Answers.Body: <p>Probably not the answer you were hoping for :-(, but confirming that is a current limitation.  ACL's for custom data do not distinguish between View &amp; Edit.  On the New ACL screen, when you set the type of data to custom data, a message is shown:  </p>
  
  <blockquote>
    <p>NOTE: For Custom Data ACLs, the 'View' and 'Edit' operations
    currently do the same thing. Either option grants the right to view
    AND / OR edit custom data fields (in all groups, or in a specific
    custom data group). Neither option grants access to administration of
    custom data fields.</p>
  </blockquote>
  
  <p>It would be a useful enhancement to fix that, but you can't do what you want without writing code.</p>
  
  <p>If you just want to deter some people from changing the data then adding a bit of jQuery to disable options would be fairly simple. That is not secure since a user can bypass it.</p>
  
  <p>For a more robust approach, you could try <a href="https://wiki.civicrm.org/confluence/display/CRMDOC/hook_civicrm_validateForm" rel="nofollow noreferrer">hook_civicrm_validateForm</a>.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-16T08:51:58.520Z
Answers.Text: It is already in Jira, see https://issues.civicrm.org/jira/browse/CRM-16303
Answers.UserDisplayName: Kainuk - CiviCooP
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-16T11:20:23.910Z
Answers.Text: Forget the advanced CiviCRM ACL.  The basic Content Management System (CMS) Access Control does not work!  Are you saying even the basic Drupal Access Control cannot prevent the editing of multi-record custom data sets?
Answers.UserDisplayName: Ron Gridley
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-17T10:47:31.650Z
Answers.Text: Yes - if you look at the available Drupal permissions there is 'access all custom data' but not a separate 'edit' permission.  The Access Control system does work, but it may not do what you would like it to. You can change that if it is important to you: as an Open Source product, it grows by people encountering things they want to improve and sponsoring those changes.
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-16T08:29:54.970Z
Answers.LastActivityDate: 2017-01-16T08:29:54.970Z
Answers.UserDisplayName: Aidan
Body: <p>I am using some multi-record custom data sets and they are working well. I have been able to import records, use them in reports, use them in searches, add/edit and delete records.  All seems to work fine for me except the authorization.</p>
  
  <p>I have simple permissions - 1) Edit everything and 2) View Only.  However, the multi-record custom data sets are open for update (add/edit/delete) for the view only users.  The view only users cannot edit any other aspect of a contact yet they can do anything to a custom data set.</p>
  
  <p>I have tried refining the permissions using ACLs for the custom data sets with the same result.</p>
  
  <p>Is there something I can do to make the multi-record custom data sets not open for change? </p>
  
  <p>We are using Drupal and CiviCRM 4.6</p>
  
Tags: <drupal><custom-fields><permissions><acl>
Title: Multi-Record Custom Data Set - Permissions (View/Edit)
ThreadText: # Multi-Record Custom Data Set - Permissions (View/Edit)
  
  (Asked by: username_0 on 2017-01-15)
  
  I am using some multi-record custom data sets and they are working well. I have been able to import records, use them in reports, use them in searches, add/edit and delete records. All seems to work fine for me except the authorization.
  
  I have simple permissions - 1) Edit everything and 2) View Only. However, the multi-record custom data sets are open for update (add/edit/delete) for the view only users. The view only users cannot edit any other aspect of a contact yet they can do anything to a custom data set.
  
  I have tried refining the permissions using ACLs for the custom data sets with the same result.
  
  Is there something I can do to make the multi-record custom data sets not open for change?
  
  We are using Drupal and CiviCRM 4.6
  
  **Tags:** drupal, custom-fields, permissions, acl
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-01-16. Score: 2
  
  Probably not the answer you were hoping for :-(, but confirming that is a current limitation. ACL's for custom data do not distinguish between View & Edit. On the New ACL screen, when you set the type of data to custom data, a message is shown:
  
  > NOTE: For Custom Data ACLs, the 'View' and 'Edit' operations
  > currently do the same thing. Either option grants the right to view
  > AND / OR edit custom data fields (in all groups, or in a specific
  > custom data group). Neither option grants access to administration of
  > custom data fields.
  
  It would be a useful enhancement to fix that, but you can't do what you want without writing code.
  
  If you just want to deter some people from changing the data then adding a bit of jQuery to disable options would be fairly simple. That is not secure since a user can bypass it.
  
  For a more robust approach, you could try [hook\_civicrm\_validateForm](https://wiki.civicrm.org/confluence/display/CRMDOC/hook_civicrm_validateForm).
  
  > **Comments:**
  > **username_2**: It is already in Jira, see https://issues.civicrm.org/jira/browse/CRM-16303  
  > **username_0**: Forget the advanced CiviCRM ACL.  The basic Content Management System (CMS) Access Control does not work!  Are you saying even the basic Drupal Access Control cannot prevent the editing of multi-record custom data sets?  
  > **username_1**: Yes - if you look at the available Drupal permissions there is 'access all custom data' but not a separate 'edit' permission.  The Access Control system does work, but it may not do what you would like it to. You can change that if it is important to you: as an Open Source product, it grows by people encountering things they want to improve and sponsoring those changes.  
  
  ---
  
  