Commit | Line | Data |
---|---|---|
6a488035 TO |
1 | <?php |
2 | /* | |
3 | +--------------------------------------------------------------------+ | |
4 | | CiviCRM version 4.3 | | |
5 | +--------------------------------------------------------------------+ | |
6 | | Copyright CiviCRM LLC (c) 2004-2013 | | |
7 | +--------------------------------------------------------------------+ | |
8 | | This file is a part of CiviCRM. | | |
9 | | | | |
10 | | CiviCRM is free software; you can copy, modify, and distribute it | | |
11 | | under the terms of the GNU Affero General Public License | | |
12 | | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. | | |
13 | | | | |
14 | | CiviCRM is distributed in the hope that it will be useful, but | | |
15 | | WITHOUT ANY WARRANTY; without even the implied warranty of | | |
16 | | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. | | |
17 | | See the GNU Affero General Public License for more details. | | |
18 | | | | |
19 | | You should have received a copy of the GNU Affero General Public | | |
20 | | License and the CiviCRM Licensing Exception along | | |
21 | | with this program; if not, contact CiviCRM LLC | | |
22 | | at info[AT]civicrm[DOT]org. If you have questions about the | | |
23 | | GNU Affero General Public License or the licensing of CiviCRM, | | |
24 | | see the CiviCRM license FAQ at http://civicrm.org/licensing | | |
25 | +--------------------------------------------------------------------+ | |
26 | */ | |
27 | ||
28 | /** | |
29 | * | |
30 | * @package CRM | |
31 | * @copyright CiviCRM LLC (c) 2004-2013 | |
32 | * $Id$ | |
33 | * | |
34 | */ | |
35 | ||
36 | /** | |
37 | * This is the basic permission class wrapper | |
38 | */ | |
39 | class CRM_Core_Permission { | |
40 | ||
41 | /** | |
42 | * Static strings used to compose permissions | |
43 | * | |
44 | * @const | |
45 | * @var string | |
46 | */ | |
47 | CONST EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in '; | |
48 | ||
49 | /** | |
50 | * The various type of permissions | |
51 | * | |
52 | * @var int | |
53 | */ | |
54 | CONST EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7; | |
55 | ||
56 | /** | |
57 | * get the current permission of this user | |
58 | * | |
59 | * @return string the permission of the user (edit or view or null) | |
60 | */ | |
61 | public static function getPermission() { | |
62 | $config = CRM_Core_Config::singleton(); | |
63 | return $config->userPermissionClass->getPermission( ); | |
64 | } | |
65 | ||
66 | /** | |
67 | * given a permission string, check for access requirements | |
68 | * | |
69 | * @param string $str the permission to check | |
70 | * | |
71 | * @return boolean true if yes, else false | |
72 | * @static | |
73 | * @access public | |
74 | */ | |
75 | static function check($str) { | |
76 | $config = CRM_Core_Config::singleton(); | |
77 | return $config->userPermissionClass->check( $str ); | |
78 | } | |
79 | ||
dc92f2f8 TO |
80 | /** |
81 | * Determine if any one of the permissions strings applies to current user | |
82 | * | |
83 | * @param array $perms | |
84 | * @return bool | |
85 | */ | |
86 | public static function checkAnyPerm($perms) { | |
87 | foreach ($perms as $perm) { | |
88 | if (CRM_Core_Permission::check($perm)) { | |
89 | return TRUE; | |
90 | } | |
91 | } | |
92 | return FALSE; | |
93 | } | |
94 | ||
6a488035 TO |
95 | /** |
96 | * Given a group/role array, check for access requirements | |
97 | * | |
98 | * @param array $array the group/role to check | |
99 | * | |
100 | * @return boolean true if yes, else false | |
101 | * @static | |
102 | * @access public | |
103 | */ | |
104 | static function checkGroupRole($array) { | |
105 | $config = CRM_Core_Config::singleton(); | |
106 | return $config->userPermissionClass->checkGroupRole( $array ); | |
107 | } | |
108 | ||
109 | /** | |
110 | * Get the permissioned where clause for the user | |
111 | * | |
112 | * @param int $type the type of permission needed | |
113 | * @param array $tables (reference ) add the tables that are needed for the select clause | |
114 | * @param array $whereTables (reference ) add the tables that are needed for the where clause | |
115 | * | |
116 | * @return string the group where clause for this user | |
117 | * @access public | |
118 | */ | |
119 | public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) { | |
120 | $config = CRM_Core_Config::singleton(); | |
121 | return $config->userPermissionClass->getPermissionedStaticGroupClause( $type, $tables, $whereTables ); | |
122 | } | |
123 | ||
124 | /** | |
125 | * Get all groups from database, filtered by permissions | |
126 | * for this user | |
127 | * | |
128 | * @param string $groupType type of group(Access/Mailing) | |
129 | * @param boolen $excludeHidden exclude hidden groups. | |
130 | * | |
131 | * @access public | |
132 | * @static | |
133 | * | |
134 | * @return array - array reference of all groups. | |
135 | * | |
136 | */ | |
137 | public static function group($groupType, $excludeHidden = TRUE) { | |
138 | $config = CRM_Core_Config::singleton(); | |
139 | return $config->userPermissionClass->group( $groupType, $excludeHidden ); | |
140 | } | |
141 | ||
142 | public static function customGroupAdmin() { | |
143 | $admin = FALSE; | |
144 | ||
145 | // check if user has all powerful permission | |
146 | // or administer civicrm permission (CRM-1905) | |
147 | if (self::check('access all custom data')) { | |
148 | return TRUE; | |
149 | } | |
150 | ||
151 | if (self::check('administer Multiple Organizations') && | |
152 | self::isMultisiteEnabled() | |
153 | ) { | |
154 | return TRUE; | |
155 | } | |
156 | ||
157 | if (self::check('administer CiviCRM')) { | |
158 | return TRUE; | |
159 | } | |
160 | ||
161 | return FALSE; | |
162 | } | |
163 | ||
164 | public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) { | |
165 | $customGroups = CRM_Core_PseudoConstant::customGroup($reset); | |
166 | $defaultGroups = array(); | |
167 | ||
168 | // check if user has all powerful permission | |
169 | // or administer civicrm permission (CRM-1905) | |
170 | if (self::customGroupAdmin()) { | |
171 | $defaultGroups = array_keys($customGroups); | |
172 | } | |
173 | ||
174 | return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups); | |
175 | } | |
176 | ||
177 | static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) { | |
178 | if (self::customGroupAdmin()) { | |
179 | return ' ( 1 ) '; | |
180 | } | |
181 | ||
182 | $groups = self::customGroup($type, $reset); | |
183 | if (empty($groups)) { | |
184 | return ' ( 0 ) '; | |
185 | } | |
186 | else { | |
187 | return "{$prefix}id IN ( " . implode(',', $groups) . ' ) '; | |
188 | } | |
189 | } | |
190 | ||
191 | public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) { | |
192 | if (empty($gid)) { | |
193 | return TRUE; | |
194 | } | |
195 | ||
196 | $groups = self::ufGroup($type); | |
197 | return in_array($gid, $groups) ? TRUE : FALSE; | |
198 | } | |
199 | ||
200 | public static function ufGroup($type = CRM_Core_Permission::VIEW) { | |
201 | $ufGroups = CRM_Core_PseudoConstant::ufGroup(); | |
202 | ||
203 | $allGroups = array_keys($ufGroups); | |
204 | ||
205 | // check if user has all powerful permission | |
206 | if (self::check('profile listings and forms')) { | |
207 | return $allGroups; | |
208 | } | |
209 | ||
210 | switch ($type) { | |
211 | case CRM_Core_Permission::VIEW: | |
212 | if (self::check('profile view')) { | |
213 | return $allGroups; | |
214 | } | |
215 | break; | |
216 | ||
217 | case CRM_Core_Permission::CREATE: | |
218 | if (self::check('profile create')) { | |
219 | return $allGroups; | |
220 | } | |
221 | break; | |
222 | ||
223 | case CRM_Core_Permission::EDIT: | |
224 | if (self::check('profile edit')) { | |
225 | return $allGroups; | |
226 | } | |
227 | break; | |
228 | ||
229 | case CRM_Core_Permission::SEARCH: | |
230 | if (self::check('profile listings')) { | |
231 | return $allGroups; | |
232 | } | |
233 | break; | |
234 | } | |
235 | ||
236 | return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups); | |
237 | } | |
238 | ||
239 | static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) { | |
240 | $groups = self::ufGroup($type); | |
241 | if ($returnUFGroupIds) { | |
242 | return $groups; | |
243 | } | |
244 | elseif (empty($groups)) { | |
245 | return ' ( 0 ) '; | |
246 | } | |
247 | else { | |
248 | return "{$prefix}id IN ( " . implode(',', $groups) . ' ) '; | |
249 | } | |
250 | } | |
251 | ||
252 | public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL) { | |
253 | $events = CRM_Event_PseudoConstant::event(NULL, TRUE); | |
254 | $includeEvents = array(); | |
255 | ||
256 | // check if user has all powerful permission | |
257 | if (self::check('register for events')) { | |
258 | $includeEvents = array_keys($events); | |
259 | } | |
260 | ||
261 | if ($type == CRM_Core_Permission::VIEW && | |
262 | self::check('view event info') | |
263 | ) { | |
264 | $includeEvents = array_keys($events); | |
265 | } | |
266 | ||
267 | $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents); | |
268 | if (!$eventID) { | |
269 | return $permissionedEvents; | |
270 | } | |
271 | return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID; | |
272 | } | |
273 | ||
274 | static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) { | |
275 | $events = self::event($type); | |
276 | if (empty($events)) { | |
277 | return ' ( 0 ) '; | |
278 | } | |
279 | else { | |
280 | return "{$prefix}id IN ( " . implode(',', $events) . ' ) '; | |
281 | } | |
282 | } | |
283 | ||
284 | static function access($module, $checkPermission = TRUE) { | |
285 | $config = CRM_Core_Config::singleton(); | |
286 | ||
287 | if (!in_array($module, $config->enableComponents)) { | |
288 | return FALSE; | |
289 | } | |
290 | ||
291 | if ($checkPermission) { | |
292 | if ($module == 'CiviCase') { | |
293 | return CRM_Case_BAO_Case::accessCiviCase(); | |
294 | } | |
295 | else { | |
296 | return CRM_Core_Permission::check("access $module"); | |
297 | } | |
298 | } | |
299 | ||
300 | return TRUE; | |
301 | } | |
302 | ||
303 | /** | |
304 | * check permissions for delete and edit actions | |
305 | * | |
306 | * @param string $module component name. | |
307 | * @param $action action to be check across component | |
308 | * | |
309 | **/ | |
310 | static function checkActionPermission($module, $action) { | |
311 | //check delete related permissions. | |
312 | if ($action & CRM_Core_Action::DELETE) { | |
313 | $permissionName = "delete in $module"; | |
314 | } | |
315 | else { | |
316 | $editPermissions = array( | |
317 | 'CiviEvent' => 'edit event participants', | |
318 | 'CiviMember' => 'edit memberships', | |
319 | 'CiviPledge' => 'edit pledges', | |
320 | 'CiviContribute' => 'edit contributions', | |
321 | 'CiviGrant' => 'edit grants', | |
322 | 'CiviMail' => 'access CiviMail', | |
323 | 'CiviAuction' => 'add auction items', | |
324 | ); | |
325 | $permissionName = CRM_Utils_Array::value($module, $editPermissions); | |
326 | } | |
327 | ||
328 | if ($module == 'CiviCase' && !$permissionName) { | |
329 | return CRM_Case_BAO_Case::accessCiviCase(); | |
330 | } | |
331 | else { | |
332 | //check for permission. | |
333 | return CRM_Core_Permission::check($permissionName); | |
334 | } | |
335 | } | |
336 | ||
337 | static function checkMenu(&$args, $op = 'and') { | |
338 | if (!is_array($args)) { | |
339 | return $args; | |
340 | } | |
341 | foreach ($args as $str) { | |
342 | $res = CRM_Core_Permission::check($str); | |
343 | if ($op == 'or' && $res) { | |
344 | return TRUE; | |
345 | } | |
346 | elseif ($op == 'and' && !$res) { | |
347 | return FALSE; | |
348 | } | |
349 | } | |
350 | return ($op == 'or') ? FALSE : TRUE; | |
351 | } | |
352 | ||
353 | static function checkMenuItem(&$item) { | |
354 | if (!array_key_exists('access_callback', $item)) { | |
355 | CRM_Core_Error::backtrace(); | |
356 | CRM_Core_Error::fatal(); | |
357 | } | |
358 | ||
359 | // if component_id is present, ensure it is enabled | |
360 | if (isset($item['component_id']) && | |
361 | $item['component_id'] | |
362 | ) { | |
363 | $config = CRM_Core_Config::singleton(); | |
364 | if (is_array($config->enableComponentIDs) && | |
365 | in_array($item['component_id'], $config->enableComponentIDs) | |
366 | ) { | |
367 | // continue with process | |
368 | } | |
369 | else { | |
370 | return FALSE; | |
371 | } | |
372 | } | |
373 | ||
374 | // the following is imitating drupal 6 code in includes/menu.inc | |
375 | if (empty($item['access_callback']) || | |
376 | is_numeric($item['access_callback']) | |
377 | ) { | |
378 | return (boolean ) $item['access_callback']; | |
379 | } | |
380 | ||
381 | // check whether the following Ajax requests submitted the right key | |
382 | // FIXME: this should be integrated into ACLs proper | |
383 | if (CRM_Utils_Array::value('page_type', $item) == 3) { | |
384 | if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) { | |
385 | return FALSE; | |
386 | } | |
387 | } | |
388 | ||
389 | // check if callback is for checkMenu, if so optimize it | |
390 | if (is_array($item['access_callback']) && | |
391 | $item['access_callback'][0] == 'CRM_Core_Permission' && | |
392 | $item['access_callback'][1] == 'checkMenu' | |
393 | ) { | |
394 | $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and'); | |
395 | return self::checkMenu($item['access_arguments'][0], $op); | |
396 | } | |
397 | else { | |
398 | return call_user_func_array($item['access_callback'], $item['access_arguments']); | |
399 | } | |
400 | } | |
401 | ||
402 | static function &basicPermissions($all = FALSE) { | |
403 | static $permissions = NULL; | |
404 | ||
405 | if (!$permissions) { | |
406 | $prefix = ts('CiviCRM') . ': '; | |
407 | $permissions = self::getCorePermissions(); | |
408 | ||
409 | if (self::isMultisiteEnabled()) { | |
410 | $permissions['administer Multiple Organizations'] = $prefix . ts('administer Multiple Organizations'); | |
411 | } | |
412 | ||
413 | $config = CRM_Core_Config::singleton(); | |
414 | ||
415 | if (!$all) { | |
416 | $components = CRM_Core_Component::getEnabledComponents(); | |
417 | } | |
418 | else { | |
419 | $components = CRM_Core_Component::getComponents(); | |
420 | } | |
421 | ||
422 | foreach ($components as $comp) { | |
423 | $perm = $comp->getPermissions(); | |
424 | if ($perm) { | |
425 | $info = $comp->getInfo(); | |
426 | foreach ($perm as $p) { | |
427 | $permissions[$p] = $info['translatedName'] . ': ' . $p; | |
428 | } | |
429 | } | |
430 | } | |
431 | ||
432 | // Add any permissions defined in hook_civicrm_permission implementations. | |
433 | $config = CRM_Core_Config::singleton(); | |
434 | $module_permissions = $config->userPermissionClass->getAllModulePermissions(); | |
435 | $permissions = array_merge($permissions, $module_permissions); | |
436 | } | |
437 | ||
438 | return $permissions; | |
439 | } | |
440 | ||
441 | static function getCorePermissions() { | |
442 | $prefix = ts('CiviCRM') . ': '; | |
443 | $permissions = array( | |
444 | 'add contacts' => $prefix . ts('add contacts'), | |
445 | 'view all contacts' => $prefix . ts('view all contacts'), | |
446 | 'edit all contacts' => $prefix . ts('edit all contacts'), | |
447 | 'delete contacts' => $prefix . ts('delete contacts'), | |
448 | 'access deleted contacts' => $prefix . ts('access deleted contacts'), | |
449 | 'import contacts' => $prefix . ts('import contacts'), | |
450 | 'edit groups' => $prefix . ts('edit groups'), | |
451 | 'administer CiviCRM' => $prefix . ts('administer CiviCRM'), | |
452 | 'access uploaded files' => $prefix . ts('access uploaded files'), | |
453 | 'profile listings and forms' => $prefix . ts('profile listings and forms'), | |
454 | 'profile listings' => $prefix . ts('profile listings'), | |
455 | 'profile create' => $prefix . ts('profile create'), | |
456 | 'profile edit' => $prefix . ts('profile edit'), | |
457 | 'profile view' => $prefix . ts('profile view'), | |
458 | 'access all custom data' => $prefix . ts('access all custom data'), | |
459 | 'view all activities' => $prefix . ts('view all activities'), | |
460 | 'delete activities' => $prefix . ts('delete activities'), | |
461 | 'access CiviCRM' => $prefix . ts('access CiviCRM'), | |
462 | 'access Contact Dashboard' => $prefix . ts('access Contact Dashboard'), | |
463 | 'translate CiviCRM' => $prefix . ts('translate CiviCRM'), | |
464 | 'administer reserved groups' => $prefix . ts('administer reserved groups'), | |
465 | 'administer Tagsets' => $prefix . ts('administer Tagsets'), | |
466 | 'administer reserved tags' => $prefix . ts('administer reserved tags'), | |
467 | 'administer dedupe rules' => $prefix . ts('administer dedupe rules'), | |
468 | 'merge duplicate contacts' => $prefix . ts('merge duplicate contacts'), | |
469 | 'view debug output' => $prefix . ts('view debug output'), | |
470 | 'view all notes' => $prefix . ts('view all notes'), | |
471 | 'access AJAX API' => $prefix . ts('access AJAX API'), | |
472 | 'access contact reference fields' => $prefix . ts('access contact reference fields'), | |
473 | 'create manual batch' => $prefix . ts('create manual batch'), | |
474 | 'edit own manual batches' => $prefix . ts('edit own manual batches'), | |
475 | 'edit all manual batches' => $prefix . ts('edit all manual batches'), | |
476 | 'view own manual batches' => $prefix . ts('view own manual batches'), | |
477 | 'view all manual batches' => $prefix . ts('view all manual batches'), | |
478 | 'delete own manual batches' => $prefix . ts('delete own manual batches'), | |
479 | 'delete all manual batches' => $prefix . ts('delete all manual batches'), | |
480 | 'export own manual batches' => $prefix . ts('export own manual batches'), | |
481 | 'export all manual batches' => $prefix . ts('export all manual batches'), | |
482 | ); | |
483 | ||
484 | return $permissions; | |
485 | } | |
486 | ||
487 | /** | |
488 | * Validate user permission across | |
489 | * edit or view or with supportable acls. | |
490 | * | |
491 | * return boolean true/false. | |
492 | **/ | |
493 | static function giveMeAllACLs() { | |
494 | if (CRM_Core_Permission::check('view all contacts') || | |
495 | CRM_Core_Permission::check('edit all contacts') | |
496 | ) { | |
497 | return TRUE; | |
498 | } | |
499 | ||
500 | $session = CRM_Core_Session::singleton(); | |
501 | $contactID = $session->get('userID'); | |
502 | ||
6a488035 TO |
503 | //check for acl. |
504 | $aclPermission = self::getPermission(); | |
505 | if (in_array($aclPermission, array( | |
506 | CRM_Core_Permission::EDIT, | |
507 | CRM_Core_Permission::VIEW, | |
508 | ))) { | |
509 | return TRUE; | |
510 | } | |
511 | ||
512 | // run acl where hook and see if the user is supplying an ACL clause | |
513 | // that is not false | |
514 | $tables = $whereTables = array(); | |
515 | $where = NULL; | |
516 | ||
517 | CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW, | |
518 | $tables, $whereTables, | |
519 | $contactID, $where | |
520 | ); | |
521 | return empty($whereTables) ? FALSE : TRUE; | |
522 | } | |
523 | ||
524 | /** | |
525 | * Function to get component name from given permission. | |
526 | * | |
527 | * @param string $permission | |
528 | * | |
529 | * return string $componentName the name of component. | |
530 | * @static | |
531 | */ | |
532 | static function getComponentName($permission) { | |
533 | $componentName = NULL; | |
534 | $permission = trim($permission); | |
535 | if (empty($permission)) { | |
536 | return $componentName; | |
537 | } | |
538 | ||
539 | static $allCompPermissions = array(); | |
540 | if (empty($allCompPermissions)) { | |
541 | $components = CRM_Core_Component::getComponents(); | |
542 | foreach ($components as $name => $comp) { | |
33777e4a PJ |
543 | //get all permissions of each components unconditionally |
544 | $allCompPermissions[$name] = $comp->getPermissions(TRUE); | |
6a488035 TO |
545 | } |
546 | } | |
547 | ||
548 | if (is_array($allCompPermissions)) { | |
549 | foreach ($allCompPermissions as $name => $permissions) { | |
550 | if (in_array($permission, $permissions)) { | |
551 | $componentName = $name; | |
552 | break; | |
553 | } | |
554 | } | |
555 | } | |
556 | ||
557 | return $componentName; | |
558 | } | |
559 | ||
560 | /** | |
561 | * Get all the contact emails for users that have a specific permission | |
562 | * | |
563 | * @param string $permissionName name of the permission we are interested in | |
564 | * | |
565 | * @return string a comma separated list of email addresses | |
566 | */ | |
567 | public static function permissionEmails($permissionName) { | |
568 | $config = CRM_Core_Config::singleton(); | |
569 | return $config->userPermissionClass->permissionEmails( $permissionName ); | |
570 | } | |
571 | ||
572 | /** | |
573 | * Get all the contact emails for users that have a specific role | |
574 | * | |
575 | * @param string $roleName name of the role we are interested in | |
576 | * | |
577 | * @return string a comma separated list of email addresses | |
578 | */ | |
579 | public static function roleEmails($roleName) { | |
580 | $config = CRM_Core_Config::singleton(); | |
581 | return $config->userRoleClass->roleEmails( $roleName ); | |
582 | } | |
583 | ||
584 | static function isMultisiteEnabled() { | |
585 | return CRM_Core_BAO_Setting::getItem(CRM_Core_BAO_Setting::MULTISITE_PREFERENCES_NAME, | |
586 | 'is_enabled' | |
587 | ) ? TRUE : FALSE; | |
588 | } | |
589 | } | |
590 |