Commit | Line | Data |
---|---|---|
6a488035 TO |
1 | <?php |
2 | /* | |
3 | +--------------------------------------------------------------------+ | |
bc77d7c0 | 4 | | Copyright CiviCRM LLC. All rights reserved. | |
6a488035 | 5 | | | |
bc77d7c0 TO |
6 | | This work is published under the GNU AGPLv3 license with some | |
7 | | permitted exceptions and without any warranty. For full license | | |
8 | | and copyright information, see https://civicrm.org/licensing | | |
6a488035 | 9 | +--------------------------------------------------------------------+ |
d25dd0ee | 10 | */ |
6a488035 TO |
11 | |
12 | /** | |
13 | * | |
14 | * @package CRM | |
ca5cec67 | 15 | * @copyright CiviCRM LLC https://civicrm.org/licensing |
6a488035 TO |
16 | */ |
17 | ||
18 | /** | |
19 | * This is the basic permission class wrapper | |
20 | */ | |
21 | class CRM_Core_Permission { | |
22 | ||
23 | /** | |
d09edf64 | 24 | * Static strings used to compose permissions. |
6a488035 TO |
25 | * |
26 | * @const | |
27 | * @var string | |
28 | */ | |
7da04cde | 29 | const EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in '; |
6a488035 TO |
30 | |
31 | /** | |
d09edf64 | 32 | * The various type of permissions. |
6a488035 TO |
33 | * |
34 | * @var int | |
35 | */ | |
7da04cde | 36 | const EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7; |
6a488035 | 37 | |
085823c1 | 38 | /** |
d09edf64 | 39 | * A placeholder permission which always fails. |
085823c1 TO |
40 | */ |
41 | const ALWAYS_DENY_PERMISSION = "*always deny*"; | |
42 | ||
43 | /** | |
d09edf64 | 44 | * A placeholder permission which always fails. |
085823c1 TO |
45 | */ |
46 | const ALWAYS_ALLOW_PERMISSION = "*always allow*"; | |
47 | ||
6dd18b98 | 48 | /** |
d09edf64 | 49 | * Various authentication sources. |
6dd18b98 DS |
50 | * |
51 | * @var int | |
52 | */ | |
7da04cde | 53 | const AUTH_SRC_UNKNOWN = 0, AUTH_SRC_CHECKSUM = 1, AUTH_SRC_SITEKEY = 2, AUTH_SRC_LOGIN = 4; |
6dd18b98 | 54 | |
6a488035 | 55 | /** |
d09edf64 | 56 | * Get the current permission of this user. |
6a488035 | 57 | * |
a6c01b45 CW |
58 | * @return string |
59 | * the permission of the user (edit or view or null) | |
6a488035 TO |
60 | */ |
61 | public static function getPermission() { | |
62 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 63 | return $config->userPermissionClass->getPermission(); |
6a488035 TO |
64 | } |
65 | ||
66 | /** | |
100fef9d | 67 | * Given a permission string or array, check for access requirements |
6a488035 | 68 | * |
9b61e85d CW |
69 | * Ex 1: Must have 'access CiviCRM' |
70 | * (string) 'access CiviCRM' | |
60ec9f43 | 71 | * |
b6e769ac JM |
72 | * Ex 2: Must have 'access CiviCRM' and 'access AJAX API' |
73 | * ['access CiviCRM', 'access AJAX API'] | |
60ec9f43 | 74 | * |
b6e769ac | 75 | * Ex 3: Must have 'access CiviCRM' or 'access AJAX API' |
9b61e85d | 76 | * [ |
b6e769ac | 77 | * ['access CiviCRM', 'access AJAX API'], |
9b61e85d | 78 | * ], |
60ec9f43 | 79 | * |
b6e769ac | 80 | * Ex 4: Must have 'access CiviCRM' or 'access AJAX API' AND 'access CiviEvent' |
9b61e85d | 81 | * [ |
b6e769ac | 82 | * ['access CiviCRM', 'access AJAX API'], |
9b61e85d CW |
83 | * 'access CiviEvent', |
84 | * ], | |
60ec9f43 | 85 | * |
9b61e85d CW |
86 | * Note that in permissions.php this is keyed by the action eg. |
87 | * (access Civi || access AJAX) && (access CiviEvent || access CiviContribute) | |
88 | * 'myaction' => [ | |
b6e769ac | 89 | * ['access CiviCRM', 'access AJAX API'], |
9b61e85d CW |
90 | * ['access CiviEvent', 'access CiviContribute'] |
91 | * ], | |
60ec9f43 | 92 | * |
9b61e85d CW |
93 | * @param string|array $permissions |
94 | * The permission to check as an array or string -see examples. | |
60ec9f43 | 95 | * |
9b61e85d CW |
96 | * @param int $contactId |
97 | * Contact id to check permissions for. Defaults to current logged-in user. | |
6a488035 | 98 | * |
acb1052e | 99 | * @return bool |
9b61e85d | 100 | * true if contact has permission(s), else false |
6a488035 | 101 | */ |
18be3201 | 102 | public static function check($permissions, $contactId = NULL) { |
60ec9f43 | 103 | $permissions = (array) $permissions; |
9b61e85d | 104 | $userId = CRM_Core_BAO_UFMatch::getUFId($contactId); |
60ec9f43 | 105 | |
18be3201 | 106 | /** @var CRM_Core_Permission_Temp $tempPerm */ |
59735506 TO |
107 | $tempPerm = CRM_Core_Config::singleton()->userPermissionTemp; |
108 | ||
60ec9f43 | 109 | foreach ($permissions as $permission) { |
22e263ad | 110 | if (is_array($permission)) { |
60ec9f43 | 111 | foreach ($permission as $orPerm) { |
18be3201 | 112 | if (self::check($orPerm, $contactId)) { |
60ec9f43 | 113 | //one of our 'or' permissions has succeeded - stop checking this permission |
b8a19656 | 114 | return TRUE; |
60ec9f43 E |
115 | } |
116 | } | |
117 | //none of our our conditions was met | |
118 | return FALSE; | |
119 | } | |
120 | else { | |
3ae62cab | 121 | // This is an individual permission |
755a1835 | 122 | $impliedPermissions = self::getImpliedPermissionsFor($permission); |
123 | $impliedPermissions[] = $permission; | |
124 | foreach ($impliedPermissions as $permissionOption) { | |
125 | $granted = CRM_Core_Config::singleton()->userPermissionClass->check($permissionOption, $userId); | |
126 | // Call the permission_check hook to permit dynamic escalation (CRM-19256) | |
127 | CRM_Utils_Hook::permission_check($permissionOption, $granted, $contactId); | |
128 | if ($granted) { | |
129 | break; | |
130 | } | |
131 | } | |
132 | ||
59735506 | 133 | if ( |
3ae62cab | 134 | !$granted |
59735506 TO |
135 | && !($tempPerm && $tempPerm->check($permission)) |
136 | ) { | |
60ec9f43 E |
137 | //one of our 'and' conditions has not been met |
138 | return FALSE; | |
139 | } | |
140 | } | |
141 | } | |
142 | return TRUE; | |
6a488035 TO |
143 | } |
144 | ||
dc92f2f8 | 145 | /** |
d09edf64 | 146 | * Determine if any one of the permissions strings applies to current user. |
dc92f2f8 TO |
147 | * |
148 | * @param array $perms | |
149 | * @return bool | |
150 | */ | |
151 | public static function checkAnyPerm($perms) { | |
152 | foreach ($perms as $perm) { | |
153 | if (CRM_Core_Permission::check($perm)) { | |
154 | return TRUE; | |
155 | } | |
156 | } | |
157 | return FALSE; | |
158 | } | |
159 | ||
6a488035 TO |
160 | /** |
161 | * Given a group/role array, check for access requirements | |
162 | * | |
6a0b768e TO |
163 | * @param array $array |
164 | * The group/role to check. | |
6a488035 | 165 | * |
acb1052e | 166 | * @return bool |
a6c01b45 | 167 | * true if yes, else false |
6a488035 | 168 | */ |
00be9182 | 169 | public static function checkGroupRole($array) { |
6a488035 | 170 | $config = CRM_Core_Config::singleton(); |
41f314b6 | 171 | return $config->userPermissionClass->checkGroupRole($array); |
6a488035 TO |
172 | } |
173 | ||
174 | /** | |
d09edf64 | 175 | * Get the permissioned where clause for the user. |
6a488035 | 176 | * |
6a0b768e TO |
177 | * @param int $type |
178 | * The type of permission needed. | |
179 | * @param array $tables | |
180 | * (reference ) add the tables that are needed for the select clause. | |
181 | * @param array $whereTables | |
182 | * (reference ) add the tables that are needed for the where clause. | |
6a488035 | 183 | * |
a6c01b45 CW |
184 | * @return string |
185 | * the group where clause for this user | |
6a488035 TO |
186 | */ |
187 | public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) { | |
188 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 189 | return $config->userPermissionClass->getPermissionedStaticGroupClause($type, $tables, $whereTables); |
6a488035 TO |
190 | } |
191 | ||
192 | /** | |
193 | * Get all groups from database, filtered by permissions | |
194 | * for this user | |
195 | * | |
6a0b768e TO |
196 | * @param string $groupType |
197 | * Type of group(Access/Mailing). | |
3f8d2862 CW |
198 | * @param bool $excludeHidden |
199 | * exclude hidden groups. | |
6a488035 | 200 | * |
6a488035 | 201 | * |
a6c01b45 CW |
202 | * @return array |
203 | * array reference of all groups. | |
6a488035 TO |
204 | */ |
205 | public static function group($groupType, $excludeHidden = TRUE) { | |
206 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 207 | return $config->userPermissionClass->group($groupType, $excludeHidden); |
6a488035 TO |
208 | } |
209 | ||
a0ee3941 EM |
210 | /** |
211 | * @return bool | |
212 | */ | |
6a488035 TO |
213 | public static function customGroupAdmin() { |
214 | $admin = FALSE; | |
215 | ||
216 | // check if user has all powerful permission | |
217 | // or administer civicrm permission (CRM-1905) | |
218 | if (self::check('access all custom data')) { | |
219 | return TRUE; | |
220 | } | |
221 | ||
634e1a1a DL |
222 | if ( |
223 | self::check('administer Multiple Organizations') && | |
6a488035 TO |
224 | self::isMultisiteEnabled() |
225 | ) { | |
226 | return TRUE; | |
227 | } | |
228 | ||
229 | if (self::check('administer CiviCRM')) { | |
230 | return TRUE; | |
231 | } | |
232 | ||
233 | return FALSE; | |
234 | } | |
235 | ||
a0ee3941 EM |
236 | /** |
237 | * @param int $type | |
238 | * @param bool $reset | |
239 | * | |
240 | * @return array | |
241 | */ | |
6a488035 | 242 | public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) { |
41f314b6 | 243 | $customGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_CustomField', 'custom_group_id', |
be2fb01f CW |
244 | ['fresh' => $reset]); |
245 | $defaultGroups = []; | |
6a488035 TO |
246 | |
247 | // check if user has all powerful permission | |
248 | // or administer civicrm permission (CRM-1905) | |
249 | if (self::customGroupAdmin()) { | |
250 | $defaultGroups = array_keys($customGroups); | |
251 | } | |
252 | ||
253 | return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups); | |
254 | } | |
255 | ||
a0ee3941 EM |
256 | /** |
257 | * @param int $type | |
258 | * @param null $prefix | |
259 | * @param bool $reset | |
260 | * | |
261 | * @return string | |
262 | */ | |
00be9182 | 263 | public static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) { |
6a488035 TO |
264 | if (self::customGroupAdmin()) { |
265 | return ' ( 1 ) '; | |
266 | } | |
267 | ||
268 | $groups = self::customGroup($type, $reset); | |
269 | if (empty($groups)) { | |
270 | return ' ( 0 ) '; | |
271 | } | |
272 | else { | |
273 | return "{$prefix}id IN ( " . implode(',', $groups) . ' ) '; | |
274 | } | |
275 | } | |
276 | ||
a0ee3941 | 277 | /** |
100fef9d | 278 | * @param int $gid |
a0ee3941 EM |
279 | * @param int $type |
280 | * | |
281 | * @return bool | |
282 | */ | |
6a488035 TO |
283 | public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) { |
284 | if (empty($gid)) { | |
285 | return TRUE; | |
286 | } | |
287 | ||
288 | $groups = self::ufGroup($type); | |
63d76404 | 289 | return !empty($groups) && in_array($gid, $groups); |
6a488035 TO |
290 | } |
291 | ||
a0ee3941 EM |
292 | /** |
293 | * @param int $type | |
294 | * | |
295 | * @return array | |
296 | */ | |
6a488035 | 297 | public static function ufGroup($type = CRM_Core_Permission::VIEW) { |
ff4f7744 | 298 | $ufGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_UFField', 'uf_group_id'); |
6a488035 TO |
299 | |
300 | $allGroups = array_keys($ufGroups); | |
301 | ||
302 | // check if user has all powerful permission | |
303 | if (self::check('profile listings and forms')) { | |
304 | return $allGroups; | |
305 | } | |
306 | ||
307 | switch ($type) { | |
308 | case CRM_Core_Permission::VIEW: | |
309 | if (self::check('profile view')) { | |
310 | return $allGroups; | |
311 | } | |
312 | break; | |
313 | ||
314 | case CRM_Core_Permission::CREATE: | |
315 | if (self::check('profile create')) { | |
316 | return $allGroups; | |
317 | } | |
318 | break; | |
319 | ||
320 | case CRM_Core_Permission::EDIT: | |
321 | if (self::check('profile edit')) { | |
322 | return $allGroups; | |
323 | } | |
324 | break; | |
325 | ||
326 | case CRM_Core_Permission::SEARCH: | |
327 | if (self::check('profile listings')) { | |
328 | return $allGroups; | |
329 | } | |
330 | break; | |
331 | } | |
332 | ||
333 | return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups); | |
334 | } | |
335 | ||
a0ee3941 EM |
336 | /** |
337 | * @param int $type | |
338 | * @param null $prefix | |
339 | * @param bool $returnUFGroupIds | |
340 | * | |
341 | * @return array|string | |
342 | */ | |
00be9182 | 343 | public static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) { |
6a488035 TO |
344 | $groups = self::ufGroup($type); |
345 | if ($returnUFGroupIds) { | |
346 | return $groups; | |
347 | } | |
348 | elseif (empty($groups)) { | |
349 | return ' ( 0 ) '; | |
350 | } | |
351 | else { | |
352 | return "{$prefix}id IN ( " . implode(',', $groups) . ' ) '; | |
353 | } | |
354 | } | |
355 | ||
a0ee3941 EM |
356 | /** |
357 | * @param int $type | |
100fef9d | 358 | * @param int $eventID |
a0ee3941 EM |
359 | * @param string $context |
360 | * | |
361 | * @return array|null | |
362 | */ | |
e2d09ab4 | 363 | public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL, $context = '') { |
22e263ad TO |
364 | if (!empty($context)) { |
365 | if (CRM_Core_Permission::check($context)) { | |
e2d09ab4 EM |
366 | return TRUE; |
367 | } | |
368 | } | |
6a488035 | 369 | $events = CRM_Event_PseudoConstant::event(NULL, TRUE); |
be2fb01f | 370 | $includeEvents = []; |
6a488035 TO |
371 | |
372 | // check if user has all powerful permission | |
373 | if (self::check('register for events')) { | |
374 | $includeEvents = array_keys($events); | |
375 | } | |
376 | ||
377 | if ($type == CRM_Core_Permission::VIEW && | |
378 | self::check('view event info') | |
379 | ) { | |
380 | $includeEvents = array_keys($events); | |
381 | } | |
382 | ||
383 | $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents); | |
384 | if (!$eventID) { | |
385 | return $permissionedEvents; | |
386 | } | |
41f314b6 | 387 | if (!empty($permissionedEvents)) { |
2efcf0c2 | 388 | return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID; |
41f314b6 | 389 | } |
dfa720e7 | 390 | return NULL; |
6a488035 TO |
391 | } |
392 | ||
a0ee3941 EM |
393 | /** |
394 | * @param int $type | |
395 | * @param null $prefix | |
396 | * | |
397 | * @return string | |
398 | */ | |
00be9182 | 399 | public static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) { |
6a488035 TO |
400 | $events = self::event($type); |
401 | if (empty($events)) { | |
402 | return ' ( 0 ) '; | |
403 | } | |
404 | else { | |
405 | return "{$prefix}id IN ( " . implode(',', $events) . ' ) '; | |
406 | } | |
407 | } | |
408 | ||
a0ee3941 | 409 | /** |
44d17ec8 BS |
410 | * Checks that component is enabled and optionally that user has basic perm. |
411 | * | |
412 | * @param string $module | |
413 | * Specifies the name of the CiviCRM component. | |
a0ee3941 | 414 | * @param bool $checkPermission |
44d17ec8 BS |
415 | * Check not only that module is enabled, but that user has necessary |
416 | * permission. | |
417 | * @param bool $requireAllCasesPermOnCiviCase | |
418 | * Significant only if $module == CiviCase | |
419 | * Require "access all cases and activities", not just | |
420 | * "access my cases and activities". | |
a0ee3941 EM |
421 | * |
422 | * @return bool | |
44d17ec8 | 423 | * Access to specified $module is granted. |
a0ee3941 | 424 | */ |
44d17ec8 | 425 | public static function access($module, $checkPermission = TRUE, $requireAllCasesPermOnCiviCase = FALSE) { |
6a488035 TO |
426 | $config = CRM_Core_Config::singleton(); |
427 | ||
428 | if (!in_array($module, $config->enableComponents)) { | |
429 | return FALSE; | |
430 | } | |
431 | ||
432 | if ($checkPermission) { | |
44d17ec8 BS |
433 | switch ($module) { |
434 | case 'CiviCase': | |
435 | $access_all_cases = CRM_Core_Permission::check("access all cases and activities"); | |
436 | $access_my_cases = CRM_Core_Permission::check("access my cases and activities"); | |
437 | return $access_all_cases || (!$requireAllCasesPermOnCiviCase && $access_my_cases); | |
438 | ||
439 | case 'CiviCampaign': | |
440 | return CRM_Core_Permission::check("administer $module"); | |
441 | ||
442 | default: | |
443 | return CRM_Core_Permission::check("access $module"); | |
6a488035 TO |
444 | } |
445 | } | |
446 | ||
447 | return TRUE; | |
448 | } | |
449 | ||
450 | /** | |
d09edf64 | 451 | * Check permissions for delete and edit actions. |
6a488035 | 452 | * |
6a0b768e TO |
453 | * @param string $module |
454 | * Component name. | |
455 | * @param int $action | |
456 | * Action to be check across component. | |
6a488035 | 457 | * |
77b97be7 EM |
458 | * |
459 | * @return bool | |
460 | */ | |
00be9182 | 461 | public static function checkActionPermission($module, $action) { |
6a488035 TO |
462 | //check delete related permissions. |
463 | if ($action & CRM_Core_Action::DELETE) { | |
464 | $permissionName = "delete in $module"; | |
465 | } | |
466 | else { | |
be2fb01f | 467 | $editPermissions = [ |
6a488035 TO |
468 | 'CiviEvent' => 'edit event participants', |
469 | 'CiviMember' => 'edit memberships', | |
470 | 'CiviPledge' => 'edit pledges', | |
471 | 'CiviContribute' => 'edit contributions', | |
472 | 'CiviGrant' => 'edit grants', | |
473 | 'CiviMail' => 'access CiviMail', | |
474 | 'CiviAuction' => 'add auction items', | |
be2fb01f | 475 | ]; |
9c1bc317 | 476 | $permissionName = $editPermissions[$module] ?? NULL; |
6a488035 TO |
477 | } |
478 | ||
479 | if ($module == 'CiviCase' && !$permissionName) { | |
480 | return CRM_Case_BAO_Case::accessCiviCase(); | |
481 | } | |
482 | else { | |
483 | //check for permission. | |
484 | return CRM_Core_Permission::check($permissionName); | |
485 | } | |
486 | } | |
487 | ||
a0ee3941 EM |
488 | /** |
489 | * @param $args | |
490 | * @param string $op | |
491 | * | |
492 | * @return bool | |
493 | */ | |
00be9182 | 494 | public static function checkMenu(&$args, $op = 'and') { |
6a488035 TO |
495 | if (!is_array($args)) { |
496 | return $args; | |
497 | } | |
498 | foreach ($args as $str) { | |
499 | $res = CRM_Core_Permission::check($str); | |
500 | if ($op == 'or' && $res) { | |
501 | return TRUE; | |
502 | } | |
503 | elseif ($op == 'and' && !$res) { | |
504 | return FALSE; | |
505 | } | |
506 | } | |
507 | return ($op == 'or') ? FALSE : TRUE; | |
508 | } | |
509 | ||
a0ee3941 EM |
510 | /** |
511 | * @param $item | |
512 | * | |
513 | * @return bool|mixed | |
514 | * @throws Exception | |
515 | */ | |
00be9182 | 516 | public static function checkMenuItem(&$item) { |
6a488035 TO |
517 | if (!array_key_exists('access_callback', $item)) { |
518 | CRM_Core_Error::backtrace(); | |
79e11805 | 519 | throw new CRM_Core_Exception('Missing Access Callback key in menu item'); |
6a488035 TO |
520 | } |
521 | ||
522 | // if component_id is present, ensure it is enabled | |
3d31a5c6 TO |
523 | if (isset($item['component_id']) && $item['component_id']) { |
524 | if (!isset(Civi::$statics[__CLASS__]['componentNameId'])) { | |
525 | Civi::$statics[__CLASS__]['componentNameId'] = array_flip(CRM_Core_Component::getComponentIDs()); | |
526 | } | |
527 | $componentName = Civi::$statics[__CLASS__]['componentNameId'][$item['component_id']]; | |
528 | ||
6a488035 | 529 | $config = CRM_Core_Config::singleton(); |
3d31a5c6 | 530 | if (is_array($config->enableComponents) && in_array($componentName, $config->enableComponents)) { |
6a488035 TO |
531 | // continue with process |
532 | } | |
533 | else { | |
534 | return FALSE; | |
535 | } | |
536 | } | |
537 | ||
538 | // the following is imitating drupal 6 code in includes/menu.inc | |
539 | if (empty($item['access_callback']) || | |
540 | is_numeric($item['access_callback']) | |
541 | ) { | |
596a8bdf | 542 | return (bool) $item['access_callback']; |
6a488035 TO |
543 | } |
544 | ||
545 | // check whether the following Ajax requests submitted the right key | |
546 | // FIXME: this should be integrated into ACLs proper | |
547 | if (CRM_Utils_Array::value('page_type', $item) == 3) { | |
548 | if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) { | |
549 | return FALSE; | |
550 | } | |
551 | } | |
552 | ||
553 | // check if callback is for checkMenu, if so optimize it | |
554 | if (is_array($item['access_callback']) && | |
555 | $item['access_callback'][0] == 'CRM_Core_Permission' && | |
556 | $item['access_callback'][1] == 'checkMenu' | |
557 | ) { | |
558 | $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and'); | |
559 | return self::checkMenu($item['access_arguments'][0], $op); | |
560 | } | |
561 | else { | |
562 | return call_user_func_array($item['access_callback'], $item['access_arguments']); | |
563 | } | |
564 | } | |
565 | ||
a0ee3941 EM |
566 | /** |
567 | * @param bool $all | |
9476d8d1 | 568 | * Include disabled components |
221b21b4 | 569 | * @param bool $descriptions |
9476d8d1 | 570 | * Whether to return descriptions |
a0ee3941 EM |
571 | * |
572 | * @return array | |
573 | */ | |
9476d8d1 | 574 | public static function basicPermissions($all = FALSE, $descriptions = FALSE) { |
be2fb01f | 575 | $cacheKey = implode('-', [$all, $descriptions]); |
9476d8d1 CW |
576 | if (empty(Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey])) { |
577 | Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey] = self::assembleBasicPermissions($all, $descriptions); | |
221b21b4 | 578 | } |
9476d8d1 | 579 | return Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey]; |
221b21b4 AH |
580 | } |
581 | ||
582 | /** | |
583 | * @param bool $all | |
584 | * @param bool $descriptions | |
585 | * whether to return descriptions | |
586 | * | |
587 | * @return array | |
d2b6eac8 | 588 | * @throws \CRM_Core_Exception |
221b21b4 | 589 | */ |
d2b6eac8 | 590 | public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE): array { |
591 | $permissions = self::getCoreAndComponentPermissions($all); | |
221b21b4 | 592 | |
b4d6a411 | 593 | // Add any permissions defined in hook_civicrm_permission implementations. |
ea54c6e5 | 594 | $module_permissions = CRM_Core_Config::singleton()->userPermissionClass->getAllModulePermissions(TRUE, $permissions); |
b4d6a411 | 595 | $permissions = array_merge($permissions, $module_permissions); |
8c282315 | 596 | if (!$descriptions) { |
597 | foreach ($permissions as $name => $attr) { | |
598 | $permissions[$name] = array_shift($attr); | |
599 | } | |
600 | } | |
6a488035 TO |
601 | return $permissions; |
602 | } | |
603 | ||
a0ee3941 EM |
604 | /** |
605 | * @return array | |
606 | */ | |
00be9182 | 607 | public static function getAnonymousPermissionsWarnings() { |
be2fb01f | 608 | static $permissions = []; |
81bb85ea | 609 | if (empty($permissions)) { |
be2fb01f | 610 | $permissions = [ |
21dfd5f5 | 611 | 'administer CiviCRM', |
be2fb01f | 612 | ]; |
81bb85ea AC |
613 | $components = CRM_Core_Component::getComponents(); |
614 | foreach ($components as $comp) { | |
615 | if (!method_exists($comp, 'getAnonymousPermissionWarnings')) { | |
616 | continue; | |
617 | } | |
618 | $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings()); | |
619 | } | |
620 | } | |
621 | return $permissions; | |
622 | } | |
623 | ||
a0ee3941 EM |
624 | /** |
625 | * @param $anonymous_perms | |
626 | * | |
627 | * @return array | |
628 | */ | |
00be9182 | 629 | public static function validateForPermissionWarnings($anonymous_perms) { |
81bb85ea AC |
630 | return array_intersect($anonymous_perms, self::getAnonymousPermissionsWarnings()); |
631 | } | |
632 | ||
a0ee3941 | 633 | /** |
6793d6a9 | 634 | * Get core permissions. |
221b21b4 | 635 | * |
a0ee3941 EM |
636 | * @return array |
637 | */ | |
8c282315 | 638 | public static function getCorePermissions() { |
6a488035 | 639 | $prefix = ts('CiviCRM') . ': '; |
be2fb01f CW |
640 | $permissions = [ |
641 | 'add contacts' => [ | |
221b21b4 AH |
642 | $prefix . ts('add contacts'), |
643 | ts('Create a new contact record in CiviCRM'), | |
be2fb01f CW |
644 | ], |
645 | 'view all contacts' => [ | |
221b21b4 AH |
646 | $prefix . ts('view all contacts'), |
647 | ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'), | |
be2fb01f CW |
648 | ], |
649 | 'edit all contacts' => [ | |
221b21b4 AH |
650 | $prefix . ts('edit all contacts'), |
651 | ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'), | |
be2fb01f CW |
652 | ], |
653 | 'view my contact' => [ | |
221b21b4 | 654 | $prefix . ts('view my contact'), |
be2fb01f CW |
655 | ], |
656 | 'edit my contact' => [ | |
221b21b4 | 657 | $prefix . ts('edit my contact'), |
be2fb01f CW |
658 | ], |
659 | 'delete contacts' => [ | |
221b21b4 | 660 | $prefix . ts('delete contacts'), |
be2fb01f CW |
661 | ], |
662 | 'access deleted contacts' => [ | |
221b21b4 AH |
663 | $prefix . ts('access deleted contacts'), |
664 | ts('Access contacts in the trash'), | |
be2fb01f CW |
665 | ], |
666 | 'import contacts' => [ | |
221b21b4 AH |
667 | $prefix . ts('import contacts'), |
668 | ts('Import contacts and activities'), | |
be2fb01f CW |
669 | ], |
670 | 'import SQL datasource' => [ | |
40bc3c68 TO |
671 | $prefix . ts('import SQL datasource'), |
672 | ts('When importing, consume data directly from a SQL datasource'), | |
be2fb01f CW |
673 | ], |
674 | 'edit groups' => [ | |
221b21b4 AH |
675 | $prefix . ts('edit groups'), |
676 | ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'), | |
be2fb01f CW |
677 | ], |
678 | 'administer CiviCRM' => [ | |
221b21b4 AH |
679 | $prefix . ts('administer CiviCRM'), |
680 | ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'), | |
be2fb01f CW |
681 | ], |
682 | 'skip IDS check' => [ | |
221b21b4 | 683 | $prefix . ts('skip IDS check'), |
d9a37cbc | 684 | ts('Warning: Give to trusted roles only; this permission has security implications. IDS system is bypassed for users with this permission. Prevents false errors for admin users.'), |
be2fb01f CW |
685 | ], |
686 | 'access uploaded files' => [ | |
221b21b4 AH |
687 | $prefix . ts('access uploaded files'), |
688 | ts('View / download files including images and photos'), | |
be2fb01f CW |
689 | ], |
690 | 'profile listings and forms' => [ | |
221b21b4 | 691 | $prefix . ts('profile listings and forms'), |
d9a37cbc | 692 | ts('Warning: Give to trusted roles only; this permission has privacy implications. Add/edit data in online forms and access public searchable directories.'), |
be2fb01f CW |
693 | ], |
694 | 'profile listings' => [ | |
221b21b4 | 695 | $prefix . ts('profile listings'), |
d9a37cbc | 696 | ts('Warning: Give to trusted roles only; this permission has privacy implications. Access public searchable directories.'), |
be2fb01f CW |
697 | ], |
698 | 'profile create' => [ | |
221b21b4 | 699 | $prefix . ts('profile create'), |
d9a37cbc | 700 | ts('Add data in a profile form.'), |
be2fb01f CW |
701 | ], |
702 | 'profile edit' => [ | |
221b21b4 | 703 | $prefix . ts('profile edit'), |
d9a37cbc | 704 | ts('Edit data in a profile form.'), |
be2fb01f CW |
705 | ], |
706 | 'profile view' => [ | |
221b21b4 | 707 | $prefix . ts('profile view'), |
d9a37cbc | 708 | ts('View data in a profile.'), |
be2fb01f CW |
709 | ], |
710 | 'access all custom data' => [ | |
221b21b4 AH |
711 | $prefix . ts('access all custom data'), |
712 | ts('View all custom fields regardless of ACL rules'), | |
be2fb01f CW |
713 | ], |
714 | 'view all activities' => [ | |
221b21b4 AH |
715 | $prefix . ts('view all activities'), |
716 | ts('View all activities (for visible contacts)'), | |
be2fb01f CW |
717 | ], |
718 | 'delete activities' => [ | |
221b21b4 | 719 | $prefix . ts('Delete activities'), |
be2fb01f CW |
720 | ], |
721 | 'edit inbound email basic information' => [ | |
ee90a98c CR |
722 | $prefix . ts('edit inbound email basic information'), |
723 | ts('Edit all inbound email activities (for visible contacts) basic information. Content editing not allowed.'), | |
be2fb01f CW |
724 | ], |
725 | 'edit inbound email basic information and content' => [ | |
ee90a98c CR |
726 | $prefix . ts('edit inbound email basic information and content'), |
727 | ts('Edit all inbound email activities (for visible contacts) basic information and content.'), | |
be2fb01f CW |
728 | ], |
729 | 'access CiviCRM' => [ | |
d9a37cbc H |
730 | $prefix . ts('access CiviCRM backend and API'), |
731 | ts('Master control for access to the main CiviCRM backend and API. Give to trusted roles only.'), | |
be2fb01f CW |
732 | ], |
733 | 'access Contact Dashboard' => [ | |
221b21b4 AH |
734 | $prefix . ts('access Contact Dashboard'), |
735 | ts('View Contact Dashboard (for themselves and visible contacts)'), | |
be2fb01f CW |
736 | ], |
737 | 'translate CiviCRM' => [ | |
221b21b4 AH |
738 | $prefix . ts('translate CiviCRM'), |
739 | ts('Allow User to enable multilingual'), | |
be2fb01f CW |
740 | ], |
741 | 'manage tags' => [ | |
eaaaef83 I |
742 | $prefix . ts('manage tags'), |
743 | ts('Create and rename tags'), | |
be2fb01f CW |
744 | ], |
745 | 'administer reserved groups' => [ | |
221b21b4 AH |
746 | $prefix . ts('administer reserved groups'), |
747 | ts('Edit and disable Reserved Groups (Needs Edit Groups)'), | |
be2fb01f CW |
748 | ], |
749 | 'administer Tagsets' => [ | |
221b21b4 | 750 | $prefix . ts('administer Tagsets'), |
be2fb01f CW |
751 | ], |
752 | 'administer reserved tags' => [ | |
221b21b4 | 753 | $prefix . ts('administer reserved tags'), |
be2fb01f CW |
754 | ], |
755 | 'administer dedupe rules' => [ | |
221b21b4 AH |
756 | $prefix . ts('administer dedupe rules'), |
757 | ts('Create and edit rules, change the supervised and unsupervised rules'), | |
be2fb01f CW |
758 | ], |
759 | 'merge duplicate contacts' => [ | |
221b21b4 AH |
760 | $prefix . ts('merge duplicate contacts'), |
761 | ts('Delete Contacts must also be granted in order for this to work.'), | |
be2fb01f CW |
762 | ], |
763 | 'force merge duplicate contacts' => [ | |
fd630ef9 | 764 | $prefix . ts('force merge duplicate contacts'), |
765 | ts('Delete Contacts must also be granted in order for this to work.'), | |
be2fb01f CW |
766 | ], |
767 | 'view debug output' => [ | |
221b21b4 AH |
768 | $prefix . ts('view debug output'), |
769 | ts('View results of debug and backtrace'), | |
be2fb01f | 770 | ], |
02d451ab | 771 | |
be2fb01f | 772 | 'view all notes' => [ |
221b21b4 AH |
773 | $prefix . ts('view all notes'), |
774 | ts("View notes (for visible contacts) even if they're marked admin only"), | |
be2fb01f CW |
775 | ], |
776 | 'add contact notes' => [ | |
088101a4 O |
777 | $prefix . ts('add contact notes'), |
778 | ts("Create notes for contacts"), | |
be2fb01f CW |
779 | ], |
780 | 'access AJAX API' => [ | |
221b21b4 AH |
781 | $prefix . ts('access AJAX API'), |
782 | ts('Allow API access even if Access CiviCRM is not granted'), | |
be2fb01f CW |
783 | ], |
784 | 'access contact reference fields' => [ | |
221b21b4 AH |
785 | $prefix . ts('access contact reference fields'), |
786 | ts('Allow entering data into contact reference fields'), | |
be2fb01f CW |
787 | ], |
788 | 'create manual batch' => [ | |
221b21b4 AH |
789 | $prefix . ts('create manual batch'), |
790 | ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'), | |
be2fb01f CW |
791 | ], |
792 | 'edit own manual batches' => [ | |
221b21b4 AH |
793 | $prefix . ts('edit own manual batches'), |
794 | ts('Edit accounting batches created by user'), | |
be2fb01f CW |
795 | ], |
796 | 'edit all manual batches' => [ | |
221b21b4 AH |
797 | $prefix . ts('edit all manual batches'), |
798 | ts('Edit all accounting batches'), | |
be2fb01f CW |
799 | ], |
800 | 'close own manual batches' => [ | |
47a98aef | 801 | $prefix . ts('close own manual batches'), |
5ad18cc2 | 802 | ts('Close accounting batches created by user (with Access to CiviContribute)'), |
be2fb01f CW |
803 | ], |
804 | 'close all manual batches' => [ | |
47a98aef | 805 | $prefix . ts('close all manual batches'), |
5ad18cc2 | 806 | ts('Close all accounting batches (with Access to CiviContribute)'), |
be2fb01f CW |
807 | ], |
808 | 'reopen own manual batches' => [ | |
47a98aef | 809 | $prefix . ts('reopen own manual batches'), |
5ad18cc2 | 810 | ts('Reopen accounting batches created by user (with Access to CiviContribute)'), |
be2fb01f CW |
811 | ], |
812 | 'reopen all manual batches' => [ | |
47a98aef | 813 | $prefix . ts('reopen all manual batches'), |
5ad18cc2 | 814 | ts('Reopen all accounting batches (with Access to CiviContribute)'), |
be2fb01f CW |
815 | ], |
816 | 'view own manual batches' => [ | |
221b21b4 AH |
817 | $prefix . ts('view own manual batches'), |
818 | ts('View accounting batches created by user (with Access to CiviContribute)'), | |
be2fb01f CW |
819 | ], |
820 | 'view all manual batches' => [ | |
221b21b4 AH |
821 | $prefix . ts('view all manual batches'), |
822 | ts('View all accounting batches (with Access to CiviContribute)'), | |
be2fb01f CW |
823 | ], |
824 | 'delete own manual batches' => [ | |
221b21b4 AH |
825 | $prefix . ts('delete own manual batches'), |
826 | ts('Delete accounting batches created by user'), | |
be2fb01f CW |
827 | ], |
828 | 'delete all manual batches' => [ | |
221b21b4 AH |
829 | $prefix . ts('delete all manual batches'), |
830 | ts('Delete all accounting batches'), | |
be2fb01f CW |
831 | ], |
832 | 'export own manual batches' => [ | |
221b21b4 AH |
833 | $prefix . ts('export own manual batches'), |
834 | ts('Export accounting batches created by user'), | |
be2fb01f CW |
835 | ], |
836 | 'export all manual batches' => [ | |
221b21b4 AH |
837 | $prefix . ts('export all manual batches'), |
838 | ts('Export all accounting batches'), | |
be2fb01f CW |
839 | ], |
840 | 'administer payment processors' => [ | |
221b21b4 AH |
841 | $prefix . ts('administer payment processors'), |
842 | ts('Add, Update, or Disable Payment Processors'), | |
be2fb01f CW |
843 | ], |
844 | 'edit message templates' => [ | |
221b21b4 | 845 | $prefix . ts('edit message templates'), |
be2fb01f CW |
846 | ], |
847 | 'edit system workflow message templates' => [ | |
40a732a9 | 848 | $prefix . ts('edit system workflow message templates'), |
be2fb01f CW |
849 | ], |
850 | 'edit user-driven message templates' => [ | |
40a732a9 | 851 | $prefix . ts('edit user-driven message templates'), |
be2fb01f CW |
852 | ], |
853 | 'view my invoices' => [ | |
a664e7b3 | 854 | $prefix . ts('view my invoices'), |
dc6b437a | 855 | ts('Allow users to view/ download their own invoices'), |
be2fb01f CW |
856 | ], |
857 | 'edit api keys' => [ | |
d4463076 TO |
858 | $prefix . ts('edit api keys'), |
859 | ts('Edit API keys'), | |
be2fb01f CW |
860 | ], |
861 | 'edit own api keys' => [ | |
d4463076 TO |
862 | $prefix . ts('edit own api keys'), |
863 | ts('Edit user\'s own API keys'), | |
be2fb01f CW |
864 | ], |
865 | 'send SMS' => [ | |
63483feb MM |
866 | $prefix . ts('send SMS'), |
867 | ts('Send an SMS'), | |
be2fb01f | 868 | ], |
755a1835 | 869 | 'administer CiviCRM system' => [ |
870 | 'label' => $prefix . ts('administer CiviCRM System'), | |
4c85c7b6 | 871 | 'description' => ts('Perform all system administration tasks in CiviCRM'), |
755a1835 | 872 | ], |
873 | 'administer CiviCRM data' => [ | |
874 | 'label' => $prefix . ts('administer CiviCRM Data'), | |
4c85c7b6 | 875 | 'description' => ts('Permit altering all restricted data options'), |
755a1835 | 876 | ], |
ea54c6e5 | 877 | 'all CiviCRM permissions and ACLs' => [ |
878 | 'label' => $prefix . ts('all CiviCRM permissions and ACLs'), | |
879 | 'description' => ts('Administer and use CiviCRM bypassing any other permission or ACL checks and enabling the creation of displays and forms that allow others to bypass checks. This permission should be given out with care'), | |
880 | ], | |
be2fb01f | 881 | ]; |
ce6b4d9b | 882 | if (self::isMultisiteEnabled()) { |
883 | // This could arguably be moved to the multisite extension but | |
884 | // within core it does permit editing group-organization records. | |
885 | $permissions['administer Multiple Organizations'] = [ | |
886 | 'label' => $prefix . ts('administer Multiple Organizations'), | |
887 | 'description' => ts('Administer multiple organizations. In practice this allows editing the group organization link'), | |
888 | ]; | |
889 | } | |
6a488035 TO |
890 | return $permissions; |
891 | } | |
892 | ||
755a1835 | 893 | /** |
894 | * Get permissions implied by 'superset' permissions. | |
895 | * | |
896 | * @return array | |
897 | */ | |
ea54c6e5 | 898 | public static function getImpliedAdminPermissions(): array { |
755a1835 | 899 | return [ |
ea54c6e5 | 900 | 'administer CiviCRM' => ['implied_permissions' => ['administer CiviCRM system', 'administer CiviCRM data']], |
901 | 'administer CiviCRM data' => ['implied_permissions' => ['edit message templates', 'administer dedupe rules']], | |
902 | 'administer CiviCRM system' => ['implied_permissions' => ['edit system workflow message templates']], | |
755a1835 | 903 | ]; |
904 | } | |
905 | ||
906 | /** | |
907 | * Get any super-permissions that imply the given permission. | |
908 | * | |
909 | * @param string $permission | |
910 | * | |
911 | * @return array | |
912 | */ | |
ea54c6e5 | 913 | public static function getImpliedPermissionsFor(string $permission): array { |
709672c6 | 914 | if (in_array($permission[0], ['@', '*'], TRUE)) { |
915 | // Special permissions like '*always deny*' - see DynamicFKAuthorizationTest. | |
916 | // Also '@afform - see AfformUsageTest. | |
917 | return []; | |
918 | } | |
ea54c6e5 | 919 | $implied = Civi::cache('metadata')->get('implied_permissions', []); |
920 | if (isset($implied[$permission])) { | |
921 | return $implied[$permission]; | |
922 | } | |
709672c6 | 923 | $implied[$permission] = ['all CiviCRM permissions and ACLs']; |
924 | foreach (self::getImpliedAdminPermissions() as $key => $details) { | |
ea54c6e5 | 925 | if (in_array($permission, $details['implied_permissions'] ?? [], TRUE)) { |
926 | $implied[$permission][] = $key; | |
755a1835 | 927 | } |
928 | } | |
ea54c6e5 | 929 | Civi::cache('metadata')->set('implied_permissions', $implied); |
930 | return $implied[$permission]; | |
755a1835 | 931 | } |
932 | ||
bf9a7c0f ES |
933 | /** |
934 | * For each entity provides an array of permissions required for each action | |
935 | * | |
936 | * The action is the array key, possible values: | |
937 | * * create: applies to create (with no id in params) | |
938 | * * update: applies to update, setvalue, create (with id in params) | |
939 | * * get: applies to getcount, getsingle, getvalue and other gets | |
940 | * * delete: applies to delete, replace | |
941 | * * meta: applies to getfields, getoptions, getspec | |
942 | * * default: catch-all for anything not declared | |
943 | * | |
944 | * Note: some APIs declare other actions as well | |
945 | * | |
946 | * Permissions should use arrays for AND and arrays of arrays for OR | |
1a5a2ade | 947 | * @see CRM_Core_Permission::check |
bf9a7c0f ES |
948 | * |
949 | * @return array of permissions | |
950 | */ | |
951 | public static function getEntityActionPermissions() { | |
be2fb01f | 952 | $permissions = []; |
bf9a7c0f ES |
953 | // These are the default permissions - if any entity does not declare permissions for a given action, |
954 | // (or the entity does not declare permissions at all) - then the action will be used from here | |
be2fb01f | 955 | $permissions['default'] = [ |
bf9a7c0f | 956 | // applies to getfields, getoptions, etc. |
be2fb01f | 957 | 'meta' => ['access CiviCRM'], |
bf9a7c0f ES |
958 | // catch-all, applies to create, get, delete, etc. |
959 | // If an entity declares it's own 'default' action it will override this one | |
be2fb01f CW |
960 | 'default' => ['administer CiviCRM'], |
961 | ]; | |
bf9a7c0f ES |
962 | |
963 | // Note: Additional permissions in DynamicFKAuthorization | |
be2fb01f CW |
964 | $permissions['attachment'] = [ |
965 | 'default' => [ | |
966 | ['access CiviCRM', 'access AJAX API'], | |
967 | ], | |
968 | ]; | |
bf9a7c0f ES |
969 | |
970 | // Contact permissions | |
be2fb01f CW |
971 | $permissions['contact'] = [ |
972 | 'create' => [ | |
bf9a7c0f ES |
973 | 'access CiviCRM', |
974 | 'add contacts', | |
be2fb01f CW |
975 | ], |
976 | 'delete' => [ | |
bf9a7c0f ES |
977 | 'access CiviCRM', |
978 | 'delete contacts', | |
be2fb01f | 979 | ], |
bf9a7c0f | 980 | // managed by query object |
be2fb01f | 981 | 'get' => [], |
bf9a7c0f | 982 | // managed by _civicrm_api3_check_edit_permissions |
be2fb01f CW |
983 | 'update' => [], |
984 | 'getquick' => [ | |
985 | ['access CiviCRM', 'access AJAX API'], | |
986 | ], | |
987 | 'duplicatecheck' => [ | |
f257308b | 988 | 'access CiviCRM', |
be2fb01f | 989 | ], |
9f8c8b7a | 990 | 'merge' => ['merge duplicate contacts'], |
be2fb01f | 991 | ]; |
bf9a7c0f | 992 | |
cc477693 | 993 | $permissions['dedupe'] = [ |
994 | 'getduplicates' => ['access CiviCRM'], | |
3ea6ec7d | 995 | 'getstatistics' => ['access CiviCRM'], |
cc477693 | 996 | ]; |
997 | ||
bf9a7c0f | 998 | // CRM-16963 - Permissions for country. |
be2fb01f CW |
999 | $permissions['country'] = [ |
1000 | 'get' => [ | |
bf9a7c0f | 1001 | 'access CiviCRM', |
be2fb01f CW |
1002 | ], |
1003 | 'default' => [ | |
bf9a7c0f | 1004 | 'administer CiviCRM', |
be2fb01f CW |
1005 | ], |
1006 | ]; | |
bf9a7c0f ES |
1007 | |
1008 | // Contact-related data permissions. | |
be2fb01f | 1009 | $permissions['address'] = [ |
bf9a7c0f ES |
1010 | // get is managed by BAO::addSelectWhereClause |
1011 | // create/delete are managed by _civicrm_api3_check_edit_permissions | |
be2fb01f CW |
1012 | 'default' => [], |
1013 | ]; | |
bf9a7c0f ES |
1014 | $permissions['email'] = $permissions['address']; |
1015 | $permissions['phone'] = $permissions['address']; | |
1016 | $permissions['website'] = $permissions['address']; | |
1017 | $permissions['im'] = $permissions['address']; | |
1018 | $permissions['open_i_d'] = $permissions['address']; | |
1019 | ||
1020 | // Also managed by ACLs - CRM-19448 | |
be2fb01f | 1021 | $permissions['entity_tag'] = ['default' => []]; |
bf9a7c0f ES |
1022 | $permissions['note'] = $permissions['entity_tag']; |
1023 | ||
1024 | // Allow non-admins to get and create tags to support tagset widget | |
1025 | // Delete is still reserved for admins | |
be2fb01f CW |
1026 | $permissions['tag'] = [ |
1027 | 'get' => ['access CiviCRM'], | |
1028 | 'create' => ['access CiviCRM'], | |
1029 | 'update' => ['access CiviCRM'], | |
1030 | ]; | |
bf9a7c0f ES |
1031 | |
1032 | //relationship permissions | |
be2fb01f | 1033 | $permissions['relationship'] = [ |
bf9a7c0f | 1034 | // get is managed by BAO::addSelectWhereClause |
be2fb01f CW |
1035 | 'get' => [], |
1036 | 'delete' => [ | |
bf9a7c0f ES |
1037 | 'access CiviCRM', |
1038 | 'edit all contacts', | |
be2fb01f CW |
1039 | ], |
1040 | 'default' => [ | |
bf9a7c0f ES |
1041 | 'access CiviCRM', |
1042 | 'edit all contacts', | |
be2fb01f CW |
1043 | ], |
1044 | ]; | |
bf9a7c0f ES |
1045 | |
1046 | // CRM-17741 - Permissions for RelationshipType. | |
be2fb01f CW |
1047 | $permissions['relationship_type'] = [ |
1048 | 'get' => [ | |
bf9a7c0f | 1049 | 'access CiviCRM', |
be2fb01f CW |
1050 | ], |
1051 | 'default' => [ | |
bf9a7c0f | 1052 | 'administer CiviCRM', |
be2fb01f CW |
1053 | ], |
1054 | ]; | |
bf9a7c0f ES |
1055 | |
1056 | // Activity permissions | |
be2fb01f CW |
1057 | $permissions['activity'] = [ |
1058 | 'delete' => [ | |
bf9a7c0f ES |
1059 | 'access CiviCRM', |
1060 | 'delete activities', | |
be2fb01f CW |
1061 | ], |
1062 | 'get' => [ | |
bf9a7c0f ES |
1063 | 'access CiviCRM', |
1064 | // Note that view all activities is also required within the api | |
1065 | // if the id is not passed in. Where the id is passed in the activity | |
1066 | // specific check functions are used and tested. | |
be2fb01f CW |
1067 | ], |
1068 | 'default' => [ | |
bf9a7c0f ES |
1069 | 'access CiviCRM', |
1070 | 'view all activities', | |
be2fb01f CW |
1071 | ], |
1072 | ]; | |
cdacd6ab | 1073 | $permissions['activity_contact'] = $permissions['activity']; |
bf9a7c0f ES |
1074 | |
1075 | // Case permissions | |
be2fb01f CW |
1076 | $permissions['case'] = [ |
1077 | 'create' => [ | |
bf9a7c0f ES |
1078 | 'access CiviCRM', |
1079 | 'add cases', | |
be2fb01f CW |
1080 | ], |
1081 | 'delete' => [ | |
bf9a7c0f ES |
1082 | 'access CiviCRM', |
1083 | 'delete in CiviCase', | |
be2fb01f CW |
1084 | ], |
1085 | 'restore' => [ | |
8572e6de | 1086 | 'administer CiviCase', |
be2fb01f CW |
1087 | ], |
1088 | 'merge' => [ | |
a6bc7218 | 1089 | 'administer CiviCase', |
be2fb01f CW |
1090 | ], |
1091 | 'default' => [ | |
bf9a7c0f | 1092 | // At minimum the user needs one of the following. Finer-grained access is controlled by CRM_Case_BAO_Case::addSelectWhereClause |
be2fb01f CW |
1093 | ['access my cases and activities', 'access all cases and activities'], |
1094 | ], | |
1095 | ]; | |
bf9a7c0f | 1096 | $permissions['case_contact'] = $permissions['case']; |
7b52581f | 1097 | $permissions['case_activity'] = $permissions['case']; |
bf9a7c0f | 1098 | |
be2fb01f CW |
1099 | $permissions['case_type'] = [ |
1100 | 'default' => ['administer CiviCase'], | |
1101 | 'get' => [ | |
bf9a7c0f | 1102 | // nested array = OR |
be2fb01f CW |
1103 | ['access my cases and activities', 'access all cases and activities'], |
1104 | ], | |
1105 | ]; | |
bf9a7c0f ES |
1106 | |
1107 | // Campaign permissions | |
be2fb01f CW |
1108 | $permissions['campaign'] = [ |
1109 | 'get' => ['access CiviCRM'], | |
1110 | 'default' => [ | |
bf9a7c0f | 1111 | // nested array = OR |
be2fb01f CW |
1112 | ['administer CiviCampaign', 'manage campaign'], |
1113 | ], | |
1114 | ]; | |
bf9a7c0f ES |
1115 | $permissions['survey'] = $permissions['campaign']; |
1116 | ||
1117 | // Financial permissions | |
be2fb01f CW |
1118 | $permissions['contribution'] = [ |
1119 | 'get' => [ | |
bf9a7c0f ES |
1120 | 'access CiviCRM', |
1121 | 'access CiviContribute', | |
be2fb01f CW |
1122 | ], |
1123 | 'delete' => [ | |
bf9a7c0f ES |
1124 | 'access CiviCRM', |
1125 | 'access CiviContribute', | |
1126 | 'delete in CiviContribute', | |
be2fb01f CW |
1127 | ], |
1128 | 'completetransaction' => [ | |
bf9a7c0f | 1129 | 'edit contributions', |
be2fb01f CW |
1130 | ], |
1131 | 'default' => [ | |
bf9a7c0f ES |
1132 | 'access CiviCRM', |
1133 | 'access CiviContribute', | |
1134 | 'edit contributions', | |
be2fb01f CW |
1135 | ], |
1136 | ]; | |
bf9a7c0f ES |
1137 | $permissions['line_item'] = $permissions['contribution']; |
1138 | ||
1139 | // Payment permissions | |
be2fb01f CW |
1140 | $permissions['payment'] = [ |
1141 | 'get' => [ | |
bf9a7c0f ES |
1142 | 'access CiviCRM', |
1143 | 'access CiviContribute', | |
be2fb01f CW |
1144 | ], |
1145 | 'delete' => [ | |
bf9a7c0f ES |
1146 | 'access CiviCRM', |
1147 | 'access CiviContribute', | |
1148 | 'delete in CiviContribute', | |
be2fb01f CW |
1149 | ], |
1150 | 'cancel' => [ | |
bf9a7c0f ES |
1151 | 'access CiviCRM', |
1152 | 'access CiviContribute', | |
1153 | 'edit contributions', | |
be2fb01f CW |
1154 | ], |
1155 | 'create' => [ | |
bf9a7c0f ES |
1156 | 'access CiviCRM', |
1157 | 'access CiviContribute', | |
1158 | 'edit contributions', | |
be2fb01f CW |
1159 | ], |
1160 | 'default' => [ | |
bf9a7c0f ES |
1161 | 'access CiviCRM', |
1162 | 'access CiviContribute', | |
1163 | 'edit contributions', | |
be2fb01f CW |
1164 | ], |
1165 | ]; | |
e4124a88 | 1166 | $permissions['contribution_recur'] = $permissions['payment']; |
bf9a7c0f ES |
1167 | |
1168 | // Custom field permissions | |
be2fb01f CW |
1169 | $permissions['custom_field'] = [ |
1170 | 'default' => [ | |
bf9a7c0f ES |
1171 | 'administer CiviCRM', |
1172 | 'access all custom data', | |
be2fb01f CW |
1173 | ], |
1174 | ]; | |
bf9a7c0f ES |
1175 | $permissions['custom_group'] = $permissions['custom_field']; |
1176 | ||
1177 | // Event permissions | |
be2fb01f CW |
1178 | $permissions['event'] = [ |
1179 | 'create' => [ | |
bf9a7c0f ES |
1180 | 'access CiviCRM', |
1181 | 'access CiviEvent', | |
1182 | 'edit all events', | |
be2fb01f CW |
1183 | ], |
1184 | 'delete' => [ | |
bf9a7c0f ES |
1185 | 'access CiviCRM', |
1186 | 'access CiviEvent', | |
1187 | 'delete in CiviEvent', | |
be2fb01f CW |
1188 | ], |
1189 | 'get' => [ | |
bf9a7c0f ES |
1190 | 'access CiviCRM', |
1191 | 'access CiviEvent', | |
1192 | 'view event info', | |
be2fb01f CW |
1193 | ], |
1194 | 'update' => [ | |
bf9a7c0f ES |
1195 | 'access CiviCRM', |
1196 | 'access CiviEvent', | |
1197 | 'edit all events', | |
be2fb01f CW |
1198 | ], |
1199 | ]; | |
170af518 | 1200 | // Exception refers to dedupe_exception. |
1201 | $permissions['exception'] = [ | |
1202 | 'default' => ['merge duplicate contacts'], | |
1203 | ]; | |
5654496c | 1204 | |
418ffc5b | 1205 | $permissions['job'] = [ |
1206 | 'process_batch_merge' => ['merge duplicate contacts'], | |
1207 | ]; | |
5654496c | 1208 | $permissions['rule_group']['get'] = [['merge duplicate contacts', 'administer CiviCRM']]; |
bf9a7c0f ES |
1209 | // Loc block is only used for events |
1210 | $permissions['loc_block'] = $permissions['event']; | |
1211 | ||
be2fb01f CW |
1212 | $permissions['state_province'] = [ |
1213 | 'get' => [ | |
fc2d1728 | 1214 | 'access CiviCRM', |
be2fb01f CW |
1215 | ], |
1216 | ]; | |
fc2d1728 | 1217 | |
bf9a7c0f | 1218 | // Price sets are shared by several components, user needs access to at least one of them |
be2fb01f CW |
1219 | $permissions['price_set'] = [ |
1220 | 'default' => [ | |
1221 | ['access CiviEvent', 'access CiviContribute', 'access CiviMember'], | |
1222 | ], | |
1223 | 'get' => [ | |
1224 | ['access CiviCRM', 'view event info', 'make online contributions'], | |
1225 | ], | |
1226 | ]; | |
bf9a7c0f ES |
1227 | |
1228 | // File permissions | |
be2fb01f CW |
1229 | $permissions['file'] = [ |
1230 | 'default' => [ | |
bf9a7c0f ES |
1231 | 'access CiviCRM', |
1232 | 'access uploaded files', | |
be2fb01f CW |
1233 | ], |
1234 | ]; | |
bf9a7c0f ES |
1235 | $permissions['files_by_entity'] = $permissions['file']; |
1236 | ||
1237 | // Group permissions | |
be2fb01f CW |
1238 | $permissions['group'] = [ |
1239 | 'get' => [ | |
bf9a7c0f | 1240 | 'access CiviCRM', |
be2fb01f CW |
1241 | ], |
1242 | 'default' => [ | |
bf9a7c0f ES |
1243 | 'access CiviCRM', |
1244 | 'edit groups', | |
be2fb01f CW |
1245 | ], |
1246 | ]; | |
bf9a7c0f ES |
1247 | |
1248 | $permissions['group_nesting'] = $permissions['group']; | |
1249 | $permissions['group_organization'] = $permissions['group']; | |
1250 | ||
1251 | //Group Contact permission | |
be2fb01f CW |
1252 | $permissions['group_contact'] = [ |
1253 | 'get' => [ | |
bf9a7c0f | 1254 | 'access CiviCRM', |
be2fb01f CW |
1255 | ], |
1256 | 'default' => [ | |
bf9a7c0f ES |
1257 | 'access CiviCRM', |
1258 | 'edit all contacts', | |
be2fb01f CW |
1259 | ], |
1260 | ]; | |
bf9a7c0f ES |
1261 | |
1262 | // CiviMail Permissions | |
be2fb01f | 1263 | $civiMailBasePerms = [ |
bf9a7c0f ES |
1264 | // To get/preview/update, one must have least one of these perms: |
1265 | // Mailing API implementations enforce nuances of create/approve/schedule permissions. | |
1266 | 'access CiviMail', | |
1267 | 'create mailings', | |
1268 | 'schedule mailings', | |
1269 | 'approve mailings', | |
be2fb01f CW |
1270 | ]; |
1271 | $permissions['mailing'] = [ | |
1272 | 'get' => [ | |
bf9a7c0f ES |
1273 | 'access CiviCRM', |
1274 | $civiMailBasePerms, | |
be2fb01f CW |
1275 | ], |
1276 | 'delete' => [ | |
bf9a7c0f ES |
1277 | 'access CiviCRM', |
1278 | $civiMailBasePerms, | |
1279 | 'delete in CiviMail', | |
be2fb01f CW |
1280 | ], |
1281 | 'submit' => [ | |
bf9a7c0f | 1282 | 'access CiviCRM', |
be2fb01f CW |
1283 | ['access CiviMail', 'schedule mailings'], |
1284 | ], | |
1285 | 'default' => [ | |
bf9a7c0f ES |
1286 | 'access CiviCRM', |
1287 | $civiMailBasePerms, | |
be2fb01f CW |
1288 | ], |
1289 | ]; | |
bf9a7c0f ES |
1290 | $permissions['mailing_group'] = $permissions['mailing']; |
1291 | $permissions['mailing_job'] = $permissions['mailing']; | |
1292 | $permissions['mailing_recipients'] = $permissions['mailing']; | |
1293 | ||
be2fb01f CW |
1294 | $permissions['mailing_a_b'] = [ |
1295 | 'get' => [ | |
bf9a7c0f ES |
1296 | 'access CiviCRM', |
1297 | 'access CiviMail', | |
be2fb01f CW |
1298 | ], |
1299 | 'delete' => [ | |
bf9a7c0f ES |
1300 | 'access CiviCRM', |
1301 | 'access CiviMail', | |
1302 | 'delete in CiviMail', | |
be2fb01f CW |
1303 | ], |
1304 | 'submit' => [ | |
bf9a7c0f | 1305 | 'access CiviCRM', |
be2fb01f CW |
1306 | ['access CiviMail', 'schedule mailings'], |
1307 | ], | |
1308 | 'default' => [ | |
bf9a7c0f ES |
1309 | 'access CiviCRM', |
1310 | 'access CiviMail', | |
be2fb01f CW |
1311 | ], |
1312 | ]; | |
bf9a7c0f ES |
1313 | |
1314 | // Membership permissions | |
be2fb01f CW |
1315 | $permissions['membership'] = [ |
1316 | 'get' => [ | |
bf9a7c0f ES |
1317 | 'access CiviCRM', |
1318 | 'access CiviMember', | |
be2fb01f CW |
1319 | ], |
1320 | 'delete' => [ | |
bf9a7c0f ES |
1321 | 'access CiviCRM', |
1322 | 'access CiviMember', | |
1323 | 'delete in CiviMember', | |
be2fb01f CW |
1324 | ], |
1325 | 'default' => [ | |
bf9a7c0f ES |
1326 | 'access CiviCRM', |
1327 | 'access CiviMember', | |
1328 | 'edit memberships', | |
be2fb01f CW |
1329 | ], |
1330 | ]; | |
bf9a7c0f ES |
1331 | $permissions['membership_status'] = $permissions['membership']; |
1332 | $permissions['membership_type'] = $permissions['membership']; | |
be2fb01f CW |
1333 | $permissions['membership_payment'] = [ |
1334 | 'create' => [ | |
bf9a7c0f ES |
1335 | 'access CiviCRM', |
1336 | 'access CiviMember', | |
1337 | 'edit memberships', | |
1338 | 'access CiviContribute', | |
1339 | 'edit contributions', | |
be2fb01f CW |
1340 | ], |
1341 | 'delete' => [ | |
bf9a7c0f ES |
1342 | 'access CiviCRM', |
1343 | 'access CiviMember', | |
1344 | 'delete in CiviMember', | |
1345 | 'access CiviContribute', | |
1346 | 'delete in CiviContribute', | |
be2fb01f CW |
1347 | ], |
1348 | 'get' => [ | |
bf9a7c0f ES |
1349 | 'access CiviCRM', |
1350 | 'access CiviMember', | |
1351 | 'access CiviContribute', | |
be2fb01f CW |
1352 | ], |
1353 | 'update' => [ | |
bf9a7c0f ES |
1354 | 'access CiviCRM', |
1355 | 'access CiviMember', | |
1356 | 'edit memberships', | |
1357 | 'access CiviContribute', | |
1358 | 'edit contributions', | |
be2fb01f CW |
1359 | ], |
1360 | ]; | |
bf9a7c0f ES |
1361 | |
1362 | // Participant permissions | |
be2fb01f CW |
1363 | $permissions['participant'] = [ |
1364 | 'create' => [ | |
bf9a7c0f ES |
1365 | 'access CiviCRM', |
1366 | 'access CiviEvent', | |
1367 | 'register for events', | |
be2fb01f CW |
1368 | ], |
1369 | 'delete' => [ | |
bf9a7c0f ES |
1370 | 'access CiviCRM', |
1371 | 'access CiviEvent', | |
1372 | 'edit event participants', | |
be2fb01f CW |
1373 | ], |
1374 | 'get' => [ | |
bf9a7c0f ES |
1375 | 'access CiviCRM', |
1376 | 'access CiviEvent', | |
1377 | 'view event participants', | |
be2fb01f CW |
1378 | ], |
1379 | 'update' => [ | |
bf9a7c0f ES |
1380 | 'access CiviCRM', |
1381 | 'access CiviEvent', | |
1382 | 'edit event participants', | |
be2fb01f CW |
1383 | ], |
1384 | ]; | |
1385 | $permissions['participant_payment'] = [ | |
1386 | 'create' => [ | |
bf9a7c0f ES |
1387 | 'access CiviCRM', |
1388 | 'access CiviEvent', | |
1389 | 'register for events', | |
1390 | 'access CiviContribute', | |
1391 | 'edit contributions', | |
be2fb01f CW |
1392 | ], |
1393 | 'delete' => [ | |
bf9a7c0f ES |
1394 | 'access CiviCRM', |
1395 | 'access CiviEvent', | |
1396 | 'edit event participants', | |
1397 | 'access CiviContribute', | |
1398 | 'delete in CiviContribute', | |
be2fb01f CW |
1399 | ], |
1400 | 'get' => [ | |
bf9a7c0f ES |
1401 | 'access CiviCRM', |
1402 | 'access CiviEvent', | |
1403 | 'view event participants', | |
1404 | 'access CiviContribute', | |
be2fb01f CW |
1405 | ], |
1406 | 'update' => [ | |
bf9a7c0f ES |
1407 | 'access CiviCRM', |
1408 | 'access CiviEvent', | |
1409 | 'edit event participants', | |
1410 | 'access CiviContribute', | |
1411 | 'edit contributions', | |
be2fb01f CW |
1412 | ], |
1413 | ]; | |
bf9a7c0f ES |
1414 | |
1415 | // Pledge permissions | |
be2fb01f CW |
1416 | $permissions['pledge'] = [ |
1417 | 'create' => [ | |
bf9a7c0f ES |
1418 | 'access CiviCRM', |
1419 | 'access CiviPledge', | |
1420 | 'edit pledges', | |
be2fb01f CW |
1421 | ], |
1422 | 'delete' => [ | |
bf9a7c0f ES |
1423 | 'access CiviCRM', |
1424 | 'access CiviPledge', | |
1425 | 'delete in CiviPledge', | |
be2fb01f CW |
1426 | ], |
1427 | 'get' => [ | |
bf9a7c0f ES |
1428 | 'access CiviCRM', |
1429 | 'access CiviPledge', | |
be2fb01f CW |
1430 | ], |
1431 | 'update' => [ | |
bf9a7c0f ES |
1432 | 'access CiviCRM', |
1433 | 'access CiviPledge', | |
1434 | 'edit pledges', | |
be2fb01f CW |
1435 | ], |
1436 | ]; | |
bf9a7c0f ES |
1437 | |
1438 | //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission. | |
be2fb01f CW |
1439 | $permissions['action_schedule'] = [ |
1440 | 'update' => [ | |
1441 | [ | |
bf9a7c0f ES |
1442 | 'access CiviCRM', |
1443 | 'edit all events', | |
be2fb01f CW |
1444 | ], |
1445 | ], | |
1446 | ]; | |
bf9a7c0f | 1447 | |
be2fb01f CW |
1448 | $permissions['pledge_payment'] = [ |
1449 | 'create' => [ | |
bf9a7c0f ES |
1450 | 'access CiviCRM', |
1451 | 'access CiviPledge', | |
1452 | 'edit pledges', | |
1453 | 'access CiviContribute', | |
1454 | 'edit contributions', | |
be2fb01f CW |
1455 | ], |
1456 | 'delete' => [ | |
bf9a7c0f ES |
1457 | 'access CiviCRM', |
1458 | 'access CiviPledge', | |
1459 | 'delete in CiviPledge', | |
1460 | 'access CiviContribute', | |
1461 | 'delete in CiviContribute', | |
be2fb01f CW |
1462 | ], |
1463 | 'get' => [ | |
bf9a7c0f ES |
1464 | 'access CiviCRM', |
1465 | 'access CiviPledge', | |
1466 | 'access CiviContribute', | |
be2fb01f CW |
1467 | ], |
1468 | 'update' => [ | |
bf9a7c0f ES |
1469 | 'access CiviCRM', |
1470 | 'access CiviPledge', | |
1471 | 'edit pledges', | |
1472 | 'access CiviContribute', | |
1473 | 'edit contributions', | |
be2fb01f CW |
1474 | ], |
1475 | ]; | |
bf9a7c0f | 1476 | |
dfcf5ba2 CW |
1477 | // Dashboard permissions |
1478 | $permissions['dashboard'] = [ | |
1479 | 'get' => [ | |
1480 | 'access CiviCRM', | |
1481 | ], | |
1482 | ]; | |
1483 | $permissions['dashboard_contact'] = [ | |
1484 | 'default' => [ | |
1485 | 'access CiviCRM', | |
1486 | ], | |
1487 | ]; | |
1488 | ||
bf9a7c0f | 1489 | // Profile permissions |
be2fb01f | 1490 | $permissions['profile'] = [ |
518fa0ee SL |
1491 | // the profile will take care of this |
1492 | 'get' => [], | |
be2fb01f | 1493 | ]; |
bf9a7c0f | 1494 | |
be2fb01f CW |
1495 | $permissions['uf_group'] = [ |
1496 | 'create' => [ | |
bf9a7c0f | 1497 | 'access CiviCRM', |
be2fb01f | 1498 | [ |
bf9a7c0f ES |
1499 | 'administer CiviCRM', |
1500 | 'manage event profiles', | |
be2fb01f CW |
1501 | ], |
1502 | ], | |
1503 | 'get' => [ | |
bf9a7c0f | 1504 | 'access CiviCRM', |
be2fb01f CW |
1505 | ], |
1506 | 'update' => [ | |
bf9a7c0f | 1507 | 'access CiviCRM', |
be2fb01f | 1508 | [ |
bf9a7c0f ES |
1509 | 'administer CiviCRM', |
1510 | 'manage event profiles', | |
be2fb01f CW |
1511 | ], |
1512 | ], | |
1513 | ]; | |
bf9a7c0f | 1514 | $permissions['uf_field'] = $permissions['uf_join'] = $permissions['uf_group']; |
be2fb01f | 1515 | $permissions['uf_field']['delete'] = [ |
bf9a7c0f | 1516 | 'access CiviCRM', |
be2fb01f | 1517 | [ |
bf9a7c0f ES |
1518 | 'administer CiviCRM', |
1519 | 'manage event profiles', | |
be2fb01f CW |
1520 | ], |
1521 | ]; | |
bf9a7c0f ES |
1522 | $permissions['option_value'] = $permissions['uf_group']; |
1523 | $permissions['option_group'] = $permissions['option_value']; | |
1524 | ||
be2fb01f CW |
1525 | $permissions['custom_value'] = [ |
1526 | 'gettree' => ['access CiviCRM'], | |
1527 | ]; | |
f26fa703 | 1528 | |
be2fb01f CW |
1529 | $permissions['message_template'] = [ |
1530 | 'get' => ['access CiviCRM'], | |
1531 | 'create' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']], | |
1532 | 'update' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']], | |
1533 | ]; | |
4341efe4 JV |
1534 | |
1535 | $permissions['report_template']['update'] = 'save Report Criteria'; | |
1536 | $permissions['report_template']['create'] = 'save Report Criteria'; | |
bf9a7c0f ES |
1537 | return $permissions; |
1538 | } | |
1539 | ||
1540 | /** | |
1541 | * Translate an unknown action to a canonical form. | |
1542 | * | |
1543 | * @param string $action | |
1544 | * | |
1545 | * @return string | |
1546 | * the standardised action name | |
1547 | */ | |
1548 | public static function getGenericAction($action) { | |
1549 | $snippet = substr($action, 0, 3); | |
1550 | if ($action == 'replace' || $snippet == 'del') { | |
1551 | // 'Replace' is a combination of get+create+update+delete; however, the permissions | |
1552 | // on each of those will be tested separately at runtime. This is just a sniff-test | |
1553 | // based on the heuristic that 'delete' tends to be the most closely guarded | |
1554 | // of the necessary permissions. | |
1555 | $action = 'delete'; | |
1556 | } | |
1557 | elseif ($action == 'setvalue' || $snippet == 'upd') { | |
1558 | $action = 'update'; | |
1559 | } | |
1560 | elseif ($action == 'getfields' || $action == 'getfield' || $action == 'getspec' || $action == 'getoptions') { | |
1561 | $action = 'meta'; | |
1562 | } | |
1563 | elseif ($snippet == 'get') { | |
1564 | $action = 'get'; | |
1565 | } | |
1566 | return $action; | |
1567 | } | |
1568 | ||
6a488035 | 1569 | /** |
d09edf64 | 1570 | * Validate user permission across. |
6a488035 TO |
1571 | * edit or view or with supportable acls. |
1572 | * | |
acb1052e WA |
1573 | * @return bool |
1574 | */ | |
00be9182 | 1575 | public static function giveMeAllACLs() { |
6a488035 TO |
1576 | if (CRM_Core_Permission::check('view all contacts') || |
1577 | CRM_Core_Permission::check('edit all contacts') | |
1578 | ) { | |
1579 | return TRUE; | |
1580 | } | |
1581 | ||
1582 | $session = CRM_Core_Session::singleton(); | |
1583 | $contactID = $session->get('userID'); | |
1584 | ||
6a488035 TO |
1585 | //check for acl. |
1586 | $aclPermission = self::getPermission(); | |
be2fb01f | 1587 | if (in_array($aclPermission, [ |
6a488035 | 1588 | CRM_Core_Permission::EDIT, |
41f314b6 | 1589 | CRM_Core_Permission::VIEW, |
be2fb01f | 1590 | ]) |
41f314b6 | 1591 | ) { |
6a488035 TO |
1592 | return TRUE; |
1593 | } | |
1594 | ||
1595 | // run acl where hook and see if the user is supplying an ACL clause | |
1596 | // that is not false | |
be2fb01f | 1597 | $tables = $whereTables = []; |
6a488035 TO |
1598 | $where = NULL; |
1599 | ||
1600 | CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW, | |
1601 | $tables, $whereTables, | |
1602 | $contactID, $where | |
1603 | ); | |
1604 | return empty($whereTables) ? FALSE : TRUE; | |
1605 | } | |
1606 | ||
1607 | /** | |
100fef9d | 1608 | * Get component name from given permission. |
6a488035 | 1609 | * |
41f314b6 | 1610 | * @param string $permission |
6a488035 | 1611 | * |
76e7a76c CW |
1612 | * @return null|string |
1613 | * the name of component. | |
6a488035 | 1614 | */ |
00be9182 | 1615 | public static function getComponentName($permission) { |
6a488035 TO |
1616 | $componentName = NULL; |
1617 | $permission = trim($permission); | |
1618 | if (empty($permission)) { | |
1619 | return $componentName; | |
1620 | } | |
1621 | ||
be2fb01f | 1622 | static $allCompPermissions = []; |
6a488035 TO |
1623 | if (empty($allCompPermissions)) { |
1624 | $components = CRM_Core_Component::getComponents(); | |
1625 | foreach ($components as $name => $comp) { | |
33777e4a PJ |
1626 | //get all permissions of each components unconditionally |
1627 | $allCompPermissions[$name] = $comp->getPermissions(TRUE); | |
6a488035 TO |
1628 | } |
1629 | } | |
1630 | ||
1631 | if (is_array($allCompPermissions)) { | |
1632 | foreach ($allCompPermissions as $name => $permissions) { | |
b9021475 | 1633 | if (array_key_exists($permission, $permissions)) { |
6a488035 TO |
1634 | $componentName = $name; |
1635 | break; | |
1636 | } | |
1637 | } | |
1638 | } | |
1639 | ||
1640 | return $componentName; | |
1641 | } | |
1642 | ||
1643 | /** | |
d09edf64 | 1644 | * Get all the contact emails for users that have a specific permission. |
6a488035 | 1645 | * |
6a0b768e TO |
1646 | * @param string $permissionName |
1647 | * Name of the permission we are interested in. | |
6a488035 | 1648 | * |
a6c01b45 CW |
1649 | * @return string |
1650 | * a comma separated list of email addresses | |
6a488035 TO |
1651 | */ |
1652 | public static function permissionEmails($permissionName) { | |
1653 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 1654 | return $config->userPermissionClass->permissionEmails($permissionName); |
6a488035 TO |
1655 | } |
1656 | ||
1657 | /** | |
d09edf64 | 1658 | * Get all the contact emails for users that have a specific role. |
6a488035 | 1659 | * |
6a0b768e TO |
1660 | * @param string $roleName |
1661 | * Name of the role we are interested in. | |
6a488035 | 1662 | * |
a6c01b45 CW |
1663 | * @return string |
1664 | * a comma separated list of email addresses | |
6a488035 TO |
1665 | */ |
1666 | public static function roleEmails($roleName) { | |
1667 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 1668 | return $config->userRoleClass->roleEmails($roleName); |
6a488035 TO |
1669 | } |
1670 | ||
a0ee3941 EM |
1671 | /** |
1672 | * @return bool | |
1673 | */ | |
00be9182 | 1674 | public static function isMultisiteEnabled() { |
63d76404 | 1675 | return (bool) Civi::settings()->get('is_enabled'); |
6a488035 | 1676 | } |
96025800 | 1677 | |
dc6b437a GC |
1678 | /** |
1679 | * Verify if the user has permission to get the invoice. | |
1680 | * | |
1681 | * @return bool | |
1682 | * TRUE if the user has download all invoices permission or download my | |
1683 | * invoices permission and the invoice author is the current user. | |
1684 | */ | |
1685 | public static function checkDownloadInvoice() { | |
4cfd4f45 | 1686 | $cid = CRM_Core_Session::getLoggedInContactID(); |
dc6b437a GC |
1687 | if (CRM_Core_Permission::check('access CiviContribute') || |
1688 | (CRM_Core_Permission::check('view my invoices') && $_GET['cid'] == $cid) | |
1689 | ) { | |
1690 | return TRUE; | |
1691 | } | |
1692 | return FALSE; | |
1693 | } | |
1694 | ||
b4d6a411 | 1695 | /** |
d2b6eac8 | 1696 | * Get permissions for components. |
1697 | * | |
b4d6a411 | 1698 | * @param bool $includeDisabled |
1699 | * | |
1700 | * @return array | |
1701 | * @throws \CRM_Core_Exception | |
1702 | */ | |
1703 | protected static function getComponentPermissions(bool $includeDisabled): array { | |
1704 | if (!$includeDisabled) { | |
1705 | $components = CRM_Core_Component::getEnabledComponents(); | |
1706 | } | |
1707 | else { | |
1708 | $components = CRM_Core_Component::getComponents(); | |
1709 | } | |
1710 | ||
1711 | $permissions = []; | |
1712 | foreach ($components as $comp) { | |
1713 | $perm = $comp->getPermissions($includeDisabled, TRUE); | |
1714 | if ($perm) { | |
1715 | $info = $comp->getInfo(); | |
1716 | foreach ($perm as $p => $attr) { | |
1717 | ||
1718 | if (!is_array($attr)) { | |
1719 | $attr = [$attr]; | |
1720 | } | |
1721 | ||
1722 | $attr[0] = $info['translatedName'] . ': ' . $attr[0]; | |
1723 | $permissions[$p] = $attr; | |
1724 | } | |
1725 | } | |
1726 | } | |
1727 | return $permissions; | |
1728 | } | |
1729 | ||
d2b6eac8 | 1730 | /** |
1731 | * Get permissions for core functionality and for that of core components. | |
1732 | * | |
1733 | * @param bool $all | |
1734 | * | |
1735 | * @return array | |
1736 | * @throws \CRM_Core_Exception | |
1737 | */ | |
1738 | protected static function getCoreAndComponentPermissions(bool $all): array { | |
1739 | $permissions = self::getCorePermissions(); | |
1740 | $permissions = array_merge($permissions, self::getComponentPermissions($all)); | |
ea54c6e5 | 1741 | $permissions['all CiviCRM permissions and ACLs']['implied_permissions'] = array_keys($permissions); |
d2b6eac8 | 1742 | return $permissions; |
1743 | } | |
1744 | ||
6a488035 | 1745 | } |