Answers.Body: <p>Can you try applying the <a href="https://github.com/civicrm/civicrm-core/pull/15347/files" rel="nofollow noreferrer">PR</a> changes to your current version of civi? you will need to apply it manually as the pr is closed and is very old. If you will apply it manually than it may give you conflicts errors.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-07T15:39:34.570Z
Answers.Text: Hi @pradpnayak I've applied those changes manually to the version 5.24.3 codebase and it does work on restricting the edit links for tables, but sadly the "Add new record" button is always hidden for everyone, so not even an admin can add values. Would this be something relativly easy to fix?
Answers.UserDisplayName: Darren
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-07T15:48:08.277Z
Answers.Text: @pradpnayak I've reverted the code in the template file: templates/CRM/Profile/Page/MultipleRecordFieldsListing.tpl so the button is always shown. If a user without permissions clicks the button, they receive an error which I think is acceptable behaviour. But it would be great to simply not show it.
Answers.UserDisplayName: Darren
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-07T15:55:15.913Z
Answers.Text: @pradpnaya sadly we now have a bug where the Contact Summary Layout extension is no longer changing the layout for contacts the user doesn't have permissions to edit (But they do have view permissions).
Answers.UserDisplayName: Darren
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-07T13:46:00.487Z
Answers.LastActivityDate: 2020-05-07T13:46:00.487Z
Answers.UserDisplayName: Pradeep Nayak
Body: <p>Using Wordpress 5.4.1 with Civi 5.24.3.</p>
  
  <p>We have a smart group used for ACL which prevents the core "Edit" button being shown on the contact summary.</p>
  
  <p>There is also an ACL entry for a group of contacts to view/edit a custom data group.</p>
  
  <p>However, contacts that are not in the ACL for the smart group are able to add and edit custom data (for all contacts, regardless of their ACL group).</p>
  
  <p>How can I use ACLs to prevent a contact view and editing custom data for contacts who are not in their ACL group?</p>
  
  <p>If I add the required ACL entry to give access to the custom data group, this allows them to edit ALL contacts' custom data, which seems contrary to the documentation.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-05-07T12:46:51.817Z
Comments.Text: I've just found this issue: https://lab.civicrm.org/dev/core/-/issues/882
Comments.UserDisplayName: Darren
Tags: <custom-fields><acl>
Title: How can I prevent users editing custom fields for contacts not in their ACL group?
ThreadText: # How can I prevent users editing custom fields for contacts not in their ACL group?
  
  (Asked by: username_0 on 2020-05-07)
  
  Using Wordpress 5.4.1 with Civi 5.24.3.
  
  We have a smart group used for ACL which prevents the core "Edit" button being shown on the contact summary.
  
  There is also an ACL entry for a group of contacts to view/edit a custom data group.
  
  However, contacts that are not in the ACL for the smart group are able to add and edit custom data (for all contacts, regardless of their ACL group).
  
  How can I use ACLs to prevent a contact view and editing custom data for contacts who are not in their ACL group?
  
  If I add the required ACL entry to give access to the custom data group, this allows them to edit ALL contacts' custom data, which seems contrary to the documentation.
  
  **Tags:** custom-fields, acl
  
  > **Comments:**
  > **username_0**: I've just found this issue: https://lab.civicrm.org/dev/core/-/issues/882  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-05-07. Score: 0
  
  Can you try applying the [PR](https://github.com/civicrm/civicrm-core/pull/15347/files) changes to your current version of civi? you will need to apply it manually as the pr is closed and is very old. If you will apply it manually than it may give you conflicts errors.
  
  > **Comments:**
  > **username_0**: Hi @pradpnayak I've applied those changes manually to the version 5.24.3 codebase and it does work on restricting the edit links for tables, but sadly the "Add new record" button is always hidden for everyone, so not even an admin can add values. Would this be something relativly easy to fix?  
  > **username_0**: @pradpnayak I've reverted the code in the template file: templates/CRM/Profile/Page/MultipleRecordFieldsListing.tpl so the button is always shown. If a user without permissions clicks the button, they receive an error which I think is acceptable behaviour. But it would be great to simply not show it.  
  > **username_0**: @pradpnaya sadly we now have a bug where the Contact Summary Layout extension is no longer changing the layout for contacts the user doesn't have permissions to edit (But they do have view permissions).  
  
  ---
  
  