWright
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-06T20:39:18.467Z
Answers.Text: Ha - I just came across this question trying to answer another ACL question!  Yes, I have Group Protect working with 5.7.2 after my latest changes.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-31T21:22:36.177Z
Answers.LastActivityDate: 2018-07-31T21:22:36.177Z
Answers.UserDisplayName: Aidan
Answers.Body: <p>We have found that limiting users in this way works well for access purposes, however, we have also found that users limited to groups in this way can create a contact that has no group. If they don't add a group, then they loose the ability to see or edit the contact they tried to add. Often, they then add the contact again. (and sometimes again). </p>
  
  <p>Also, when adding a contact through Cases->New Case->New Organisation, it is not possible to add a group on that 'easy-add' screen.</p>
  
  <p>It then takes an admin to login and add the group that the user forgot to add. </p>
  
  <p>We can see no way of making the selection of a group compulsory (or a default) when a user adds a contact on the Contacts-->New Organisation screen.</p>
  
  <p>We have treated this as a 'user coaching opportunity', emphasising that if they don't choose the right group, it's going to take extra time to get the data in, as they'll have to contact an admin to get the group added. At least all our users now know what to do if they forget to put a contact in the right group. </p>
  
  <p>We also insist that a user creates an organisation before adding a case, so that the organisation is in the correct group.</p>
  
  <p>Just thought I should mention these small issues we have found, and their work-rounds to hopefully save someone else the pain of working it out. Hope it helps. </p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-08T10:41:49.190Z
Answers.LastActivityDate: 2018-08-08T10:41:49.190Z
Answers.UserDisplayName: Oddjob
Answers.Body: <p>The ability to add groups to a contact depends on the visibility of groups for the user. The cms permissions "view all contacts" and "edit all contacts" grant visibility to all groups in the system.</p>
  
  <p>You need to remove the cms permissions "view all contacts" and "edit all contacts" for this role and add an acl for each civicrm group that the contact should be able to view or edit. This way you can set permissions to edit/view contacts and restrict the visibility of groups.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-07T15:16:45.703Z
Answers.LastActivityDate: 2018-08-07T15:16:45.703Z
Answers.UserDisplayName: Thomas Schüttler
Body: <p>There are a couple of posts, listed below, already on this topic - but I'd like to follow up:</p>
  
  <p><strong>SUMMARY</strong></p>
  
  <p>I can create an ACL role and limit access to a custom field group - which is <em>seemingly</em> wonderful. Data that should not be visible to everyone is not.</p>
  
  <p>BUUUT any user (with the ability to edit a contact) can add users to an ACL group. I feel it renders ACL roles/restrictions pointless. (We have users who need to be able to edit a contact, to adjust contact information and such but shouldn't be privy to all the custom data in the system.)</p>
  
  <p><a href="https://civicrm.stackexchange.com/questions/97/how-do-i-prevent-a-user-from-adding-contacts-to-acl-groups">How do I prevent a user from adding contacts to ACL groups?</a></p>
  
  <p><a href="https://civicrm.stackexchange.com/questions/17165/permissions-acl-and-groups">Permissions, ACL and Groups</a></p>
  
  <p><strong>QUESTION</strong>
  Does anyone have feedback on the <a href="https://civicrm.org/extensions/group-protect" rel="nofollow noreferrer">Group Protect</a> extension? It looks very promising but the notes indicate it's a work in progress from early 2016. Or is anyone taking a different avenue to prevent users from adding themselves to ACL groups?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-01T08:47:11.630Z
Comments.Text: Do you have the CMS based permission to edit groups for those contacts? If you dont allow that, a restricted user can only add contacts to groups that they have an acl to view/edit.
Comments.UserDisplayName: Thomas Schüttler
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-02T13:27:35.623Z
Comments.Text: (Sorry, didn't say I was in Drupal). Yes, I do have the CMS permission for edit groups. I do see your point, if I don't allow them to edit their own contact they couldn't then add themselves to groups. That could work for some situations. For us, it doesn't solve the problem at large, for anyone they do have permission to edit they could add an ACL group. Also, there is a LOT wrapped up the edit contact capabilities (relationships, tags, signatures) that we still need.
Comments.UserDisplayName: RayWright
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-06T08:59:06.010Z
Comments.Text: Editing the own contact is fine. But if you were to revoke the cms permission to edit groups they can only add those groups, that they have the permission for.
Comments.UserDisplayName: Thomas Schüttler
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-06T20:04:20.467Z
Comments.Text: I may be misunderstanding you but the CMS permissions for CiviCRM: Edit Groups states: "Create new groups, edit group settings (e.g. group name, visibility...), delete groups" and has nothing to do with adding or removing contacts to groups. I have user with the CMS permission edit groups turned off (but edit contacts turned on) and no ACLs added at all. That user can add contacts to any group they desire. The ACLs for groups only controls the ability to edit contacts in that group not whether you can add/remove membership to that group.
Comments.UserDisplayName: RayWright
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-07T10:26:33.060Z
Comments.Text: Oh, that is correct. The ability to view every group is actually tied to the cms permissions "view all contacts" / "edit all contacts". If you disable those you can use civicrm acl rules to allow view / edit permissions of contacts within specific groups. As a consequence the user will only be able to see said groups and is not able to assign ACL groups even if the user has the permission to edit the contact.
Comments.UserDisplayName: Thomas Schüttler
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-07T12:16:52.363Z
Comments.Text: That's not the behavior I experience (once a user can edit a contact they can add/remove to ANY group.) Please forgive the rookie mistake of not including my version (Drupal 7.59  / Civi 4.6.38). Perhaps in Civi 5 there's better control.
Comments.UserDisplayName: RayWright
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-07T14:02:27.480Z
Comments.Text: I have no experience with 4.6 but the code looks pretty identical regarding this functionality: https://github.com/civicrm/civicrm-core/blob/4.6/CRM/Core/Permission/DrupalBase.php#L77. You need to remove the cms permissions "view all contacts" and "edit all contacts" for this role and add an acl for each civicrm group that the contact should be able to view or edit. This way you can set permissions to edit/view contacts and restrict the visibility of groups.
Comments.UserDisplayName: Thomas Schüttler
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-07T14:27:44.427Z
Comments.Text: Aah, so the key here is that the ability to add to a group (or view the membership of that group on a contact) is in the ability to VIEW contacts in that group (not EDIT.) This workflow could work - in fact it's probably worth it for others to throw it below as an answer cause no one will read our zillion comments ;) For us I still have a need for a user to be able to view/edit contact A, who may happen to be a part of a 'staff ACL'. So I'd need to create a group that basically holds all our contacts and grant view/edit ACL to all roles. Not sure yet how maintainable that is for us.
Comments.UserDisplayName: RayWright
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-08-07T15:16:57.883Z
Comments.Text: You could create a smart group containing all contacts and create a common civicrm acl role for all users for this purpose. Going the route of an extension and using the hooks hook_civicrm_aclGroup / hook_civicrm_aclGroup could probably deliver a better performance if you want to dive in there.
Comments.UserDisplayName: Thomas Schüttler
Tags: <groups><acl>
Title: User can add themselves to any group
ThreadText: # User can add themselves to any group
  
  (Asked by: username_0 on 2018-07-31)
  
  There are a couple of posts, listed below, already on this topic - but I'd like to follow up:
  
  **SUMMARY**
  
  I can create an ACL role and limit access to a custom field group - which is *seemingly* wonderful. Data that should not be visible to everyone is not.
  
  BUUUT any user (with the ability to edit a contact) can add users to an ACL group. I feel it renders ACL roles/restrictions pointless. (We have users who need to be able to edit a contact, to adjust contact information and such but shouldn't be privy to all the custom data in the system.)
  
  [How do I prevent a user from adding contacts to ACL groups?](https://civicrm.stackexchange.com/questions/97/how-do-i-prevent-a-user-from-adding-contacts-to-acl-groups)
  
  [Permissions, ACL and Groups](https://civicrm.stackexchange.com/questions/17165/permissions-acl-and-groups)
  
  **QUESTION**
  Does anyone have feedback on the [Group Protect](https://civicrm.org/extensions/group-protect) extension? It looks very promising but the notes indicate it's a work in progress from early 2016. Or is anyone taking a different avenue to prevent users from adding themselves to ACL groups?
  
  **Tags:** groups, acl
  
  > **Comments:**
  > **username_1**: Do you have the CMS based permission to edit groups for those contacts? If you dont allow that, a restricted user can only add contacts to groups that they have an acl to view/edit.  
  > **username_0**: (Sorry, didn't say I was in Drupal). Yes, I do have the CMS permission for edit groups. I do see your point, if I don't allow them to edit their own contact they couldn't then add themselves to groups. That could work for some situations. For us, it doesn't solve the problem at large, for anyone they do have permission to edit they could add an ACL group. Also, there is a LOT wrapped up the edit contact capabilities (relationships, tags, signatures) that we still need.  
  > **username_1**: Editing the own contact is fine. But if you were to revoke the cms permission to edit groups they can only add those groups, that they have the permission for.  
  > **username_0**: I may be misunderstanding you but the CMS permissions for CiviCRM: Edit Groups states: "Create new groups, edit group settings (e.g. group name, visibility...), delete groups" and has nothing to do with adding or removing contacts to groups. I have user with the CMS permission edit groups turned off (but edit contacts turned on) and no ACLs added at all. That user can add contacts to any group they desire. The ACLs for groups only controls the ability to edit contacts in that group not whether you can add/remove membership to that group.  
  > **username_1**: Oh, that is correct. The ability to view every group is actually tied to the cms permissions "view all contacts" / "edit all contacts". If you disable those you can use civicrm acl rules to allow view / edit permissions of contacts within specific groups. As a consequence the user will only be able to see said groups and is not able to assign ACL groups even if the user has the permission to edit the contact.  
  > **username_0**: That's not the behavior I experience (once a user can edit a contact they can add/remove to ANY group.) Please forgive the rookie mistake of not including my version (Drupal 7.59  / Civi 4.6.38). Perhaps in Civi 5 there's better control.  
  > **username_1**: I have no experience with 4.6 but the code looks pretty identical regarding this functionality: https://github.com/civicrm/civicrm-core/blob/4.6/CRM/Core/Permission/DrupalBase.php#L77. You need to remove the cms permissions "view all contacts" and "edit all contacts" for this role and add an acl for each civicrm group that the contact should be able to view or edit. This way you can set permissions to edit/view contacts and restrict the visibility of groups.  
  > **username_0**: Aah, so the key here is that the ability to add to a group (or view the membership of that group on a contact) is in the ability to VIEW contacts in that group (not EDIT.) This workflow could work - in fact it's probably worth it for others to throw it below as an answer cause no one will read our zillion comments ;) For us I still have a need for a user to be able to view/edit contact A, who may happen to be a part of a 'staff ACL'. So I'd need to create a group that basically holds all our contacts and grant view/edit ACL to all roles. Not sure yet how maintainable that is for us.  
  > **username_1**: You could create a smart group containing all contacts and create a common civicrm acl role for all users for this purpose. Going the route of an extension and using the hooks hook_civicrm_aclGroup / hook_civicrm_aclGroup could probably deliver a better performance if you want to dive in there.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2018-07-31. Score: 2
  
  As you have noted, the big problem with the ACL group system is the lack of control around adding to groups. I've used the Group Protect extension previously and it does the job.
  
  > **Comments:**
  > **username_3**: But this extension doesn't work for 5.4.1 - it resulted in a solid database error - I had to remove it get going again.  
  > **username_0**: @username_3 did you see that a few days ago Jon made a commit to the project. It might work in 5.x now! https://github.com/CiviCooP/org.civicoop.groupprotect/commit/510a44159d6c96cbff5271558f2525ea5496e673 (I won't be able to test for another week or so.)  
  > **username_4**: Ha - I just came across this question trying to answer another ACL question!  Yes, I have Group Protect working with 5.7.2 after my latest changes.  
  
  ---
  
  ### Answer by username_5 on 2018-08-08. Score: 1
  
  We have found that limiting users in this way works well for access purposes, however, we have also found that users limited to groups in this way can create a contact that has no group. If they don't add a group, then they loose the ability to see or edit the contact they tried to add. Often, they then add the contact again. (and sometimes again).
  
  Also, when adding a contact through Cases->New Case->New Organisation, it is not possible to add a group on that 'easy-add' screen.
  
  It then takes an admin to login and add the group that the user forgot to add.
  
  We can see no way of making the selection of a group compulsory (or a default) when a user adds a contact on the Contacts-->New Organisation screen.
  
  We have treated this as a 'user coaching opportunity', emphasising that if they don't choose the right group, it's going to take extra time to get the data in, as they'll have to contact an admin to get the group added. At least all our users now know what to do if they forget to put a contact in the right group.
  
  We also insist that a user creates an organisation before adding a case, so that the organisation is in the correct group.
  
  Just thought I should mention these small issues we have found, and their work-rounds to hopefully save someone else the pain of working it out. Hope it helps.
  
  
  ---
  
  ### Answer by username_1 on 2018-08-07. Score: 1
  
  The ability to add groups to a contact depends on the visibility of groups for the user. The cms permissions "view all contacts" and "edit all contacts" grant visibility to all groups in the system.
  
  You need to remove the cms permissions "view all contacts" and "edit all contacts" for this role and add an acl for each civicrm group that the contact should be able to view or edit. This way you can set permissions to edit/view contacts and restrict the visibility of groups.
  
  
  ---
  
  