Answers.Body: <p>Permissions control is not related to Civi groups. It is controlled by WordPress user roles as you suggest for #1 fix. You should have no trouble from a security management stand point to set it up so staff cannot assign themselves to other roles.</p>
  
  <p>You might want to add this plugin for better control. <a href="https://www.role-editor.com/" rel="nofollow noreferrer">https://www.role-editor.com/</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-02-17T10:55:42.707Z
Answers.Text: Ok, maybe my question was not clear enough:  
  
  -  Permission control is related to Civi (access control) groups when using ACL  
  
  -  Possible permissions: "permission to change own group" or "assign user to control access groups" is not included in civicrm (wordpress)role-related permission set (phase #1 will change that)  
  
  -  Problem described is not related to user changing his/her own role but changing his own access control group and (through it) its ACL related permissions
Answers.UserDisplayName: Daniel Martínez
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-04-26T02:52:56.297Z
Answers.Text: There is a difference between WordPress User (create/edit/delete) and Civi Contacts (create/edit/delete). If you follow my answer above--Your Admin Role has access to WP User create/edit/delete (they are the only ones that can set Civi ACLs). You create your other Roles that need access to edit Civi contacts without WP User access and they cannot assign themselves to other ACL groups. Maybe my User Roles look different because I use the above mentioned plugin.
Answers.UserDisplayName: Iowa Boy
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-10T12:48:24.873Z
Answers.Text: Even if WP user does not have WP user-related perms, it can change its contact's own groups in the CRM database, giving him civi permissions related to those groups (i.e. "London manager" can assign himself to group "Paris manager" giving him access to Paris contacts)
Answers.UserDisplayName: Daniel Martínez
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-02-11T23:34:28.373Z
Answers.LastActivityDate: 2017-02-12T01:31:20.733Z
Answers.LastEditDate: 2017-02-12T01:31:20.733Z
Answers.UserDisplayName: Iowa Boy
Body: <p>I would like to confirm this statements regarding permissions, ACL and groups (Wordpress 4.7.1, civicrm 4.7.15)</p>
  
  <ol>
  <li>Permission to edit contacts (ACL or general), allows user to
  assign contacts to ANY group</li>
  <li>As 1 is true, user can add himself to another group and thus
  obtain its ACL related permissions</li>
  </ol>
  
  <p>This is a serious issue for us as it hinders the flexible security management ACL provides. I would like to evaluate viability of a feature to solve this problem. I see two approaches:</p>
  
  <ol>
  <li>A general permission (not ACL related, in wordpress related to
  wordpress user role) which would control assignment to control
  access groups (this will be enough for our organization) </li>
  <li>As 1, combined with ACL permissions (p.e. denied general permission but
  allowed assignment to certain control access groups through ACL)</li>
  </ol>
  
  <p>I would be capable to work in any of this approaches (1 in first phase, then 2) but I am not yet very familiar with civicrm code structure. Can you point out the possible problems and difficulties of implementation of these features? Is there any related isssue in Jira?</p>
  
  <p>Thank you</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-02-02T10:23:14.707Z
Comments.Text: I ran into the same issue. It's rather insane behaviour if you ask me.
Comments.UserDisplayName: Nuoji
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-03-14T17:42:54.497Z
Comments.Text: FWIW I can't confirm this on CiviCRM 5.10 (and Drupal 7) - users who only have access to contacts by way of an ACL rule cannot add people to any group; therefore cannot add themself or anyone else into a group that would grant ACL access.
Comments.UserDisplayName: artfulrobot
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-09-18T12:24:00.793Z
Comments.Text: We have the same question... @Daniel Martinez did you finally find out how to do what you wanted ?
Comments.UserDisplayName: fred neau
Tags: <groups><permissions><acl>
Title: Permissions, ACL and Groups
ThreadText: # Permissions, ACL and Groups
  
  (Asked by: username_0 on 2017-02-10)
  
  I would like to confirm this statements regarding permissions, ACL and groups (Wordpress 4.7.1, civicrm 4.7.15)
  
  1. Permission to edit contacts (ACL or general), allows user to
     assign contacts to ANY group
  2. As 1 is true, user can add himself to another group and thus
     obtain its ACL related permissions
  
  This is a serious issue for us as it hinders the flexible security management ACL provides. I would like to evaluate viability of a feature to solve this problem. I see two approaches:
  
  1. A general permission (not ACL related, in wordpress related to
     wordpress user role) which would control assignment to control
     access groups (this will be enough for our organization)
  2. As 1, combined with ACL permissions (p.e. denied general permission but
     allowed assignment to certain control access groups through ACL)
  
  I would be capable to work in any of this approaches (1 in first phase, then 2) but I am not yet very familiar with civicrm code structure. Can you point out the possible problems and difficulties of implementation of these features? Is there any related isssue in Jira?
  
  Thank you
  
  **Tags:** groups, permissions, acl
  
  > **Comments:**
  > **username_1**: I ran into the same issue. It's rather insane behaviour if you ask me.  
  > **username_2**: FWIW I can't confirm this on CiviCRM 5.10 (and Drupal 7) - users who only have access to contacts by way of an ACL rule cannot add people to any group; therefore cannot add themself or anyone else into a group that would grant ACL access.  
  > **username_3**: We have the same question... @Daniel Martinez did you finally find out how to do what you wanted ?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_4 on 2017-02-11. Score: 0
  
  Permissions control is not related to Civi groups. It is controlled by WordPress user roles as you suggest for #1 fix. You should have no trouble from a security management stand point to set it up so staff cannot assign themselves to other roles.
  
  You might want to add this plugin for better control. <https://www.role-editor.com/>
  
  > **Comments:**
  > **username_0**: Ok, maybe my question was not clear enough:    -  Permission control is related to Civi (access control) groups when using ACL    -  Possible permissions: "permission to change own group" or "assign user to control access groups" is not included in civicrm (wordpress)role-related permission set (phase #1 will change that)    -  Problem described is not related to user changing his/her own role but changing his own access control group and (through it) its ACL related permissions  
  > **username_4**: There is a difference between WordPress User (create/edit/delete) and Civi Contacts (create/edit/delete). If you follow my answer above--Your Admin Role has access to WP User create/edit/delete (they are the only ones that can set Civi ACLs). You create your other Roles that need access to edit Civi contacts without WP User access and they cannot assign themselves to other ACL groups. Maybe my User Roles look different because I use the above mentioned plugin.  
  > **username_0**: Even if WP user does not have WP user-related perms, it can change its contact's own groups in the CRM database, giving him civi permissions related to those groups (i.e. "London manager" can assign himself to group "Paris manager" giving him access to Paris contacts)  
  
  ---
  
  