Answers.Body: <p>Figured it out thanks to @Colemanw.</p>
  
  <p>The relationship permissions are only for dashboard access and do not act as ACL permissions. </p>
  
  <p>I installed <a href="https://civicrm.org/extensions/relationship-permissions-acls" rel="noreferrer">this extension</a> which transforms relationship permissions into ACL permissions. 
  Now it is simple, I simply enable the 'Enforce Permission' option in the'Existing User' field and the drop down only shows the intended contacts.</p>
  
  <p>Yosef</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T03:45:16.270Z
Answers.Text: Hi @Yossi - are you having users (parents) logged in - or are you using cid and cs tokens in the URL?
Answers.UserDisplayName: KarinG - Semper IT
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T03:46:38.990Z
Answers.Text: I am having them log in
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T03:54:27.717Z
Answers.Text: I'm trying to just use cid and cs for an event with guests type registration - have you ever tried that w/ permissions?
Answers.UserDisplayName: KarinG - Semper IT
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T04:05:37.690Z
Answers.Text: IIRC, that wont work if "enforce permissions" is enabled.
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T04:18:03.677Z
Answers.Text: Yep - found it: https://www.drupal.org/node/2406823
Answers.UserDisplayName: KarinG - Semper IT
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T04:19:06.090Z
Answers.Text: user accounts it is  thanks Yossi and good evening!
Answers.UserDisplayName: KarinG - Semper IT
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-08-31T04:35:25.777Z
Answers.Text: Maybe take a look at @Paul Mosey comment above where he leaves the permissions disabled and loads the form in a modal/colorbox so that the URL can't be tinkered with
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-25T21:37:12.857Z
Answers.LastActivityDate: 2015-11-25T21:37:12.857Z
Answers.UserDisplayName: Yossi
Answers.Body: <p>This doesn't answer your question specifically, but we create this exact functionality through Views and a Webform.  The view does most of the heavy lifting.</p>
  
  <p>We create a CiviCRM contact view, we use a contextual filter for the current user, add contact id for the child and render it in a table that displays the child's name and an Edit Now link to the Webform with a url of node/1?cid1=[id].</p>
  
  <p>In our case, we use households as the relationship (that's why there are quite a few relationships), but it would be easier if you only had to use Child of.</p>
  
  <p>On the webform, I only have one contact (the child) and it is set to static.</p>
  
  <p><a href="https://i.sstatic.net/2YvX0.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/2YvX0.png" alt="enter image description here"></a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-25T14:12:31.917Z
Answers.Text: Cool. If someone changes the [id] in the URL would it show the contact represented by new Id? That still might be a security issue.
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-25T14:47:00.457Z
Answers.Text: It would, but I would keep testing with the 2 contacts on the webform and playing with the relationship stuff on the webform component for the child.    I have it open in a colorbox so they don't actually see the url.
Answers.UserDisplayName: pmoz
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-25T23:27:25.833Z
Answers.Text: I want to display all contacts who Relationship≠"Paired with". The view creates a table row for every relationship, so I end up with 3 rows per contact, it does remove the row with Relationship="Paired with" but I want the whole contact to disappear. Any ideas?
Answers.UserDisplayName: Yossi
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-26T00:59:41.637Z
Answers.Text: Not certain I understand.
Answers.UserDisplayName: pmoz
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-26T01:08:58.417Z
Answers.Text: if i understand you can 'group by' in your table, and use Contact A for that field, then you should just see the names of the 3x Contact B underneath
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-25T12:19:11.240Z
Answers.LastActivityDate: 2015-11-26T00:55:18.000Z
Answers.LastEditDate: 2015-11-26T00:55:18.000Z
Answers.UserDisplayName: pmoz
Body: <p>On my webform, I enabled 2 contacts. Contact 1 has 'Existing user' enabled and set to 'static' and default value is 'current user'. Contact 2 has 'Existing user' enabled and set to 'drop down' and default value is 'relationship to contact 1' relationship = 'child of'.</p>
  
  <p>My goal is that contact 1 can go to that form and select one of his children and fill out the form. 
  The form doesn't respect the filter and displays all civicrm contacts in the drop down menu. </p>
  
  <p>I also tried setting default values to use filters and set the filter to contact type to= campers, I also enabled the 'Enforce Permissions'. 
  The drop down still displays all civicrm contacts for contact 1 even though he only has permissions to edit his/her child. </p>
  
  <p><a href="https://i.sstatic.net/FKg4n.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FKg4n.png" alt="enter image description here"></a>
  <a href="https://i.sstatic.net/ulXt2.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/ulXt2.png" alt="enter image description here"></a></p>
  
Tags: <webform-civicrm>
Title: Webform civicrm integration not respecting permissions
ThreadText: # Webform civicrm integration not respecting permissions
  
  (Asked by: username_0 on 2015-11-24)
  
  On my webform, I enabled 2 contacts. Contact 1 has 'Existing user' enabled and set to 'static' and default value is 'current user'. Contact 2 has 'Existing user' enabled and set to 'drop down' and default value is 'relationship to contact 1' relationship = 'child of'.
  
  My goal is that contact 1 can go to that form and select one of his children and fill out the form.
  The form doesn't respect the filter and displays all civicrm contacts in the drop down menu.
  
  I also tried setting default values to use filters and set the filter to contact type to= campers, I also enabled the 'Enforce Permissions'.
  The drop down still displays all civicrm contacts for contact 1 even though he only has permissions to edit his/her child.
  
  [![enter image description here](https://i.sstatic.net/FKg4n.png)](https://i.sstatic.net/FKg4n.png)
  [![enter image description here](https://i.sstatic.net/ulXt2.png)](https://i.sstatic.net/ulXt2.png)
  
  **Tags:** webform-civicrm
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2015-11-25. Score: 5
  
  Figured it out thanks to @Colemanw.
  
  The relationship permissions are only for dashboard access and do not act as ACL permissions.
  
  I installed [this extension](https://civicrm.org/extensions/relationship-permissions-acls) which transforms relationship permissions into ACL permissions.
  Now it is simple, I simply enable the 'Enforce Permission' option in the'Existing User' field and the drop down only shows the intended contacts.
  
  Yosef
  
  > **Comments:**
  > **username_1**: Hi @username_0 - are you having users (parents) logged in - or are you using cid and cs tokens in the URL?  
  > **username_0**: I am having them log in  
  > **username_1**: I'm trying to just use cid and cs for an event with guests type registration - have you ever tried that w/ permissions?  
  > **username_0**: IIRC, that wont work if "enforce permissions" is enabled.  
  > **username_1**: Yep - found it: https://www.drupal.org/node/2406823  
  > **username_1**: user accounts it is  thanks username_0 and good evening!  
  > **username_0**: Maybe take a look at @Paul Mosey comment above where he leaves the permissions disabled and loads the form in a modal/colorbox so that the URL can't be tinkered with  
  
  ---
  
  ### Answer by username_2 on 2015-11-25. Score: 1
  
  This doesn't answer your question specifically, but we create this exact functionality through Views and a Webform. The view does most of the heavy lifting.
  
  We create a CiviCRM contact view, we use a contextual filter for the current user, add contact id for the child and render it in a table that displays the child's name and an Edit Now link to the Webform with a url of node/1?cid1=[id].
  
  In our case, we use households as the relationship (that's why there are quite a few relationships), but it would be easier if you only had to use Child of.
  
  On the webform, I only have one contact (the child) and it is set to static.
  
  [![enter image description here](https://i.sstatic.net/2YvX0.png)](https://i.sstatic.net/2YvX0.png)
  
  > **Comments:**
  > **username_0**: Cool. If someone changes the [id] in the URL would it show the contact represented by new Id? That still might be a security issue.  
  > **username_2**: It would, but I would keep testing with the 2 contacts on the webform and playing with the relationship stuff on the webform component for the child.    I have it open in a colorbox so they don't actually see the url.  
  > **username_0**: I want to display all contacts who Relationship≠"Paired with". The view creates a table row for every relationship, so I end up with 3 rows per contact, it does remove the row with Relationship="Paired with" but I want the whole contact to disappear. Any ideas?  
  > **username_2**: Not certain I understand.  
  > **username_3**: if i understand you can 'group by' in your table, and use Contact A for that field, then you should just see the names of the 3x Contact B underneath  
  
  ---
  
  