Answers.Body: <p>Your ACL allows to view and edit all custom fields sets. I guess you previously had <strong>CiviCRM: view all contacts</strong> to be able to see the contacts at all. </p>
  
  <p>You still need to grant a view permission to access the contact or an edit permission to allow any modification to your desired set of contacts: <a href="https://i.sstatic.net/OF0WQ.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/OF0WQ.png" alt="ACL Edit Group Permission"></a></p>
  
  <p>I'm not aware that you can grant permission to edit custom fields without permission to edit the contact while using the UI.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-06T17:20:19.883Z
Answers.Text: In fact I was not using drupal permission **CiviCRM: view all contacts**. Instead, I was using ACL which enabled specific **role** to **view** specific **group**. In this way the user could access the list of contacts (via direct link to smart group), but could not see contacts outside that list. The only problem is with giving the edit access to custom fields (or any fields) of only these contacts.
  
  Then I wonder if it is a bug that **custom field edit** does not work when configured as in my screenshot above.
Answers.UserDisplayName: Aivars
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-07T08:14:37.567Z
Answers.Text: You could alter that ACL to allow this role to edit this specific group. The note, as shown in your screenshot, already hints, that an ACL for custom data fields just allows the role to see those fields, with the same permissions as without this ACL.
Answers.UserDisplayName: Thomas Schüttler
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-07T14:15:20.203Z
Answers.Text: I thought ACL edit group means access to remove or add contacts to the group, not edit contact fields. This helps a lot, as long as there is no option to fine tune **edit of specific custom fields**.
Answers.UserDisplayName: Aivars
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-03-06T09:04:25.917Z
Answers.LastActivityDate: 2017-03-06T09:04:25.917Z
Answers.UserDisplayName: Thomas Schüttler
Answers.Body: <p>I was keen to find out whether i can specify a user, given a WP role, can be limited to just a group of users and also just specific custom field groups for this group of users.  On my system (CIVICRM 5.21.2/WP 5.4.2) i can do this by not allowing access to all records and to all custom data at the WordPress Permission for this WP role.  Then i separately added an ACL to allow the Role to just access the specific Group, and added another ACL to allow the same Role to just access the specific Custom Field Group. This worked out for me.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-01-02T15:06:19.627Z
Answers.LastActivityDate: 2021-01-02T15:06:19.627Z
Answers.UserDisplayName: Clement Leong
Body: <p>I would like to limit access of some CiviCRM users, so they can only <strong>access contacts in certain smart groups</strong>. Meanwhile, I would like them to be able to <strong>edit Custom Fields</strong>.</p>
  
  <p>I created a separate drupal role for these users.</p>
  
  <p>Now, if I keep the Permission <strong>CiviCRM: edit all contacts</strong>, the user can access all contacts and edit all fields.</p>
  
  <p>If I remove Permission: <strong>CiviCRM: edit all contacts</strong> and allow access to specific groups in ACL, the user can access contacts in these groups, but can't edit any fields including custom fields. (It is not possible to edit any fields even if I enable ACL for all, authenticated or specific role users to be able to edit custom groups.)</p>
  
  <p><a href="https://i.sstatic.net/CSxC4.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/CSxC4.png" alt="enter image description here"></a></p>
  
  <p>CiviCRM 4.7.14 on Drupal.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-06T13:45:35.450Z
Comments.Text: As Thomas has answered 'probably not possible', there may be a way you could work around by creating a profile in civiCRM or a webform in Drupal that just exposes the custom fields you want these users to have access to, as a way to further narrow the 'edit' permission.
Comments.UserDisplayName: Eli Lisseck
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-06T17:51:30.777Z
Comments.Text: Will the profile help, if I need the users to work inside the CiviCRM (e.g. create Actions for contacts - possible, edit Custom fields - impossible = **bug of ACL?**).
Comments.UserDisplayName: Aivars
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-03-06T19:40:50.690Z
Comments.Text: I see what you're saying now. I believe you're right, if users are already granted access to edit contacts in civiCRM, I don't believe that granularity of permissions exists right now. Someone else can feel free to correct me of course.
Comments.UserDisplayName: Eli Lisseck
Tags: <permissions><acl>
Title: How can I setup ACL for user to modify only custom fields?
ThreadText: # How can I setup ACL for user to modify only custom fields?
  
  (Asked by: username_0 on 2017-03-05)
  
  I would like to limit access of some CiviCRM users, so they can only **access contacts in certain smart groups**. Meanwhile, I would like them to be able to **edit Custom Fields**.
  
  I created a separate drupal role for these users.
  
  Now, if I keep the Permission **CiviCRM: edit all contacts**, the user can access all contacts and edit all fields.
  
  If I remove Permission: **CiviCRM: edit all contacts** and allow access to specific groups in ACL, the user can access contacts in these groups, but can't edit any fields including custom fields. (It is not possible to edit any fields even if I enable ACL for all, authenticated or specific role users to be able to edit custom groups.)
  
  [![enter image description here](https://i.sstatic.net/CSxC4.png)](https://i.sstatic.net/CSxC4.png)
  
  CiviCRM 4.7.14 on Drupal.
  
  **Tags:** permissions, acl
  
  > **Comments:**
  > **username_1**: As Thomas has answered 'probably not possible', there may be a way you could work around by creating a profile in civiCRM or a webform in Drupal that just exposes the custom fields you want these users to have access to, as a way to further narrow the 'edit' permission.  
  > **username_0**: Will the profile help, if I need the users to work inside the CiviCRM (e.g. create Actions for contacts - possible, edit Custom fields - impossible = **bug of ACL?**).  
  > **username_1**: I see what you're saying now. I believe you're right, if users are already granted access to edit contacts in civiCRM, I don't believe that granularity of permissions exists right now. Someone else can feel free to correct me of course.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-03-06. Score: 1
  
  Your ACL allows to view and edit all custom fields sets. I guess you previously had **CiviCRM: view all contacts** to be able to see the contacts at all.
  
  You still need to grant a view permission to access the contact or an edit permission to allow any modification to your desired set of contacts: [![ACL Edit Group Permission](https://i.sstatic.net/OF0WQ.png)](https://i.sstatic.net/OF0WQ.png)
  
  I'm not aware that you can grant permission to edit custom fields without permission to edit the contact while using the UI.
  
  > **Comments:**
  > **username_0**: In fact I was not using drupal permission **CiviCRM: view all contacts**. Instead, I was using ACL which enabled specific **role** to **view** specific **group**. In this way the user could access the list of contacts (via direct link to smart group), but could not see contacts outside that list. The only problem is with giving the edit access to custom fields (or any fields) of only these contacts.  Then I wonder if it is a bug that **custom field edit** does not work when configured as in my screenshot above.  
  > **username_2**: You could alter that ACL to allow this role to edit this specific group. The note, as shown in your screenshot, already hints, that an ACL for custom data fields just allows the role to see those fields, with the same permissions as without this ACL.  
  > **username_0**: I thought ACL edit group means access to remove or add contacts to the group, not edit contact fields. This helps a lot, as long as there is no option to fine tune **edit of specific custom fields**.  
  
  ---
  
  ### Answer by username_3 on 2021-01-02. Score: 1
  
  I was keen to find out whether i can specify a user, given a WP role, can be limited to just a group of users and also just specific custom field groups for this group of users. On my system (CIVICRM 5.21.2/WP 5.4.2) i can do this by not allowing access to all records and to all custom data at the WordPress Permission for this WP role. Then i separately added an ACL to allow the Role to just access the specific Group, and added another ACL to allow the same Role to just access the specific Custom Field Group. This worked out for me.
  
  
  ---
  
  