Answers.Body: <p>Have you seen this extension:</p>
  
  <p><a href="https://civicrm.org/extensions/relationship-permissions-acls" rel="nofollow noreferrer">https://civicrm.org/extensions/relationship-permissions-acls</a></p>
  
  <p>It makes the permission flag on a relationship work like a true ACL.</p>
  
  <p>But then perhaps you don't have relationships to work with?</p>
  
  <p>So:
  - create a relationship between your Primary Contact and the Contacts he/she has access to [e.g. Counselor and the kids in the Youth Program]
  - via webform_civicrm and the additional extension above you can pull in all a Counselor's Contacts on a webform -> with enforce permissions true
  - don't allow the Counselor to create new contacts - and lock a Contact's fields; that way the activity can only be created if the Counselor has the necessary permissions to view that contact.</p>
  
  <p>To make the form not accessible to certain users who don't have the necessary permissions in CiviCRM (ACL) -> put your ACL allow users into a CiviCRM Group -> then use GroupRole Sync module to assign these users automatically to a Role when they login -> then configure your form such that only users with that role are allowed to Submit the form.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-09T19:39:50.617Z
Answers.Text: I like that last suggestion.
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-04T04:38:11.763Z
Answers.LastActivityDate: 2017-03-09T13:29:49.727Z
Answers.LastEditDate: 2017-03-09T13:29:49.727Z
Answers.UserDisplayName: KarinG - Semper IT
Body: <p>I'm building a webform to create activities against existing contacts. I want to make it so that the user completing this webform about an existing contact can only use it on contacts that are legitimately accessible to them via the ACL. Otherwise you get a message saying no and you can't fill in the form.</p>
  
  <p>Obvs I could do this in a hook, but I bet it's functionality that other people would love.</p>
  
  <p>So rather than fumble and hack around, I'm asking the community, where in webform_civicrm would be the best place for this to go? Any other tips/advice/general suggestions?</p>
  
  <p>Thanks,</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-06T21:16:12.793Z
Comments.Text: I'm confused by this question. Webform-CiviCRM does by default respect ACLs. When you add an "Existing Contact" field it will not allow users to select anyone they don't have permission to see. Am I missing something?
Comments.UserDisplayName: Coleman
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-07T09:52:20.933Z
Comments.Text: The webform is only regarding one existing contact. So I want the whole form not to be accessible if that contact isn't. @Coleman
Comments.UserDisplayName: JohnFF
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-07T16:05:06.193Z
Comments.Text: You could use the "block unknown users" in the webform-civicrm "options" tab.
Comments.UserDisplayName: Coleman
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-07T17:53:32.900Z
Comments.Text: The user will always be known - it's making sure they can't use the webform to update the contact unless they have ACL access.
Comments.UserDisplayName: JohnFF
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-07T22:53:06.220Z
Comments.Text: So unless I'm missing something you want contact 1 to be the current user and contact 2 to be the person they are acting on. Set contact 2 to use existing contact - autocomplete and do not include the name fields so it will only update, never create contacts. ACLs will kick in automatically.
Comments.UserDisplayName: Coleman
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-07T23:34:09.363Z
Comments.Text: Great - but then they can still fill in the form.
  
  I want to run an ACL check and bar the form from working if it fails. I'm wondering where the best place to put that code is.
Comments.UserDisplayName: JohnFF
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-08T11:08:39.297Z
Comments.Text: You could make the autocomplete box required and maybe hide the other parts of the form if the autocomplete is empty.
Comments.UserDisplayName: Aidan
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-09T13:31:21.113Z
Comments.Text: I've added how you could give specific users with specific ACLs  access (or not) to your webform.
Comments.UserDisplayName: KarinG - Semper IT
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-09T13:33:48.327Z
Comments.Text: Though I may still be confused by this question.
Comments.UserDisplayName: KarinG - Semper IT
Tags: <webform-civicrm>
Title: CiviCRM Webform - enforce ACL permissions
ThreadText: # CiviCRM Webform - enforce ACL permissions
  
  (Asked by: username_0 on 2017-02-06)
  
  I'm building a webform to create activities against existing contacts. I want to make it so that the user completing this webform about an existing contact can only use it on contacts that are legitimately accessible to them via the ACL. Otherwise you get a message saying no and you can't fill in the form.
  
  Obvs I could do this in a hook, but I bet it's functionality that other people would love.
  
  So rather than fumble and hack around, I'm asking the community, where in webform\_civicrm would be the best place for this to go? Any other tips/advice/general suggestions?
  
  Thanks,
  
  **Tags:** webform-civicrm
  
  > **Comments:**
  > **username_1**: I'm confused by this question. Webform-CiviCRM does by default respect ACLs. When you add an "Existing Contact" field it will not allow users to select anyone they don't have permission to see. Am I missing something?  
  > **username_0**: The webform is only regarding one existing contact. So I want the whole form not to be accessible if that contact isn't. @username_1  
  > **username_1**: You could use the "block unknown users" in the webform-civicrm "options" tab.  
  > **username_0**: The user will always be known - it's making sure they can't use the webform to update the contact unless they have ACL access.  
  > **username_1**: So unless I'm missing something you want contact 1 to be the current user and contact 2 to be the person they are acting on. Set contact 2 to use existing contact - autocomplete and do not include the name fields so it will only update, never create contacts. ACLs will kick in automatically.  
  > **username_0**: Great - but then they can still fill in the form.  I want to run an ACL check and bar the form from working if it fails. I'm wondering where the best place to put that code is.  
  > **username_2**: You could make the autocomplete box required and maybe hide the other parts of the form if the autocomplete is empty.  
  > **username_3**: I've added how you could give specific users with specific ACLs  access (or not) to your webform.  
  > **username_3**: Though I may still be confused by this question.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2017-03-04. Score: 2
  
  Have you seen this extension:
  
  <https://civicrm.org/extensions/relationship-permissions-acls>
  
  It makes the permission flag on a relationship work like a true ACL.
  
  But then perhaps you don't have relationships to work with?
  
  So:
  - create a relationship between your Primary Contact and the Contacts he/she has access to [e.g. Counselor and the kids in the Youth Program]
  - via webform\_civicrm and the additional extension above you can pull in all a Counselor's Contacts on a webform -> with enforce permissions true
  - don't allow the Counselor to create new contacts - and lock a Contact's fields; that way the activity can only be created if the Counselor has the necessary permissions to view that contact.
  
  To make the form not accessible to certain users who don't have the necessary permissions in CiviCRM (ACL) -> put your ACL allow users into a CiviCRM Group -> then use GroupRole Sync module to assign these users automatically to a Role when they login -> then configure your form such that only users with that role are allowed to Submit the form.
  
  > **Comments:**
  > **username_4**: I like that last suggestion.  
  
  ---
  
  