Answers.Body: <p>With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.</p>
  
  <p>If you need to add someone else to the group, just enable, add and disable again.</p>
  
  <p>Heather.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-11-18T12:05:24.090Z
Answers.Text: I've always used this method - its a pain but the simplest way.  Will explore the Group Protect extension to see if that is simpler.  Really, this should be baked in along with adding permissions for any data field regardless of whether it is Custom or not (e.g. data of birth, gender or any other sensitive information)
Answers.UserDisplayName: ChumKui
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-09-12T16:02:01.827Z
Answers.Text: Hi how do you prevent users from enabling the group again? thanks
Answers.UserDisplayName: Cirrus
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-03-26T10:17:29.767Z
Answers.LastActivityDate: 2015-03-26T10:17:29.767Z
Answers.UserDisplayName: Heather O.
Answers.Body: <p>There is a useful little CiviCoop extension called <a href="https://civicrm.org/extensions/group-protect" rel="nofollow noreferrer">group-protect</a> to mark a group as protected.  You can use this to protect your ACL groups and assign a permission to those who should edit them.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-05T10:43:35.963Z
Answers.LastActivityDate: 2018-06-05T10:43:35.963Z
Answers.UserDisplayName: Aidan
Answers.Body: <p>Set the view permission for the group so that users you don't want adding themselves or others to it can't see it.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-18T16:56:40.297Z
Answers.Text: How can I set the view permission for a specific group?
Answers.UserDisplayName: Graham
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-03-31T03:43:26.460Z
Answers.LastActivityDate: 2015-03-31T03:43:26.460Z
Answers.UserDisplayName: Joe Murray
Answers.Body: <p>I think you'd need to use hooks to hide the ACL groups from the dropdowns. There's a forum post <a href="http://forum.civicrm.org/index.php?topic=14595.0" rel="nofollow">here</a> that links to <a href="http://svn.civicrm.org/hrd/trunk/drupal/hrd.module" rel="nofollow">a module</a> that does this - looks like it could be adapted into an extension to hide the groups from everyone but admins. It's a few years old, mind.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-03-26T11:30:19.193Z
Answers.LastActivityDate: 2015-03-26T11:30:19.193Z
Answers.UserDisplayName: Andrew West
Answers.Body: <p>CiviCRM has an option for groups in the group settings to make the group "Reserved".  You can use this setting along with the CMS permission "CiviCRM: administer reserved groups" to limit who can edit a group.</p>
  
  <p>For more information, here are some good docs:  <a href="http://book.civicrm.org/user/current/organising-your-data/groups-and-tags/" rel="nofollow">http://book.civicrm.org/user/current/organising-your-data/groups-and-tags/</a></p>
  
  <p>Another way to control who can create groups is using hook_civicrm_buildForm and warning/redirecting the user to another page if they don't have certain permissions.  See code snippet below.</p>
  
  <pre><code>function memberperms_civicrm_buildForm( $formName, &amp;$form ) {
      if (strpos($formName, "AddToGroup")
          and
          !CRM_Core_Permission::check('edit all contacts')
      ) {
  
          // Display Error Message
          CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");
  
          // Redirect to civicrm home
          drupal_goto("civicrm"); 
      }
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-07T08:02:44.120Z
Answers.Text: From my testing, it appears that making a group "Reserved" does not prevent a user from adding himself to the group. (The Group Settings dialog itself says "If reserved, only users with 'administer reserved groups' permission can disable, delete, or change settings for this group. The reserved flag does NOT affect users ability to add or remove contacts from a group.")
Answers.UserDisplayName: Martin_W
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-23T21:50:46.347Z
Answers.Text: Please see most recent edit where I offer a workaround with hook_civicrm_buildForm.
Answers.UserDisplayName: bdombro
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-21T22:35:12.263Z
Answers.LastActivityDate: 2015-04-23T21:50:14.183Z
Answers.LastEditDate: 2015-04-23T21:50:14.183Z
Answers.UserDisplayName: bdombro
Body: <p>I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events. </p>
  
  <p>What I am trying to figure out is how to prevent low-level users from adding themselves (or other contacts) to the CiviCRM group "NYC Team".  (If a low level user can add themselves (or others) to the group "NYC Team" (and other Access Control type groups), it renders the ACLs to be ineffective.  </p>
  
Tags: <groups><security><acl>
Title: How do I prevent a user from adding contacts to ACL groups?
ThreadText: # How do I prevent a user from adding contacts to ACL groups?
  
  (Asked by: username_0 on 2015-03-25)
  
  I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events.
  
  What I am trying to figure out is how to prevent low-level users from adding themselves (or other contacts) to the CiviCRM group "NYC Team". (If a low level user can add themselves (or others) to the group "NYC Team" (and other Access Control type groups), it renders the ACLs to be ineffective.
  
  **Tags:** groups, security, acl
  
  
  ---
  
  ## 5 answers
  
  ### Answer by username_1 on 2015-03-26. Score: 9
  
  With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.
  
  If you need to add someone else to the group, just enable, add and disable again.
  
  Heather.
  
  > **Comments:**
  > **username_2**: I've always used this method - its a pain but the simplest way.  Will explore the Group Protect extension to see if that is simpler.  Really, this should be baked in along with adding permissions for any data field regardless of whether it is Custom or not (e.g. data of birth, gender or any other sensitive information)  
  > **username_3**: Hi how do you prevent users from enabling the group again? thanks  
  
  ---
  
  ### Answer by username_4 on 2018-06-05. Score: 3
  
  There is a useful little CiviCoop extension called [group-protect](https://civicrm.org/extensions/group-protect) to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.
  
  
  ---
  
  ### Answer by username_5 on 2015-03-31. Score: 2
  
  Set the view permission for the group so that users you don't want adding themselves or others to it can't see it.
  
  > **Comments:**
  > **username_6**: How can I set the view permission for a specific group?  
  
  ---
  
  ### Answer by username_7 on 2015-03-26. Score: 2
  
  I think you'd need to use hooks to hide the ACL groups from the dropdowns. There's a forum post [here](http://forum.civicrm.org/index.php?topic=14595.0) that links to [a module](http://svn.civicrm.org/hrd/trunk/drupal/hrd.module) that does this - looks like it could be adapted into an extension to hide the groups from everyone but admins. It's a few years old, mind.
  
  
  ---
  
  ### Answer by username_8 on 2015-04-21. Score: 0
  
  CiviCRM has an option for groups in the group settings to make the group "Reserved".  You can use this setting along with the CMS permission "CiviCRM: administer reserved groups" to limit who can edit a group.
  For more information, here are some good docs:  http://book.civicrm.org/user/current/organising-your-data/groups-and-tags/
  Another way to control who can create groups is using hook_civicrm_buildForm and warning/redirecting the user to another page if they don't have certain permissions.  See code snippet below.
  function memberperms_civicrm_buildForm( $formName, &$form ) {
      if (strpos($formName, "AddToGroup")
          and
          !CRM_Core_Permission::check('edit all contacts')
      ) {
  
          // Display Error Message
          CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");
  
          // Redirect to civicrm home
          drupal_goto("civicrm"); 
      }
  }
  
  > **Comments:**
  > **username_8**: Please see most recent edit where I offer a workaround with hook_civicrm_buildForm.  
  > **username_9**: From my testing, it appears that making a group "Reserved" does not prevent a user from adding himself to the group. (The Group Settings dialog itself says "If reserved, only users with 'administer reserved groups' permission can disable, delete, or change settings for this group. The reserved flag does NOT affect users ability to add or remove contacts from a group.")  
  
  ---
  
  