Answers.Body: <p>Have you tested this as a regular user and not as an admin or higher-level user? There should be a set of permissions that define whether or not users can edit their accounts, the accounts of others, etc. Make sure "edit all contacts" is only select for the appropriate role(s).</p>
  
  <p>Here's what they look like in Drupal, for an idea:</p>
  
  <p><a href="https://i.sstatic.net/YXtzn.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/YXtzn.png" alt="enter image description here"></a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T07:38:14.977Z
Answers.Text: The question is wordpress related and I agree with Christia but you should find out how set permissions in wordpress. I dont know how to do that.  Have a look at the documentation: https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/
Answers.UserDisplayName: Jaap Jansma - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T15:22:50.780Z
Answers.Text: thanks both, from what I can see it seems like it is not a good idea to expose profile fields in contribution pages as they can be easily overwritten. i'll look into permissions too though to see if it can limited.
Answers.UserDisplayName: dgk112
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T21:25:35.147Z
Answers.Text: having profile fields on Contribution pages is totally fine - you just need to sort out your permissions so the average user cannot fill in the form 'as someone else'
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-22T17:53:12.913Z
Answers.LastActivityDate: 2018-08-22T17:53:12.913Z
Answers.UserDisplayName: Christia
Answers.Body: <p>I do not know if you can achieve this with configuration. However, it can be coded. The idea is that section you want to hide is marked with a unique css class <code>crm-not-you-message</code>.</p>
  
  <p>Create an extension (see <a href="https://docs.civicrm.org/dev/en/latest/extensions/" rel="nofollow noreferrer">https://docs.civicrm.org/dev/en/latest/extensions/</a>).</p>
  
  <p>Create a file in the extension with the name <code>&lt;extensiondir&gt;/templates/CRM/Contribute/Form/Contribution/Main.extra.tpl</code></p>
  
  <p>Add the following code to the file</p>
  
  <pre><code>{literal}
    &lt;!-- ui removing link --&gt;
    &lt;script type="text/javascript"&gt;
       CRM.$('.crm-not-you-message').hide();
    &lt;/script&gt;
  {/literal}
  </code></pre>
  
  <p>This code is appended (due to workings of the CiviCRM extension) to the page. The <code>CRM.$</code> function selects the elements and hides it.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T15:23:57.940Z
Answers.Text: thanks for this.  could you clarify please will this 'hide' the link as in just making it not visible?  will it still be in the page source code?
Answers.UserDisplayName: dgk112
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T17:43:56.227Z
Answers.Text: It is still visible in the page source code. So it prevents mischief of the general user but does not make the page safe for more users that can code.  That can be also done but is more complicated.
Answers.UserDisplayName: Kainuk - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T18:02:28.503Z
Answers.Text: ok - thank you Kainuk for your help:)
Answers.UserDisplayName: dgk112
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-23T08:06:57.180Z
Answers.LastActivityDate: 2018-08-23T08:06:57.180Z
Answers.UserDisplayName: Kainuk - CiviCooP
Answers.Body: <p>Editing the ACL configuration does a good job of handling broad, role-based problems of anonymous users accidentally or deliberately overwriting data in a profile, (eg. <a href="https://civicrm.stackexchange.com/questions/24588/unwanted-links-do-this-for-different-person-on-membership-signup-page">Unwanted links &quot;do this for different person&quot; on membership signup page</a> and <a href="https://civicrm.stackexchange.com/questions/832/how-to-delete-not-you-or-want-to-join-for-a-different-person">How to delete &quot;Not you or want to join..for a different person&quot;?</a>. Hiding the code from display is one way of solving the problem that stems from what I think is a design feature that may work well for many but in some cases like this, is sub-optimal. The message tends to appear for authenticated users, and the feature is illustrated by this help dialog for 'What to do upon duplicate match' in <em>advanced settings</em> for the relevant profile settings page:</p>
  
  <blockquote>
    <p>If you are using the profile as a contact signup and editing form - this option controls what happens if the data matches an existing contact record. Using this option user can update the matching record or create a duplicate record or otherwise he will get a 'duplicate record' warning, and their input will not be saved.</p>
  </blockquote>
  
  <p>However, it goes on to say:</p>
  
  <blockquote>
    <p>This setting is ignored if the profile is embedded in an online > contribution, member signup or event registration form. In this case a contact match always results in the transaction being linked to the matching contact.</p>
  </blockquote>
  
  <p>So, the message combined with the default "Individual Strict Duplicate Matching Rule" (match on email address) gives rise to a concern with existing contact data being over-written by authenticated visitors with many ACL's.</p>
  
  <p>The solution given is as follows:</p>
  
  <blockquote>
    <p>...if you NEVER want anonymous input to match (i.e. always create a new contact record) - edit that rule and set the 'weight threshold' higher than 10. You will then need to run Find Duplicates periodically using a different rule, and merge any duplicate records with their associated passports, contributions, etc.</p>
  </blockquote>
  
  <p>For smaller outfits this seems like a fair bit of admin overhead, so if this is a concern I suggest setting up your own custom <code>Main.tpl</code> template file here:</p>
  
  <pre><code>[civicrm.root]/custom_templates/CRM/Contribute/Form/Contribution/Main.tpl
  </code></pre>
  
  <p>At around line 75 remove the link so it just leaves: <code>{ts 1=$display_name}Welcome %1{/ts}</code>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-09-27T00:01:32.670Z
Answers.LastActivityDate: 2018-09-27T00:01:32.670Z
Answers.UserDisplayName: Mat K. Witts
Body: <p>I'm obviously missing something...</p>
  
  <p>Wordpress / civicrm 5.4</p>
  
  <p>I have a contribution / membership renewal page to allow members to renew.   They need to log in before veiwing the page  It presents them with their contact info via a profile and allows them to change any incorrect info and then asks them to select their membership type and pay.  All seems to work  great!</p>
  
  <p>Except for the link that says 'want to do this for someone else?'  If they click on this and happen to know the email address of another member seems they can rewrite all their contact info?!</p>
  
  <p>I don't seem to be able remove this link.</p>
  
  <p>The above is obviously bonkers.  But what am i doing wrong please? 
  Is the 'do for different person' link removable?
  Is it not possible to limit the ability of members to update info to their own records? Is there a permission I need to set somewhere?  Or do I just need to separate out the processes for making contribution from the process for maintaining contact info?</p>
  
  <p>thank you:)</p>
  
Tags: <civimember><permissions>
Title: How to remove the link 'do this for different person?' on a contribution / membership renewal page
ThreadText: # How to remove the link 'do this for different person?' on a contribution / membership renewal page
  
  (Asked by: username_0 on 2018-08-22)
  
  I'm obviously missing something...
  
  Wordpress / civicrm 5.4
  
  I have a contribution / membership renewal page to allow members to renew. They need to log in before veiwing the page It presents them with their contact info via a profile and allows them to change any incorrect info and then asks them to select their membership type and pay. All seems to work great!
  
  Except for the link that says 'want to do this for someone else?' If they click on this and happen to know the email address of another member seems they can rewrite all their contact info?!
  
  I don't seem to be able remove this link.
  
  The above is obviously bonkers. But what am i doing wrong please?
  Is the 'do for different person' link removable?
  Is it not possible to limit the ability of members to update info to their own records? Is there a permission I need to set somewhere? Or do I just need to separate out the processes for making contribution from the process for maintaining contact info?
  
  thank you:)
  
  **Tags:** civimember, permissions
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2018-08-22. Score: 2
  
  Have you tested this as a regular user and not as an admin or higher-level user? There should be a set of permissions that define whether or not users can edit their accounts, the accounts of others, etc. Make sure "edit all contacts" is only select for the appropriate role(s).
  
  Here's what they look like in Drupal, for an idea:
  
  [![enter image description here](https://i.sstatic.net/YXtzn.png)](https://i.sstatic.net/YXtzn.png)
  
  > **Comments:**
  > **username_2**: The question is wordpress related and I agree with username_1 but you should find out how set permissions in wordpress. I dont know how to do that.  Have a look at the documentation: https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/  
  > **username_0**: thanks both, from what I can see it seems like it is not a good idea to expose profile fields in contribution pages as they can be easily overwritten. i'll look into permissions too though to see if it can limited.  
  > **username_3**: having profile fields on Contribution pages is totally fine - you just need to sort out your permissions so the average user cannot fill in the form 'as someone else'  
  
  ---
  
  ### Answer by username_4 on 2018-08-23. Score: 1
  
  I do not know if you can achieve this with configuration. However, it can be coded. The idea is that section you want to hide is marked with a unique css class `crm-not-you-message`.
  
  Create an extension (see <https://docs.civicrm.org/dev/en/latest/extensions/>).
  
  Create a file in the extension with the name `<extensiondir>/templates/CRM/Contribute/Form/Contribution/Main.extra.tpl`
  
  Add the following code to the file
  
  ```
  {literal}
    <!-- ui removing link -->
    <script type="text/javascript">
       CRM.$('.crm-not-you-message').hide();
    </script>
  {/literal}
  
  ```
  
  This code is appended (due to workings of the CiviCRM extension) to the page. The `CRM.$` function selects the elements and hides it.
  
  > **Comments:**
  > **username_0**: thanks for this.  could you clarify please will this 'hide' the link as in just making it not visible?  will it still be in the page source code?  
  > **username_4**: It is still visible in the page source code. So it prevents mischief of the general user but does not make the page safe for more users that can code.  That can be also done but is more complicated.  
  > **username_0**: ok - thank you username_4 for your help:)  
  
  ---
  
  ### Answer by username_5 on 2018-09-27. Score: 0
  
  Editing the ACL configuration does a good job of handling broad, role-based problems of anonymous users accidentally or deliberately overwriting data in a profile, (eg. [Unwanted links "do this for different person" on membership signup page](https://civicrm.stackexchange.com/questions/24588/unwanted-links-do-this-for-different-person-on-membership-signup-page) and [How to delete "Not you or want to join..for a different person"?](https://civicrm.stackexchange.com/questions/832/how-to-delete-not-you-or-want-to-join-for-a-different-person). Hiding the code from display is one way of solving the problem that stems from what I think is a design feature that may work well for many but in some cases like this, is sub-optimal. The message tends to appear for authenticated users, and the feature is illustrated by this help dialog for 'What to do upon duplicate match' in *advanced settings* for the relevant profile settings page:
  
  > If you are using the profile as a contact signup and editing form - this option controls what happens if the data matches an existing contact record. Using this option user can update the matching record or create a duplicate record or otherwise he will get a 'duplicate record' warning, and their input will not be saved.
  
  However, it goes on to say:
  
  > This setting is ignored if the profile is embedded in an online > contribution, member signup or event registration form. In this case a contact match always results in the transaction being linked to the matching contact.
  
  So, the message combined with the default "Individual Strict Duplicate Matching Rule" (match on email address) gives rise to a concern with existing contact data being over-written by authenticated visitors with many ACL's.
  
  The solution given is as follows:
  
  > ...if you NEVER want anonymous input to match (i.e. always create a new contact record) - edit that rule and set the 'weight threshold' higher than 10. You will then need to run Find Duplicates periodically using a different rule, and merge any duplicate records with their associated passports, contributions, etc.
  
  For smaller outfits this seems like a fair bit of admin overhead, so if this is a concern I suggest setting up your own custom `Main.tpl` template file here:
  
  ```
  [civicrm.root]/custom_templates/CRM/Contribute/Form/Contribution/Main.tpl
  
  ```
  
  At around line 75 remove the link so it just leaves: `{ts 1=$display_name}Welcome %1{/ts}`.
  
  
  ---
  
  