Commit | Line | Data |
---|---|---|
6a488035 TO |
1 | <?php |
2 | /* | |
3 | +--------------------------------------------------------------------+ | |
bc77d7c0 | 4 | | Copyright CiviCRM LLC. All rights reserved. | |
6a488035 | 5 | | | |
bc77d7c0 TO |
6 | | This work is published under the GNU AGPLv3 license with some | |
7 | | permitted exceptions and without any warranty. For full license | | |
8 | | and copyright information, see https://civicrm.org/licensing | | |
6a488035 | 9 | +--------------------------------------------------------------------+ |
d25dd0ee | 10 | */ |
6a488035 TO |
11 | |
12 | /** | |
13 | * | |
14 | * @package CRM | |
ca5cec67 | 15 | * @copyright CiviCRM LLC https://civicrm.org/licensing |
6a488035 TO |
16 | */ |
17 | ||
18 | /** | |
19 | * This is the basic permission class wrapper | |
20 | */ | |
21 | class CRM_Core_Permission { | |
22 | ||
23 | /** | |
d09edf64 | 24 | * Static strings used to compose permissions. |
6a488035 TO |
25 | * |
26 | * @const | |
27 | * @var string | |
28 | */ | |
7da04cde | 29 | const EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in '; |
6a488035 TO |
30 | |
31 | /** | |
d09edf64 | 32 | * The various type of permissions. |
6a488035 TO |
33 | * |
34 | * @var int | |
35 | */ | |
7da04cde | 36 | const EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7; |
6a488035 | 37 | |
085823c1 | 38 | /** |
d09edf64 | 39 | * A placeholder permission which always fails. |
085823c1 TO |
40 | */ |
41 | const ALWAYS_DENY_PERMISSION = "*always deny*"; | |
42 | ||
43 | /** | |
d09edf64 | 44 | * A placeholder permission which always fails. |
085823c1 TO |
45 | */ |
46 | const ALWAYS_ALLOW_PERMISSION = "*always allow*"; | |
47 | ||
6dd18b98 | 48 | /** |
d09edf64 | 49 | * Various authentication sources. |
6dd18b98 DS |
50 | * |
51 | * @var int | |
52 | */ | |
7da04cde | 53 | const AUTH_SRC_UNKNOWN = 0, AUTH_SRC_CHECKSUM = 1, AUTH_SRC_SITEKEY = 2, AUTH_SRC_LOGIN = 4; |
6dd18b98 | 54 | |
6a488035 | 55 | /** |
d09edf64 | 56 | * Get the current permission of this user. |
6a488035 | 57 | * |
a6c01b45 CW |
58 | * @return string |
59 | * the permission of the user (edit or view or null) | |
6a488035 TO |
60 | */ |
61 | public static function getPermission() { | |
62 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 63 | return $config->userPermissionClass->getPermission(); |
6a488035 TO |
64 | } |
65 | ||
66 | /** | |
100fef9d | 67 | * Given a permission string or array, check for access requirements |
6a488035 | 68 | * |
9b61e85d CW |
69 | * Ex 1: Must have 'access CiviCRM' |
70 | * (string) 'access CiviCRM' | |
60ec9f43 | 71 | * |
9b61e85d CW |
72 | * Ex 2: Must have 'access CiviCRM' and 'access Ajax API' |
73 | * ['access CiviCRM', 'access Ajax API'] | |
60ec9f43 | 74 | * |
9b61e85d CW |
75 | * Ex 3: Must have 'access CiviCRM' or 'access Ajax API' |
76 | * [ | |
77 | * ['access CiviCRM', 'access Ajax API'], | |
78 | * ], | |
60ec9f43 | 79 | * |
9b61e85d CW |
80 | * Ex 4: Must have 'access CiviCRM' or 'access Ajax API' AND 'access CiviEvent' |
81 | * [ | |
82 | * ['access CiviCRM', 'access Ajax API'], | |
83 | * 'access CiviEvent', | |
84 | * ], | |
60ec9f43 | 85 | * |
9b61e85d CW |
86 | * Note that in permissions.php this is keyed by the action eg. |
87 | * (access Civi || access AJAX) && (access CiviEvent || access CiviContribute) | |
88 | * 'myaction' => [ | |
89 | * ['access CiviCRM', 'access Ajax API'], | |
90 | * ['access CiviEvent', 'access CiviContribute'] | |
91 | * ], | |
60ec9f43 | 92 | * |
9b61e85d CW |
93 | * @param string|array $permissions |
94 | * The permission to check as an array or string -see examples. | |
60ec9f43 | 95 | * |
9b61e85d CW |
96 | * @param int $contactId |
97 | * Contact id to check permissions for. Defaults to current logged-in user. | |
6a488035 | 98 | * |
acb1052e | 99 | * @return bool |
9b61e85d | 100 | * true if contact has permission(s), else false |
6a488035 | 101 | */ |
18be3201 | 102 | public static function check($permissions, $contactId = NULL) { |
60ec9f43 | 103 | $permissions = (array) $permissions; |
9b61e85d | 104 | $userId = CRM_Core_BAO_UFMatch::getUFId($contactId); |
60ec9f43 | 105 | |
18be3201 | 106 | /** @var CRM_Core_Permission_Temp $tempPerm */ |
59735506 TO |
107 | $tempPerm = CRM_Core_Config::singleton()->userPermissionTemp; |
108 | ||
60ec9f43 | 109 | foreach ($permissions as $permission) { |
22e263ad | 110 | if (is_array($permission)) { |
60ec9f43 | 111 | foreach ($permission as $orPerm) { |
18be3201 | 112 | if (self::check($orPerm, $contactId)) { |
60ec9f43 | 113 | //one of our 'or' permissions has succeeded - stop checking this permission |
b8a19656 | 114 | return TRUE; |
60ec9f43 E |
115 | } |
116 | } | |
117 | //none of our our conditions was met | |
118 | return FALSE; | |
119 | } | |
120 | else { | |
3ae62cab | 121 | // This is an individual permission |
755a1835 | 122 | $impliedPermissions = self::getImpliedPermissionsFor($permission); |
123 | $impliedPermissions[] = $permission; | |
124 | foreach ($impliedPermissions as $permissionOption) { | |
125 | $granted = CRM_Core_Config::singleton()->userPermissionClass->check($permissionOption, $userId); | |
126 | // Call the permission_check hook to permit dynamic escalation (CRM-19256) | |
127 | CRM_Utils_Hook::permission_check($permissionOption, $granted, $contactId); | |
128 | if ($granted) { | |
129 | break; | |
130 | } | |
131 | } | |
132 | ||
59735506 | 133 | if ( |
3ae62cab | 134 | !$granted |
59735506 TO |
135 | && !($tempPerm && $tempPerm->check($permission)) |
136 | ) { | |
60ec9f43 E |
137 | //one of our 'and' conditions has not been met |
138 | return FALSE; | |
139 | } | |
140 | } | |
141 | } | |
142 | return TRUE; | |
6a488035 TO |
143 | } |
144 | ||
dc92f2f8 | 145 | /** |
d09edf64 | 146 | * Determine if any one of the permissions strings applies to current user. |
dc92f2f8 TO |
147 | * |
148 | * @param array $perms | |
149 | * @return bool | |
150 | */ | |
151 | public static function checkAnyPerm($perms) { | |
152 | foreach ($perms as $perm) { | |
153 | if (CRM_Core_Permission::check($perm)) { | |
154 | return TRUE; | |
155 | } | |
156 | } | |
157 | return FALSE; | |
158 | } | |
159 | ||
6a488035 TO |
160 | /** |
161 | * Given a group/role array, check for access requirements | |
162 | * | |
6a0b768e TO |
163 | * @param array $array |
164 | * The group/role to check. | |
6a488035 | 165 | * |
acb1052e | 166 | * @return bool |
a6c01b45 | 167 | * true if yes, else false |
6a488035 | 168 | */ |
00be9182 | 169 | public static function checkGroupRole($array) { |
6a488035 | 170 | $config = CRM_Core_Config::singleton(); |
41f314b6 | 171 | return $config->userPermissionClass->checkGroupRole($array); |
6a488035 TO |
172 | } |
173 | ||
174 | /** | |
d09edf64 | 175 | * Get the permissioned where clause for the user. |
6a488035 | 176 | * |
6a0b768e TO |
177 | * @param int $type |
178 | * The type of permission needed. | |
179 | * @param array $tables | |
180 | * (reference ) add the tables that are needed for the select clause. | |
181 | * @param array $whereTables | |
182 | * (reference ) add the tables that are needed for the where clause. | |
6a488035 | 183 | * |
a6c01b45 CW |
184 | * @return string |
185 | * the group where clause for this user | |
6a488035 TO |
186 | */ |
187 | public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) { | |
188 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 189 | return $config->userPermissionClass->getPermissionedStaticGroupClause($type, $tables, $whereTables); |
6a488035 TO |
190 | } |
191 | ||
192 | /** | |
193 | * Get all groups from database, filtered by permissions | |
194 | * for this user | |
195 | * | |
6a0b768e TO |
196 | * @param string $groupType |
197 | * Type of group(Access/Mailing). | |
3f8d2862 CW |
198 | * @param bool $excludeHidden |
199 | * exclude hidden groups. | |
6a488035 | 200 | * |
6a488035 | 201 | * |
a6c01b45 CW |
202 | * @return array |
203 | * array reference of all groups. | |
6a488035 TO |
204 | */ |
205 | public static function group($groupType, $excludeHidden = TRUE) { | |
206 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 207 | return $config->userPermissionClass->group($groupType, $excludeHidden); |
6a488035 TO |
208 | } |
209 | ||
a0ee3941 EM |
210 | /** |
211 | * @return bool | |
212 | */ | |
6a488035 TO |
213 | public static function customGroupAdmin() { |
214 | $admin = FALSE; | |
215 | ||
216 | // check if user has all powerful permission | |
217 | // or administer civicrm permission (CRM-1905) | |
218 | if (self::check('access all custom data')) { | |
219 | return TRUE; | |
220 | } | |
221 | ||
634e1a1a DL |
222 | if ( |
223 | self::check('administer Multiple Organizations') && | |
6a488035 TO |
224 | self::isMultisiteEnabled() |
225 | ) { | |
226 | return TRUE; | |
227 | } | |
228 | ||
229 | if (self::check('administer CiviCRM')) { | |
230 | return TRUE; | |
231 | } | |
232 | ||
233 | return FALSE; | |
234 | } | |
235 | ||
a0ee3941 EM |
236 | /** |
237 | * @param int $type | |
238 | * @param bool $reset | |
239 | * | |
240 | * @return array | |
241 | */ | |
6a488035 | 242 | public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) { |
41f314b6 | 243 | $customGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_CustomField', 'custom_group_id', |
be2fb01f CW |
244 | ['fresh' => $reset]); |
245 | $defaultGroups = []; | |
6a488035 TO |
246 | |
247 | // check if user has all powerful permission | |
248 | // or administer civicrm permission (CRM-1905) | |
249 | if (self::customGroupAdmin()) { | |
250 | $defaultGroups = array_keys($customGroups); | |
251 | } | |
252 | ||
253 | return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups); | |
254 | } | |
255 | ||
a0ee3941 EM |
256 | /** |
257 | * @param int $type | |
258 | * @param null $prefix | |
259 | * @param bool $reset | |
260 | * | |
261 | * @return string | |
262 | */ | |
00be9182 | 263 | public static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) { |
6a488035 TO |
264 | if (self::customGroupAdmin()) { |
265 | return ' ( 1 ) '; | |
266 | } | |
267 | ||
268 | $groups = self::customGroup($type, $reset); | |
269 | if (empty($groups)) { | |
270 | return ' ( 0 ) '; | |
271 | } | |
272 | else { | |
273 | return "{$prefix}id IN ( " . implode(',', $groups) . ' ) '; | |
274 | } | |
275 | } | |
276 | ||
a0ee3941 | 277 | /** |
100fef9d | 278 | * @param int $gid |
a0ee3941 EM |
279 | * @param int $type |
280 | * | |
281 | * @return bool | |
282 | */ | |
6a488035 TO |
283 | public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) { |
284 | if (empty($gid)) { | |
285 | return TRUE; | |
286 | } | |
287 | ||
288 | $groups = self::ufGroup($type); | |
63d76404 | 289 | return !empty($groups) && in_array($gid, $groups); |
6a488035 TO |
290 | } |
291 | ||
a0ee3941 EM |
292 | /** |
293 | * @param int $type | |
294 | * | |
295 | * @return array | |
296 | */ | |
6a488035 | 297 | public static function ufGroup($type = CRM_Core_Permission::VIEW) { |
ff4f7744 | 298 | $ufGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_UFField', 'uf_group_id'); |
6a488035 TO |
299 | |
300 | $allGroups = array_keys($ufGroups); | |
301 | ||
302 | // check if user has all powerful permission | |
303 | if (self::check('profile listings and forms')) { | |
304 | return $allGroups; | |
305 | } | |
306 | ||
307 | switch ($type) { | |
308 | case CRM_Core_Permission::VIEW: | |
309 | if (self::check('profile view')) { | |
310 | return $allGroups; | |
311 | } | |
312 | break; | |
313 | ||
314 | case CRM_Core_Permission::CREATE: | |
315 | if (self::check('profile create')) { | |
316 | return $allGroups; | |
317 | } | |
318 | break; | |
319 | ||
320 | case CRM_Core_Permission::EDIT: | |
321 | if (self::check('profile edit')) { | |
322 | return $allGroups; | |
323 | } | |
324 | break; | |
325 | ||
326 | case CRM_Core_Permission::SEARCH: | |
327 | if (self::check('profile listings')) { | |
328 | return $allGroups; | |
329 | } | |
330 | break; | |
331 | } | |
332 | ||
333 | return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups); | |
334 | } | |
335 | ||
a0ee3941 EM |
336 | /** |
337 | * @param int $type | |
338 | * @param null $prefix | |
339 | * @param bool $returnUFGroupIds | |
340 | * | |
341 | * @return array|string | |
342 | */ | |
00be9182 | 343 | public static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) { |
6a488035 TO |
344 | $groups = self::ufGroup($type); |
345 | if ($returnUFGroupIds) { | |
346 | return $groups; | |
347 | } | |
348 | elseif (empty($groups)) { | |
349 | return ' ( 0 ) '; | |
350 | } | |
351 | else { | |
352 | return "{$prefix}id IN ( " . implode(',', $groups) . ' ) '; | |
353 | } | |
354 | } | |
355 | ||
a0ee3941 EM |
356 | /** |
357 | * @param int $type | |
100fef9d | 358 | * @param int $eventID |
a0ee3941 EM |
359 | * @param string $context |
360 | * | |
361 | * @return array|null | |
362 | */ | |
e2d09ab4 | 363 | public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL, $context = '') { |
22e263ad TO |
364 | if (!empty($context)) { |
365 | if (CRM_Core_Permission::check($context)) { | |
e2d09ab4 EM |
366 | return TRUE; |
367 | } | |
368 | } | |
6a488035 | 369 | $events = CRM_Event_PseudoConstant::event(NULL, TRUE); |
be2fb01f | 370 | $includeEvents = []; |
6a488035 TO |
371 | |
372 | // check if user has all powerful permission | |
373 | if (self::check('register for events')) { | |
374 | $includeEvents = array_keys($events); | |
375 | } | |
376 | ||
377 | if ($type == CRM_Core_Permission::VIEW && | |
378 | self::check('view event info') | |
379 | ) { | |
380 | $includeEvents = array_keys($events); | |
381 | } | |
382 | ||
383 | $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents); | |
384 | if (!$eventID) { | |
385 | return $permissionedEvents; | |
386 | } | |
41f314b6 | 387 | if (!empty($permissionedEvents)) { |
2efcf0c2 | 388 | return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID; |
41f314b6 | 389 | } |
dfa720e7 | 390 | return NULL; |
6a488035 TO |
391 | } |
392 | ||
a0ee3941 EM |
393 | /** |
394 | * @param int $type | |
395 | * @param null $prefix | |
396 | * | |
397 | * @return string | |
398 | */ | |
00be9182 | 399 | public static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) { |
6a488035 TO |
400 | $events = self::event($type); |
401 | if (empty($events)) { | |
402 | return ' ( 0 ) '; | |
403 | } | |
404 | else { | |
405 | return "{$prefix}id IN ( " . implode(',', $events) . ' ) '; | |
406 | } | |
407 | } | |
408 | ||
a0ee3941 | 409 | /** |
44d17ec8 BS |
410 | * Checks that component is enabled and optionally that user has basic perm. |
411 | * | |
412 | * @param string $module | |
413 | * Specifies the name of the CiviCRM component. | |
a0ee3941 | 414 | * @param bool $checkPermission |
44d17ec8 BS |
415 | * Check not only that module is enabled, but that user has necessary |
416 | * permission. | |
417 | * @param bool $requireAllCasesPermOnCiviCase | |
418 | * Significant only if $module == CiviCase | |
419 | * Require "access all cases and activities", not just | |
420 | * "access my cases and activities". | |
a0ee3941 EM |
421 | * |
422 | * @return bool | |
44d17ec8 | 423 | * Access to specified $module is granted. |
a0ee3941 | 424 | */ |
44d17ec8 | 425 | public static function access($module, $checkPermission = TRUE, $requireAllCasesPermOnCiviCase = FALSE) { |
6a488035 TO |
426 | $config = CRM_Core_Config::singleton(); |
427 | ||
428 | if (!in_array($module, $config->enableComponents)) { | |
429 | return FALSE; | |
430 | } | |
431 | ||
432 | if ($checkPermission) { | |
44d17ec8 BS |
433 | switch ($module) { |
434 | case 'CiviCase': | |
435 | $access_all_cases = CRM_Core_Permission::check("access all cases and activities"); | |
436 | $access_my_cases = CRM_Core_Permission::check("access my cases and activities"); | |
437 | return $access_all_cases || (!$requireAllCasesPermOnCiviCase && $access_my_cases); | |
438 | ||
439 | case 'CiviCampaign': | |
440 | return CRM_Core_Permission::check("administer $module"); | |
441 | ||
442 | default: | |
443 | return CRM_Core_Permission::check("access $module"); | |
6a488035 TO |
444 | } |
445 | } | |
446 | ||
447 | return TRUE; | |
448 | } | |
449 | ||
450 | /** | |
d09edf64 | 451 | * Check permissions for delete and edit actions. |
6a488035 | 452 | * |
6a0b768e TO |
453 | * @param string $module |
454 | * Component name. | |
455 | * @param int $action | |
456 | * Action to be check across component. | |
6a488035 | 457 | * |
77b97be7 EM |
458 | * |
459 | * @return bool | |
460 | */ | |
00be9182 | 461 | public static function checkActionPermission($module, $action) { |
6a488035 TO |
462 | //check delete related permissions. |
463 | if ($action & CRM_Core_Action::DELETE) { | |
464 | $permissionName = "delete in $module"; | |
465 | } | |
466 | else { | |
be2fb01f | 467 | $editPermissions = [ |
6a488035 TO |
468 | 'CiviEvent' => 'edit event participants', |
469 | 'CiviMember' => 'edit memberships', | |
470 | 'CiviPledge' => 'edit pledges', | |
471 | 'CiviContribute' => 'edit contributions', | |
472 | 'CiviGrant' => 'edit grants', | |
473 | 'CiviMail' => 'access CiviMail', | |
474 | 'CiviAuction' => 'add auction items', | |
be2fb01f | 475 | ]; |
9c1bc317 | 476 | $permissionName = $editPermissions[$module] ?? NULL; |
6a488035 TO |
477 | } |
478 | ||
479 | if ($module == 'CiviCase' && !$permissionName) { | |
480 | return CRM_Case_BAO_Case::accessCiviCase(); | |
481 | } | |
482 | else { | |
483 | //check for permission. | |
484 | return CRM_Core_Permission::check($permissionName); | |
485 | } | |
486 | } | |
487 | ||
a0ee3941 EM |
488 | /** |
489 | * @param $args | |
490 | * @param string $op | |
491 | * | |
492 | * @return bool | |
493 | */ | |
00be9182 | 494 | public static function checkMenu(&$args, $op = 'and') { |
6a488035 TO |
495 | if (!is_array($args)) { |
496 | return $args; | |
497 | } | |
498 | foreach ($args as $str) { | |
499 | $res = CRM_Core_Permission::check($str); | |
500 | if ($op == 'or' && $res) { | |
501 | return TRUE; | |
502 | } | |
503 | elseif ($op == 'and' && !$res) { | |
504 | return FALSE; | |
505 | } | |
506 | } | |
507 | return ($op == 'or') ? FALSE : TRUE; | |
508 | } | |
509 | ||
a0ee3941 EM |
510 | /** |
511 | * @param $item | |
512 | * | |
513 | * @return bool|mixed | |
514 | * @throws Exception | |
515 | */ | |
00be9182 | 516 | public static function checkMenuItem(&$item) { |
6a488035 TO |
517 | if (!array_key_exists('access_callback', $item)) { |
518 | CRM_Core_Error::backtrace(); | |
79e11805 | 519 | throw new CRM_Core_Exception('Missing Access Callback key in menu item'); |
6a488035 TO |
520 | } |
521 | ||
522 | // if component_id is present, ensure it is enabled | |
3d31a5c6 TO |
523 | if (isset($item['component_id']) && $item['component_id']) { |
524 | if (!isset(Civi::$statics[__CLASS__]['componentNameId'])) { | |
525 | Civi::$statics[__CLASS__]['componentNameId'] = array_flip(CRM_Core_Component::getComponentIDs()); | |
526 | } | |
527 | $componentName = Civi::$statics[__CLASS__]['componentNameId'][$item['component_id']]; | |
528 | ||
6a488035 | 529 | $config = CRM_Core_Config::singleton(); |
3d31a5c6 | 530 | if (is_array($config->enableComponents) && in_array($componentName, $config->enableComponents)) { |
6a488035 TO |
531 | // continue with process |
532 | } | |
533 | else { | |
534 | return FALSE; | |
535 | } | |
536 | } | |
537 | ||
538 | // the following is imitating drupal 6 code in includes/menu.inc | |
539 | if (empty($item['access_callback']) || | |
540 | is_numeric($item['access_callback']) | |
541 | ) { | |
596a8bdf | 542 | return (bool) $item['access_callback']; |
6a488035 TO |
543 | } |
544 | ||
545 | // check whether the following Ajax requests submitted the right key | |
546 | // FIXME: this should be integrated into ACLs proper | |
547 | if (CRM_Utils_Array::value('page_type', $item) == 3) { | |
548 | if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) { | |
549 | return FALSE; | |
550 | } | |
551 | } | |
552 | ||
553 | // check if callback is for checkMenu, if so optimize it | |
554 | if (is_array($item['access_callback']) && | |
555 | $item['access_callback'][0] == 'CRM_Core_Permission' && | |
556 | $item['access_callback'][1] == 'checkMenu' | |
557 | ) { | |
558 | $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and'); | |
559 | return self::checkMenu($item['access_arguments'][0], $op); | |
560 | } | |
561 | else { | |
562 | return call_user_func_array($item['access_callback'], $item['access_arguments']); | |
563 | } | |
564 | } | |
565 | ||
a0ee3941 EM |
566 | /** |
567 | * @param bool $all | |
9476d8d1 | 568 | * Include disabled components |
221b21b4 | 569 | * @param bool $descriptions |
9476d8d1 | 570 | * Whether to return descriptions |
a0ee3941 EM |
571 | * |
572 | * @return array | |
573 | */ | |
9476d8d1 | 574 | public static function basicPermissions($all = FALSE, $descriptions = FALSE) { |
be2fb01f | 575 | $cacheKey = implode('-', [$all, $descriptions]); |
9476d8d1 CW |
576 | if (empty(Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey])) { |
577 | Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey] = self::assembleBasicPermissions($all, $descriptions); | |
221b21b4 | 578 | } |
9476d8d1 | 579 | return Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey]; |
221b21b4 AH |
580 | } |
581 | ||
582 | /** | |
583 | * @param bool $all | |
584 | * @param bool $descriptions | |
585 | * whether to return descriptions | |
586 | * | |
587 | * @return array | |
d2b6eac8 | 588 | * @throws \CRM_Core_Exception |
221b21b4 | 589 | */ |
d2b6eac8 | 590 | public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE): array { |
591 | $permissions = self::getCoreAndComponentPermissions($all); | |
221b21b4 | 592 | |
b4d6a411 | 593 | // Add any permissions defined in hook_civicrm_permission implementations. |
d2b6eac8 | 594 | $module_permissions = CRM_Core_Config::singleton()->userPermissionClass->getAllModulePermissions(TRUE); |
b4d6a411 | 595 | $permissions = array_merge($permissions, $module_permissions); |
8c282315 | 596 | if (!$descriptions) { |
597 | foreach ($permissions as $name => $attr) { | |
598 | $permissions[$name] = array_shift($attr); | |
599 | } | |
600 | } | |
6a488035 TO |
601 | return $permissions; |
602 | } | |
603 | ||
a0ee3941 EM |
604 | /** |
605 | * @return array | |
606 | */ | |
00be9182 | 607 | public static function getAnonymousPermissionsWarnings() { |
be2fb01f | 608 | static $permissions = []; |
81bb85ea | 609 | if (empty($permissions)) { |
be2fb01f | 610 | $permissions = [ |
21dfd5f5 | 611 | 'administer CiviCRM', |
be2fb01f | 612 | ]; |
81bb85ea AC |
613 | $components = CRM_Core_Component::getComponents(); |
614 | foreach ($components as $comp) { | |
615 | if (!method_exists($comp, 'getAnonymousPermissionWarnings')) { | |
616 | continue; | |
617 | } | |
618 | $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings()); | |
619 | } | |
620 | } | |
621 | return $permissions; | |
622 | } | |
623 | ||
a0ee3941 EM |
624 | /** |
625 | * @param $anonymous_perms | |
626 | * | |
627 | * @return array | |
628 | */ | |
00be9182 | 629 | public static function validateForPermissionWarnings($anonymous_perms) { |
81bb85ea AC |
630 | return array_intersect($anonymous_perms, self::getAnonymousPermissionsWarnings()); |
631 | } | |
632 | ||
a0ee3941 | 633 | /** |
6793d6a9 | 634 | * Get core permissions. |
221b21b4 | 635 | * |
a0ee3941 EM |
636 | * @return array |
637 | */ | |
8c282315 | 638 | public static function getCorePermissions() { |
6a488035 | 639 | $prefix = ts('CiviCRM') . ': '; |
be2fb01f CW |
640 | $permissions = [ |
641 | 'add contacts' => [ | |
221b21b4 AH |
642 | $prefix . ts('add contacts'), |
643 | ts('Create a new contact record in CiviCRM'), | |
be2fb01f CW |
644 | ], |
645 | 'view all contacts' => [ | |
221b21b4 AH |
646 | $prefix . ts('view all contacts'), |
647 | ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'), | |
be2fb01f CW |
648 | ], |
649 | 'edit all contacts' => [ | |
221b21b4 AH |
650 | $prefix . ts('edit all contacts'), |
651 | ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'), | |
be2fb01f CW |
652 | ], |
653 | 'view my contact' => [ | |
221b21b4 | 654 | $prefix . ts('view my contact'), |
be2fb01f CW |
655 | ], |
656 | 'edit my contact' => [ | |
221b21b4 | 657 | $prefix . ts('edit my contact'), |
be2fb01f CW |
658 | ], |
659 | 'delete contacts' => [ | |
221b21b4 | 660 | $prefix . ts('delete contacts'), |
be2fb01f CW |
661 | ], |
662 | 'access deleted contacts' => [ | |
221b21b4 AH |
663 | $prefix . ts('access deleted contacts'), |
664 | ts('Access contacts in the trash'), | |
be2fb01f CW |
665 | ], |
666 | 'import contacts' => [ | |
221b21b4 AH |
667 | $prefix . ts('import contacts'), |
668 | ts('Import contacts and activities'), | |
be2fb01f CW |
669 | ], |
670 | 'import SQL datasource' => [ | |
40bc3c68 TO |
671 | $prefix . ts('import SQL datasource'), |
672 | ts('When importing, consume data directly from a SQL datasource'), | |
be2fb01f CW |
673 | ], |
674 | 'edit groups' => [ | |
221b21b4 AH |
675 | $prefix . ts('edit groups'), |
676 | ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'), | |
be2fb01f CW |
677 | ], |
678 | 'administer CiviCRM' => [ | |
221b21b4 AH |
679 | $prefix . ts('administer CiviCRM'), |
680 | ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'), | |
be2fb01f CW |
681 | ], |
682 | 'skip IDS check' => [ | |
221b21b4 | 683 | $prefix . ts('skip IDS check'), |
d9a37cbc | 684 | ts('Warning: Give to trusted roles only; this permission has security implications. IDS system is bypassed for users with this permission. Prevents false errors for admin users.'), |
be2fb01f CW |
685 | ], |
686 | 'access uploaded files' => [ | |
221b21b4 AH |
687 | $prefix . ts('access uploaded files'), |
688 | ts('View / download files including images and photos'), | |
be2fb01f CW |
689 | ], |
690 | 'profile listings and forms' => [ | |
221b21b4 | 691 | $prefix . ts('profile listings and forms'), |
d9a37cbc | 692 | ts('Warning: Give to trusted roles only; this permission has privacy implications. Add/edit data in online forms and access public searchable directories.'), |
be2fb01f CW |
693 | ], |
694 | 'profile listings' => [ | |
221b21b4 | 695 | $prefix . ts('profile listings'), |
d9a37cbc | 696 | ts('Warning: Give to trusted roles only; this permission has privacy implications. Access public searchable directories.'), |
be2fb01f CW |
697 | ], |
698 | 'profile create' => [ | |
221b21b4 | 699 | $prefix . ts('profile create'), |
d9a37cbc | 700 | ts('Add data in a profile form.'), |
be2fb01f CW |
701 | ], |
702 | 'profile edit' => [ | |
221b21b4 | 703 | $prefix . ts('profile edit'), |
d9a37cbc | 704 | ts('Edit data in a profile form.'), |
be2fb01f CW |
705 | ], |
706 | 'profile view' => [ | |
221b21b4 | 707 | $prefix . ts('profile view'), |
d9a37cbc | 708 | ts('View data in a profile.'), |
be2fb01f CW |
709 | ], |
710 | 'access all custom data' => [ | |
221b21b4 AH |
711 | $prefix . ts('access all custom data'), |
712 | ts('View all custom fields regardless of ACL rules'), | |
be2fb01f CW |
713 | ], |
714 | 'view all activities' => [ | |
221b21b4 AH |
715 | $prefix . ts('view all activities'), |
716 | ts('View all activities (for visible contacts)'), | |
be2fb01f CW |
717 | ], |
718 | 'delete activities' => [ | |
221b21b4 | 719 | $prefix . ts('Delete activities'), |
be2fb01f CW |
720 | ], |
721 | 'edit inbound email basic information' => [ | |
ee90a98c CR |
722 | $prefix . ts('edit inbound email basic information'), |
723 | ts('Edit all inbound email activities (for visible contacts) basic information. Content editing not allowed.'), | |
be2fb01f CW |
724 | ], |
725 | 'edit inbound email basic information and content' => [ | |
ee90a98c CR |
726 | $prefix . ts('edit inbound email basic information and content'), |
727 | ts('Edit all inbound email activities (for visible contacts) basic information and content.'), | |
be2fb01f CW |
728 | ], |
729 | 'access CiviCRM' => [ | |
d9a37cbc H |
730 | $prefix . ts('access CiviCRM backend and API'), |
731 | ts('Master control for access to the main CiviCRM backend and API. Give to trusted roles only.'), | |
be2fb01f CW |
732 | ], |
733 | 'access Contact Dashboard' => [ | |
221b21b4 AH |
734 | $prefix . ts('access Contact Dashboard'), |
735 | ts('View Contact Dashboard (for themselves and visible contacts)'), | |
be2fb01f CW |
736 | ], |
737 | 'translate CiviCRM' => [ | |
221b21b4 AH |
738 | $prefix . ts('translate CiviCRM'), |
739 | ts('Allow User to enable multilingual'), | |
be2fb01f CW |
740 | ], |
741 | 'manage tags' => [ | |
eaaaef83 I |
742 | $prefix . ts('manage tags'), |
743 | ts('Create and rename tags'), | |
be2fb01f CW |
744 | ], |
745 | 'administer reserved groups' => [ | |
221b21b4 AH |
746 | $prefix . ts('administer reserved groups'), |
747 | ts('Edit and disable Reserved Groups (Needs Edit Groups)'), | |
be2fb01f CW |
748 | ], |
749 | 'administer Tagsets' => [ | |
221b21b4 | 750 | $prefix . ts('administer Tagsets'), |
be2fb01f CW |
751 | ], |
752 | 'administer reserved tags' => [ | |
221b21b4 | 753 | $prefix . ts('administer reserved tags'), |
be2fb01f CW |
754 | ], |
755 | 'administer dedupe rules' => [ | |
221b21b4 AH |
756 | $prefix . ts('administer dedupe rules'), |
757 | ts('Create and edit rules, change the supervised and unsupervised rules'), | |
be2fb01f CW |
758 | ], |
759 | 'merge duplicate contacts' => [ | |
221b21b4 AH |
760 | $prefix . ts('merge duplicate contacts'), |
761 | ts('Delete Contacts must also be granted in order for this to work.'), | |
be2fb01f CW |
762 | ], |
763 | 'force merge duplicate contacts' => [ | |
fd630ef9 | 764 | $prefix . ts('force merge duplicate contacts'), |
765 | ts('Delete Contacts must also be granted in order for this to work.'), | |
be2fb01f CW |
766 | ], |
767 | 'view debug output' => [ | |
221b21b4 AH |
768 | $prefix . ts('view debug output'), |
769 | ts('View results of debug and backtrace'), | |
be2fb01f | 770 | ], |
02d451ab | 771 | |
be2fb01f | 772 | 'view all notes' => [ |
221b21b4 AH |
773 | $prefix . ts('view all notes'), |
774 | ts("View notes (for visible contacts) even if they're marked admin only"), | |
be2fb01f CW |
775 | ], |
776 | 'add contact notes' => [ | |
088101a4 O |
777 | $prefix . ts('add contact notes'), |
778 | ts("Create notes for contacts"), | |
be2fb01f CW |
779 | ], |
780 | 'access AJAX API' => [ | |
221b21b4 AH |
781 | $prefix . ts('access AJAX API'), |
782 | ts('Allow API access even if Access CiviCRM is not granted'), | |
be2fb01f CW |
783 | ], |
784 | 'access contact reference fields' => [ | |
221b21b4 AH |
785 | $prefix . ts('access contact reference fields'), |
786 | ts('Allow entering data into contact reference fields'), | |
be2fb01f CW |
787 | ], |
788 | 'create manual batch' => [ | |
221b21b4 AH |
789 | $prefix . ts('create manual batch'), |
790 | ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'), | |
be2fb01f CW |
791 | ], |
792 | 'edit own manual batches' => [ | |
221b21b4 AH |
793 | $prefix . ts('edit own manual batches'), |
794 | ts('Edit accounting batches created by user'), | |
be2fb01f CW |
795 | ], |
796 | 'edit all manual batches' => [ | |
221b21b4 AH |
797 | $prefix . ts('edit all manual batches'), |
798 | ts('Edit all accounting batches'), | |
be2fb01f CW |
799 | ], |
800 | 'close own manual batches' => [ | |
47a98aef | 801 | $prefix . ts('close own manual batches'), |
5ad18cc2 | 802 | ts('Close accounting batches created by user (with Access to CiviContribute)'), |
be2fb01f CW |
803 | ], |
804 | 'close all manual batches' => [ | |
47a98aef | 805 | $prefix . ts('close all manual batches'), |
5ad18cc2 | 806 | ts('Close all accounting batches (with Access to CiviContribute)'), |
be2fb01f CW |
807 | ], |
808 | 'reopen own manual batches' => [ | |
47a98aef | 809 | $prefix . ts('reopen own manual batches'), |
5ad18cc2 | 810 | ts('Reopen accounting batches created by user (with Access to CiviContribute)'), |
be2fb01f CW |
811 | ], |
812 | 'reopen all manual batches' => [ | |
47a98aef | 813 | $prefix . ts('reopen all manual batches'), |
5ad18cc2 | 814 | ts('Reopen all accounting batches (with Access to CiviContribute)'), |
be2fb01f CW |
815 | ], |
816 | 'view own manual batches' => [ | |
221b21b4 AH |
817 | $prefix . ts('view own manual batches'), |
818 | ts('View accounting batches created by user (with Access to CiviContribute)'), | |
be2fb01f CW |
819 | ], |
820 | 'view all manual batches' => [ | |
221b21b4 AH |
821 | $prefix . ts('view all manual batches'), |
822 | ts('View all accounting batches (with Access to CiviContribute)'), | |
be2fb01f CW |
823 | ], |
824 | 'delete own manual batches' => [ | |
221b21b4 AH |
825 | $prefix . ts('delete own manual batches'), |
826 | ts('Delete accounting batches created by user'), | |
be2fb01f CW |
827 | ], |
828 | 'delete all manual batches' => [ | |
221b21b4 AH |
829 | $prefix . ts('delete all manual batches'), |
830 | ts('Delete all accounting batches'), | |
be2fb01f CW |
831 | ], |
832 | 'export own manual batches' => [ | |
221b21b4 AH |
833 | $prefix . ts('export own manual batches'), |
834 | ts('Export accounting batches created by user'), | |
be2fb01f CW |
835 | ], |
836 | 'export all manual batches' => [ | |
221b21b4 AH |
837 | $prefix . ts('export all manual batches'), |
838 | ts('Export all accounting batches'), | |
be2fb01f CW |
839 | ], |
840 | 'administer payment processors' => [ | |
221b21b4 AH |
841 | $prefix . ts('administer payment processors'), |
842 | ts('Add, Update, or Disable Payment Processors'), | |
be2fb01f CW |
843 | ], |
844 | 'edit message templates' => [ | |
221b21b4 | 845 | $prefix . ts('edit message templates'), |
be2fb01f CW |
846 | ], |
847 | 'edit system workflow message templates' => [ | |
40a732a9 | 848 | $prefix . ts('edit system workflow message templates'), |
be2fb01f CW |
849 | ], |
850 | 'edit user-driven message templates' => [ | |
40a732a9 | 851 | $prefix . ts('edit user-driven message templates'), |
be2fb01f CW |
852 | ], |
853 | 'view my invoices' => [ | |
a664e7b3 | 854 | $prefix . ts('view my invoices'), |
dc6b437a | 855 | ts('Allow users to view/ download their own invoices'), |
be2fb01f CW |
856 | ], |
857 | 'edit api keys' => [ | |
d4463076 TO |
858 | $prefix . ts('edit api keys'), |
859 | ts('Edit API keys'), | |
be2fb01f CW |
860 | ], |
861 | 'edit own api keys' => [ | |
d4463076 TO |
862 | $prefix . ts('edit own api keys'), |
863 | ts('Edit user\'s own API keys'), | |
be2fb01f CW |
864 | ], |
865 | 'send SMS' => [ | |
63483feb MM |
866 | $prefix . ts('send SMS'), |
867 | ts('Send an SMS'), | |
be2fb01f | 868 | ], |
755a1835 | 869 | 'administer CiviCRM system' => [ |
870 | 'label' => $prefix . ts('administer CiviCRM System'), | |
4c85c7b6 | 871 | 'description' => ts('Perform all system administration tasks in CiviCRM'), |
755a1835 | 872 | ], |
873 | 'administer CiviCRM data' => [ | |
874 | 'label' => $prefix . ts('administer CiviCRM Data'), | |
4c85c7b6 | 875 | 'description' => ts('Permit altering all restricted data options'), |
755a1835 | 876 | ], |
be2fb01f | 877 | ]; |
ce6b4d9b | 878 | if (self::isMultisiteEnabled()) { |
879 | // This could arguably be moved to the multisite extension but | |
880 | // within core it does permit editing group-organization records. | |
881 | $permissions['administer Multiple Organizations'] = [ | |
882 | 'label' => $prefix . ts('administer Multiple Organizations'), | |
883 | 'description' => ts('Administer multiple organizations. In practice this allows editing the group organization link'), | |
884 | ]; | |
885 | } | |
755a1835 | 886 | foreach (self::getImpliedPermissions() as $name => $includes) { |
887 | foreach ($includes as $permission) { | |
888 | $permissions[$name][] = $permissions[$permission]; | |
889 | } | |
890 | } | |
6a488035 TO |
891 | return $permissions; |
892 | } | |
893 | ||
755a1835 | 894 | /** |
895 | * Get permissions implied by 'superset' permissions. | |
896 | * | |
897 | * @return array | |
898 | */ | |
899 | public static function getImpliedPermissions() { | |
900 | return [ | |
901 | 'administer CiviCRM' => ['administer CiviCRM system', 'administer CiviCRM data'], | |
902 | 'administer CiviCRM data' => ['edit message templates', 'administer dedupe rules'], | |
c424169e | 903 | 'administer CiviCRM system' => ['edit system workflow message templates'], |
755a1835 | 904 | ]; |
905 | } | |
906 | ||
907 | /** | |
908 | * Get any super-permissions that imply the given permission. | |
909 | * | |
910 | * @param string $permission | |
911 | * | |
912 | * @return array | |
913 | */ | |
914 | public static function getImpliedPermissionsFor(string $permission) { | |
915 | $return = []; | |
916 | foreach (self::getImpliedPermissions() as $superPermission => $components) { | |
917 | if (in_array($permission, $components, TRUE)) { | |
918 | $return[$superPermission] = $superPermission; | |
919 | } | |
920 | } | |
921 | return $return; | |
922 | } | |
923 | ||
bf9a7c0f ES |
924 | /** |
925 | * For each entity provides an array of permissions required for each action | |
926 | * | |
927 | * The action is the array key, possible values: | |
928 | * * create: applies to create (with no id in params) | |
929 | * * update: applies to update, setvalue, create (with id in params) | |
930 | * * get: applies to getcount, getsingle, getvalue and other gets | |
931 | * * delete: applies to delete, replace | |
932 | * * meta: applies to getfields, getoptions, getspec | |
933 | * * default: catch-all for anything not declared | |
934 | * | |
935 | * Note: some APIs declare other actions as well | |
936 | * | |
937 | * Permissions should use arrays for AND and arrays of arrays for OR | |
1a5a2ade | 938 | * @see CRM_Core_Permission::check |
bf9a7c0f ES |
939 | * |
940 | * @return array of permissions | |
941 | */ | |
942 | public static function getEntityActionPermissions() { | |
be2fb01f | 943 | $permissions = []; |
bf9a7c0f ES |
944 | // These are the default permissions - if any entity does not declare permissions for a given action, |
945 | // (or the entity does not declare permissions at all) - then the action will be used from here | |
be2fb01f | 946 | $permissions['default'] = [ |
bf9a7c0f | 947 | // applies to getfields, getoptions, etc. |
be2fb01f | 948 | 'meta' => ['access CiviCRM'], |
bf9a7c0f ES |
949 | // catch-all, applies to create, get, delete, etc. |
950 | // If an entity declares it's own 'default' action it will override this one | |
be2fb01f CW |
951 | 'default' => ['administer CiviCRM'], |
952 | ]; | |
bf9a7c0f ES |
953 | |
954 | // Note: Additional permissions in DynamicFKAuthorization | |
be2fb01f CW |
955 | $permissions['attachment'] = [ |
956 | 'default' => [ | |
957 | ['access CiviCRM', 'access AJAX API'], | |
958 | ], | |
959 | ]; | |
bf9a7c0f ES |
960 | |
961 | // Contact permissions | |
be2fb01f CW |
962 | $permissions['contact'] = [ |
963 | 'create' => [ | |
bf9a7c0f ES |
964 | 'access CiviCRM', |
965 | 'add contacts', | |
be2fb01f CW |
966 | ], |
967 | 'delete' => [ | |
bf9a7c0f ES |
968 | 'access CiviCRM', |
969 | 'delete contacts', | |
be2fb01f | 970 | ], |
bf9a7c0f | 971 | // managed by query object |
be2fb01f | 972 | 'get' => [], |
bf9a7c0f | 973 | // managed by _civicrm_api3_check_edit_permissions |
be2fb01f CW |
974 | 'update' => [], |
975 | 'getquick' => [ | |
976 | ['access CiviCRM', 'access AJAX API'], | |
977 | ], | |
978 | 'duplicatecheck' => [ | |
f257308b | 979 | 'access CiviCRM', |
be2fb01f | 980 | ], |
9f8c8b7a | 981 | 'merge' => ['merge duplicate contacts'], |
be2fb01f | 982 | ]; |
bf9a7c0f | 983 | |
cc477693 | 984 | $permissions['dedupe'] = [ |
985 | 'getduplicates' => ['access CiviCRM'], | |
3ea6ec7d | 986 | 'getstatistics' => ['access CiviCRM'], |
cc477693 | 987 | ]; |
988 | ||
bf9a7c0f | 989 | // CRM-16963 - Permissions for country. |
be2fb01f CW |
990 | $permissions['country'] = [ |
991 | 'get' => [ | |
bf9a7c0f | 992 | 'access CiviCRM', |
be2fb01f CW |
993 | ], |
994 | 'default' => [ | |
bf9a7c0f | 995 | 'administer CiviCRM', |
be2fb01f CW |
996 | ], |
997 | ]; | |
bf9a7c0f ES |
998 | |
999 | // Contact-related data permissions. | |
be2fb01f | 1000 | $permissions['address'] = [ |
bf9a7c0f ES |
1001 | // get is managed by BAO::addSelectWhereClause |
1002 | // create/delete are managed by _civicrm_api3_check_edit_permissions | |
be2fb01f CW |
1003 | 'default' => [], |
1004 | ]; | |
bf9a7c0f ES |
1005 | $permissions['email'] = $permissions['address']; |
1006 | $permissions['phone'] = $permissions['address']; | |
1007 | $permissions['website'] = $permissions['address']; | |
1008 | $permissions['im'] = $permissions['address']; | |
1009 | $permissions['open_i_d'] = $permissions['address']; | |
1010 | ||
1011 | // Also managed by ACLs - CRM-19448 | |
be2fb01f | 1012 | $permissions['entity_tag'] = ['default' => []]; |
bf9a7c0f ES |
1013 | $permissions['note'] = $permissions['entity_tag']; |
1014 | ||
1015 | // Allow non-admins to get and create tags to support tagset widget | |
1016 | // Delete is still reserved for admins | |
be2fb01f CW |
1017 | $permissions['tag'] = [ |
1018 | 'get' => ['access CiviCRM'], | |
1019 | 'create' => ['access CiviCRM'], | |
1020 | 'update' => ['access CiviCRM'], | |
1021 | ]; | |
bf9a7c0f ES |
1022 | |
1023 | //relationship permissions | |
be2fb01f | 1024 | $permissions['relationship'] = [ |
bf9a7c0f | 1025 | // get is managed by BAO::addSelectWhereClause |
be2fb01f CW |
1026 | 'get' => [], |
1027 | 'delete' => [ | |
bf9a7c0f ES |
1028 | 'access CiviCRM', |
1029 | 'edit all contacts', | |
be2fb01f CW |
1030 | ], |
1031 | 'default' => [ | |
bf9a7c0f ES |
1032 | 'access CiviCRM', |
1033 | 'edit all contacts', | |
be2fb01f CW |
1034 | ], |
1035 | ]; | |
bf9a7c0f ES |
1036 | |
1037 | // CRM-17741 - Permissions for RelationshipType. | |
be2fb01f CW |
1038 | $permissions['relationship_type'] = [ |
1039 | 'get' => [ | |
bf9a7c0f | 1040 | 'access CiviCRM', |
be2fb01f CW |
1041 | ], |
1042 | 'default' => [ | |
bf9a7c0f | 1043 | 'administer CiviCRM', |
be2fb01f CW |
1044 | ], |
1045 | ]; | |
bf9a7c0f ES |
1046 | |
1047 | // Activity permissions | |
be2fb01f CW |
1048 | $permissions['activity'] = [ |
1049 | 'delete' => [ | |
bf9a7c0f ES |
1050 | 'access CiviCRM', |
1051 | 'delete activities', | |
be2fb01f CW |
1052 | ], |
1053 | 'get' => [ | |
bf9a7c0f ES |
1054 | 'access CiviCRM', |
1055 | // Note that view all activities is also required within the api | |
1056 | // if the id is not passed in. Where the id is passed in the activity | |
1057 | // specific check functions are used and tested. | |
be2fb01f CW |
1058 | ], |
1059 | 'default' => [ | |
bf9a7c0f ES |
1060 | 'access CiviCRM', |
1061 | 'view all activities', | |
be2fb01f CW |
1062 | ], |
1063 | ]; | |
cdacd6ab | 1064 | $permissions['activity_contact'] = $permissions['activity']; |
bf9a7c0f ES |
1065 | |
1066 | // Case permissions | |
be2fb01f CW |
1067 | $permissions['case'] = [ |
1068 | 'create' => [ | |
bf9a7c0f ES |
1069 | 'access CiviCRM', |
1070 | 'add cases', | |
be2fb01f CW |
1071 | ], |
1072 | 'delete' => [ | |
bf9a7c0f ES |
1073 | 'access CiviCRM', |
1074 | 'delete in CiviCase', | |
be2fb01f CW |
1075 | ], |
1076 | 'restore' => [ | |
8572e6de | 1077 | 'administer CiviCase', |
be2fb01f CW |
1078 | ], |
1079 | 'merge' => [ | |
a6bc7218 | 1080 | 'administer CiviCase', |
be2fb01f CW |
1081 | ], |
1082 | 'default' => [ | |
bf9a7c0f | 1083 | // At minimum the user needs one of the following. Finer-grained access is controlled by CRM_Case_BAO_Case::addSelectWhereClause |
be2fb01f CW |
1084 | ['access my cases and activities', 'access all cases and activities'], |
1085 | ], | |
1086 | ]; | |
bf9a7c0f ES |
1087 | $permissions['case_contact'] = $permissions['case']; |
1088 | ||
be2fb01f CW |
1089 | $permissions['case_type'] = [ |
1090 | 'default' => ['administer CiviCase'], | |
1091 | 'get' => [ | |
bf9a7c0f | 1092 | // nested array = OR |
be2fb01f CW |
1093 | ['access my cases and activities', 'access all cases and activities'], |
1094 | ], | |
1095 | ]; | |
bf9a7c0f ES |
1096 | |
1097 | // Campaign permissions | |
be2fb01f CW |
1098 | $permissions['campaign'] = [ |
1099 | 'get' => ['access CiviCRM'], | |
1100 | 'default' => [ | |
bf9a7c0f | 1101 | // nested array = OR |
be2fb01f CW |
1102 | ['administer CiviCampaign', 'manage campaign'], |
1103 | ], | |
1104 | ]; | |
bf9a7c0f ES |
1105 | $permissions['survey'] = $permissions['campaign']; |
1106 | ||
1107 | // Financial permissions | |
be2fb01f CW |
1108 | $permissions['contribution'] = [ |
1109 | 'get' => [ | |
bf9a7c0f ES |
1110 | 'access CiviCRM', |
1111 | 'access CiviContribute', | |
be2fb01f CW |
1112 | ], |
1113 | 'delete' => [ | |
bf9a7c0f ES |
1114 | 'access CiviCRM', |
1115 | 'access CiviContribute', | |
1116 | 'delete in CiviContribute', | |
be2fb01f CW |
1117 | ], |
1118 | 'completetransaction' => [ | |
bf9a7c0f | 1119 | 'edit contributions', |
be2fb01f CW |
1120 | ], |
1121 | 'default' => [ | |
bf9a7c0f ES |
1122 | 'access CiviCRM', |
1123 | 'access CiviContribute', | |
1124 | 'edit contributions', | |
be2fb01f CW |
1125 | ], |
1126 | ]; | |
bf9a7c0f ES |
1127 | $permissions['line_item'] = $permissions['contribution']; |
1128 | ||
1129 | // Payment permissions | |
be2fb01f CW |
1130 | $permissions['payment'] = [ |
1131 | 'get' => [ | |
bf9a7c0f ES |
1132 | 'access CiviCRM', |
1133 | 'access CiviContribute', | |
be2fb01f CW |
1134 | ], |
1135 | 'delete' => [ | |
bf9a7c0f ES |
1136 | 'access CiviCRM', |
1137 | 'access CiviContribute', | |
1138 | 'delete in CiviContribute', | |
be2fb01f CW |
1139 | ], |
1140 | 'cancel' => [ | |
bf9a7c0f ES |
1141 | 'access CiviCRM', |
1142 | 'access CiviContribute', | |
1143 | 'edit contributions', | |
be2fb01f CW |
1144 | ], |
1145 | 'create' => [ | |
bf9a7c0f ES |
1146 | 'access CiviCRM', |
1147 | 'access CiviContribute', | |
1148 | 'edit contributions', | |
be2fb01f CW |
1149 | ], |
1150 | 'default' => [ | |
bf9a7c0f ES |
1151 | 'access CiviCRM', |
1152 | 'access CiviContribute', | |
1153 | 'edit contributions', | |
be2fb01f CW |
1154 | ], |
1155 | ]; | |
e4124a88 | 1156 | $permissions['contribution_recur'] = $permissions['payment']; |
bf9a7c0f ES |
1157 | |
1158 | // Custom field permissions | |
be2fb01f CW |
1159 | $permissions['custom_field'] = [ |
1160 | 'default' => [ | |
bf9a7c0f ES |
1161 | 'administer CiviCRM', |
1162 | 'access all custom data', | |
be2fb01f CW |
1163 | ], |
1164 | ]; | |
bf9a7c0f ES |
1165 | $permissions['custom_group'] = $permissions['custom_field']; |
1166 | ||
1167 | // Event permissions | |
be2fb01f CW |
1168 | $permissions['event'] = [ |
1169 | 'create' => [ | |
bf9a7c0f ES |
1170 | 'access CiviCRM', |
1171 | 'access CiviEvent', | |
1172 | 'edit all events', | |
be2fb01f CW |
1173 | ], |
1174 | 'delete' => [ | |
bf9a7c0f ES |
1175 | 'access CiviCRM', |
1176 | 'access CiviEvent', | |
1177 | 'delete in CiviEvent', | |
be2fb01f CW |
1178 | ], |
1179 | 'get' => [ | |
bf9a7c0f ES |
1180 | 'access CiviCRM', |
1181 | 'access CiviEvent', | |
1182 | 'view event info', | |
be2fb01f CW |
1183 | ], |
1184 | 'update' => [ | |
bf9a7c0f ES |
1185 | 'access CiviCRM', |
1186 | 'access CiviEvent', | |
1187 | 'edit all events', | |
be2fb01f CW |
1188 | ], |
1189 | ]; | |
170af518 | 1190 | // Exception refers to dedupe_exception. |
1191 | $permissions['exception'] = [ | |
1192 | 'default' => ['merge duplicate contacts'], | |
1193 | ]; | |
5654496c | 1194 | |
418ffc5b | 1195 | $permissions['job'] = [ |
1196 | 'process_batch_merge' => ['merge duplicate contacts'], | |
1197 | ]; | |
5654496c | 1198 | $permissions['rule_group']['get'] = [['merge duplicate contacts', 'administer CiviCRM']]; |
bf9a7c0f ES |
1199 | // Loc block is only used for events |
1200 | $permissions['loc_block'] = $permissions['event']; | |
1201 | ||
be2fb01f CW |
1202 | $permissions['state_province'] = [ |
1203 | 'get' => [ | |
fc2d1728 | 1204 | 'access CiviCRM', |
be2fb01f CW |
1205 | ], |
1206 | ]; | |
fc2d1728 | 1207 | |
bf9a7c0f | 1208 | // Price sets are shared by several components, user needs access to at least one of them |
be2fb01f CW |
1209 | $permissions['price_set'] = [ |
1210 | 'default' => [ | |
1211 | ['access CiviEvent', 'access CiviContribute', 'access CiviMember'], | |
1212 | ], | |
1213 | 'get' => [ | |
1214 | ['access CiviCRM', 'view event info', 'make online contributions'], | |
1215 | ], | |
1216 | ]; | |
bf9a7c0f ES |
1217 | |
1218 | // File permissions | |
be2fb01f CW |
1219 | $permissions['file'] = [ |
1220 | 'default' => [ | |
bf9a7c0f ES |
1221 | 'access CiviCRM', |
1222 | 'access uploaded files', | |
be2fb01f CW |
1223 | ], |
1224 | ]; | |
bf9a7c0f ES |
1225 | $permissions['files_by_entity'] = $permissions['file']; |
1226 | ||
1227 | // Group permissions | |
be2fb01f CW |
1228 | $permissions['group'] = [ |
1229 | 'get' => [ | |
bf9a7c0f | 1230 | 'access CiviCRM', |
be2fb01f CW |
1231 | ], |
1232 | 'default' => [ | |
bf9a7c0f ES |
1233 | 'access CiviCRM', |
1234 | 'edit groups', | |
be2fb01f CW |
1235 | ], |
1236 | ]; | |
bf9a7c0f ES |
1237 | |
1238 | $permissions['group_nesting'] = $permissions['group']; | |
1239 | $permissions['group_organization'] = $permissions['group']; | |
1240 | ||
1241 | //Group Contact permission | |
be2fb01f CW |
1242 | $permissions['group_contact'] = [ |
1243 | 'get' => [ | |
bf9a7c0f | 1244 | 'access CiviCRM', |
be2fb01f CW |
1245 | ], |
1246 | 'default' => [ | |
bf9a7c0f ES |
1247 | 'access CiviCRM', |
1248 | 'edit all contacts', | |
be2fb01f CW |
1249 | ], |
1250 | ]; | |
bf9a7c0f ES |
1251 | |
1252 | // CiviMail Permissions | |
be2fb01f | 1253 | $civiMailBasePerms = [ |
bf9a7c0f ES |
1254 | // To get/preview/update, one must have least one of these perms: |
1255 | // Mailing API implementations enforce nuances of create/approve/schedule permissions. | |
1256 | 'access CiviMail', | |
1257 | 'create mailings', | |
1258 | 'schedule mailings', | |
1259 | 'approve mailings', | |
be2fb01f CW |
1260 | ]; |
1261 | $permissions['mailing'] = [ | |
1262 | 'get' => [ | |
bf9a7c0f ES |
1263 | 'access CiviCRM', |
1264 | $civiMailBasePerms, | |
be2fb01f CW |
1265 | ], |
1266 | 'delete' => [ | |
bf9a7c0f ES |
1267 | 'access CiviCRM', |
1268 | $civiMailBasePerms, | |
1269 | 'delete in CiviMail', | |
be2fb01f CW |
1270 | ], |
1271 | 'submit' => [ | |
bf9a7c0f | 1272 | 'access CiviCRM', |
be2fb01f CW |
1273 | ['access CiviMail', 'schedule mailings'], |
1274 | ], | |
1275 | 'default' => [ | |
bf9a7c0f ES |
1276 | 'access CiviCRM', |
1277 | $civiMailBasePerms, | |
be2fb01f CW |
1278 | ], |
1279 | ]; | |
bf9a7c0f ES |
1280 | $permissions['mailing_group'] = $permissions['mailing']; |
1281 | $permissions['mailing_job'] = $permissions['mailing']; | |
1282 | $permissions['mailing_recipients'] = $permissions['mailing']; | |
1283 | ||
be2fb01f CW |
1284 | $permissions['mailing_a_b'] = [ |
1285 | 'get' => [ | |
bf9a7c0f ES |
1286 | 'access CiviCRM', |
1287 | 'access CiviMail', | |
be2fb01f CW |
1288 | ], |
1289 | 'delete' => [ | |
bf9a7c0f ES |
1290 | 'access CiviCRM', |
1291 | 'access CiviMail', | |
1292 | 'delete in CiviMail', | |
be2fb01f CW |
1293 | ], |
1294 | 'submit' => [ | |
bf9a7c0f | 1295 | 'access CiviCRM', |
be2fb01f CW |
1296 | ['access CiviMail', 'schedule mailings'], |
1297 | ], | |
1298 | 'default' => [ | |
bf9a7c0f ES |
1299 | 'access CiviCRM', |
1300 | 'access CiviMail', | |
be2fb01f CW |
1301 | ], |
1302 | ]; | |
bf9a7c0f ES |
1303 | |
1304 | // Membership permissions | |
be2fb01f CW |
1305 | $permissions['membership'] = [ |
1306 | 'get' => [ | |
bf9a7c0f ES |
1307 | 'access CiviCRM', |
1308 | 'access CiviMember', | |
be2fb01f CW |
1309 | ], |
1310 | 'delete' => [ | |
bf9a7c0f ES |
1311 | 'access CiviCRM', |
1312 | 'access CiviMember', | |
1313 | 'delete in CiviMember', | |
be2fb01f CW |
1314 | ], |
1315 | 'default' => [ | |
bf9a7c0f ES |
1316 | 'access CiviCRM', |
1317 | 'access CiviMember', | |
1318 | 'edit memberships', | |
be2fb01f CW |
1319 | ], |
1320 | ]; | |
bf9a7c0f ES |
1321 | $permissions['membership_status'] = $permissions['membership']; |
1322 | $permissions['membership_type'] = $permissions['membership']; | |
be2fb01f CW |
1323 | $permissions['membership_payment'] = [ |
1324 | 'create' => [ | |
bf9a7c0f ES |
1325 | 'access CiviCRM', |
1326 | 'access CiviMember', | |
1327 | 'edit memberships', | |
1328 | 'access CiviContribute', | |
1329 | 'edit contributions', | |
be2fb01f CW |
1330 | ], |
1331 | 'delete' => [ | |
bf9a7c0f ES |
1332 | 'access CiviCRM', |
1333 | 'access CiviMember', | |
1334 | 'delete in CiviMember', | |
1335 | 'access CiviContribute', | |
1336 | 'delete in CiviContribute', | |
be2fb01f CW |
1337 | ], |
1338 | 'get' => [ | |
bf9a7c0f ES |
1339 | 'access CiviCRM', |
1340 | 'access CiviMember', | |
1341 | 'access CiviContribute', | |
be2fb01f CW |
1342 | ], |
1343 | 'update' => [ | |
bf9a7c0f ES |
1344 | 'access CiviCRM', |
1345 | 'access CiviMember', | |
1346 | 'edit memberships', | |
1347 | 'access CiviContribute', | |
1348 | 'edit contributions', | |
be2fb01f CW |
1349 | ], |
1350 | ]; | |
bf9a7c0f ES |
1351 | |
1352 | // Participant permissions | |
be2fb01f CW |
1353 | $permissions['participant'] = [ |
1354 | 'create' => [ | |
bf9a7c0f ES |
1355 | 'access CiviCRM', |
1356 | 'access CiviEvent', | |
1357 | 'register for events', | |
be2fb01f CW |
1358 | ], |
1359 | 'delete' => [ | |
bf9a7c0f ES |
1360 | 'access CiviCRM', |
1361 | 'access CiviEvent', | |
1362 | 'edit event participants', | |
be2fb01f CW |
1363 | ], |
1364 | 'get' => [ | |
bf9a7c0f ES |
1365 | 'access CiviCRM', |
1366 | 'access CiviEvent', | |
1367 | 'view event participants', | |
be2fb01f CW |
1368 | ], |
1369 | 'update' => [ | |
bf9a7c0f ES |
1370 | 'access CiviCRM', |
1371 | 'access CiviEvent', | |
1372 | 'edit event participants', | |
be2fb01f CW |
1373 | ], |
1374 | ]; | |
1375 | $permissions['participant_payment'] = [ | |
1376 | 'create' => [ | |
bf9a7c0f ES |
1377 | 'access CiviCRM', |
1378 | 'access CiviEvent', | |
1379 | 'register for events', | |
1380 | 'access CiviContribute', | |
1381 | 'edit contributions', | |
be2fb01f CW |
1382 | ], |
1383 | 'delete' => [ | |
bf9a7c0f ES |
1384 | 'access CiviCRM', |
1385 | 'access CiviEvent', | |
1386 | 'edit event participants', | |
1387 | 'access CiviContribute', | |
1388 | 'delete in CiviContribute', | |
be2fb01f CW |
1389 | ], |
1390 | 'get' => [ | |
bf9a7c0f ES |
1391 | 'access CiviCRM', |
1392 | 'access CiviEvent', | |
1393 | 'view event participants', | |
1394 | 'access CiviContribute', | |
be2fb01f CW |
1395 | ], |
1396 | 'update' => [ | |
bf9a7c0f ES |
1397 | 'access CiviCRM', |
1398 | 'access CiviEvent', | |
1399 | 'edit event participants', | |
1400 | 'access CiviContribute', | |
1401 | 'edit contributions', | |
be2fb01f CW |
1402 | ], |
1403 | ]; | |
bf9a7c0f ES |
1404 | |
1405 | // Pledge permissions | |
be2fb01f CW |
1406 | $permissions['pledge'] = [ |
1407 | 'create' => [ | |
bf9a7c0f ES |
1408 | 'access CiviCRM', |
1409 | 'access CiviPledge', | |
1410 | 'edit pledges', | |
be2fb01f CW |
1411 | ], |
1412 | 'delete' => [ | |
bf9a7c0f ES |
1413 | 'access CiviCRM', |
1414 | 'access CiviPledge', | |
1415 | 'delete in CiviPledge', | |
be2fb01f CW |
1416 | ], |
1417 | 'get' => [ | |
bf9a7c0f ES |
1418 | 'access CiviCRM', |
1419 | 'access CiviPledge', | |
be2fb01f CW |
1420 | ], |
1421 | 'update' => [ | |
bf9a7c0f ES |
1422 | 'access CiviCRM', |
1423 | 'access CiviPledge', | |
1424 | 'edit pledges', | |
be2fb01f CW |
1425 | ], |
1426 | ]; | |
bf9a7c0f ES |
1427 | |
1428 | //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission. | |
be2fb01f CW |
1429 | $permissions['action_schedule'] = [ |
1430 | 'update' => [ | |
1431 | [ | |
bf9a7c0f ES |
1432 | 'access CiviCRM', |
1433 | 'edit all events', | |
be2fb01f CW |
1434 | ], |
1435 | ], | |
1436 | ]; | |
bf9a7c0f | 1437 | |
be2fb01f CW |
1438 | $permissions['pledge_payment'] = [ |
1439 | 'create' => [ | |
bf9a7c0f ES |
1440 | 'access CiviCRM', |
1441 | 'access CiviPledge', | |
1442 | 'edit pledges', | |
1443 | 'access CiviContribute', | |
1444 | 'edit contributions', | |
be2fb01f CW |
1445 | ], |
1446 | 'delete' => [ | |
bf9a7c0f ES |
1447 | 'access CiviCRM', |
1448 | 'access CiviPledge', | |
1449 | 'delete in CiviPledge', | |
1450 | 'access CiviContribute', | |
1451 | 'delete in CiviContribute', | |
be2fb01f CW |
1452 | ], |
1453 | 'get' => [ | |
bf9a7c0f ES |
1454 | 'access CiviCRM', |
1455 | 'access CiviPledge', | |
1456 | 'access CiviContribute', | |
be2fb01f CW |
1457 | ], |
1458 | 'update' => [ | |
bf9a7c0f ES |
1459 | 'access CiviCRM', |
1460 | 'access CiviPledge', | |
1461 | 'edit pledges', | |
1462 | 'access CiviContribute', | |
1463 | 'edit contributions', | |
be2fb01f CW |
1464 | ], |
1465 | ]; | |
bf9a7c0f | 1466 | |
dfcf5ba2 CW |
1467 | // Dashboard permissions |
1468 | $permissions['dashboard'] = [ | |
1469 | 'get' => [ | |
1470 | 'access CiviCRM', | |
1471 | ], | |
1472 | ]; | |
1473 | $permissions['dashboard_contact'] = [ | |
1474 | 'default' => [ | |
1475 | 'access CiviCRM', | |
1476 | ], | |
1477 | ]; | |
1478 | ||
bf9a7c0f | 1479 | // Profile permissions |
be2fb01f | 1480 | $permissions['profile'] = [ |
518fa0ee SL |
1481 | // the profile will take care of this |
1482 | 'get' => [], | |
be2fb01f | 1483 | ]; |
bf9a7c0f | 1484 | |
be2fb01f CW |
1485 | $permissions['uf_group'] = [ |
1486 | 'create' => [ | |
bf9a7c0f | 1487 | 'access CiviCRM', |
be2fb01f | 1488 | [ |
bf9a7c0f ES |
1489 | 'administer CiviCRM', |
1490 | 'manage event profiles', | |
be2fb01f CW |
1491 | ], |
1492 | ], | |
1493 | 'get' => [ | |
bf9a7c0f | 1494 | 'access CiviCRM', |
be2fb01f CW |
1495 | ], |
1496 | 'update' => [ | |
bf9a7c0f | 1497 | 'access CiviCRM', |
be2fb01f | 1498 | [ |
bf9a7c0f ES |
1499 | 'administer CiviCRM', |
1500 | 'manage event profiles', | |
be2fb01f CW |
1501 | ], |
1502 | ], | |
1503 | ]; | |
bf9a7c0f | 1504 | $permissions['uf_field'] = $permissions['uf_join'] = $permissions['uf_group']; |
be2fb01f | 1505 | $permissions['uf_field']['delete'] = [ |
bf9a7c0f | 1506 | 'access CiviCRM', |
be2fb01f | 1507 | [ |
bf9a7c0f ES |
1508 | 'administer CiviCRM', |
1509 | 'manage event profiles', | |
be2fb01f CW |
1510 | ], |
1511 | ]; | |
bf9a7c0f ES |
1512 | $permissions['option_value'] = $permissions['uf_group']; |
1513 | $permissions['option_group'] = $permissions['option_value']; | |
1514 | ||
be2fb01f CW |
1515 | $permissions['custom_value'] = [ |
1516 | 'gettree' => ['access CiviCRM'], | |
1517 | ]; | |
f26fa703 | 1518 | |
be2fb01f CW |
1519 | $permissions['message_template'] = [ |
1520 | 'get' => ['access CiviCRM'], | |
1521 | 'create' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']], | |
1522 | 'update' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']], | |
1523 | ]; | |
4341efe4 JV |
1524 | |
1525 | $permissions['report_template']['update'] = 'save Report Criteria'; | |
1526 | $permissions['report_template']['create'] = 'save Report Criteria'; | |
bf9a7c0f ES |
1527 | return $permissions; |
1528 | } | |
1529 | ||
1530 | /** | |
1531 | * Translate an unknown action to a canonical form. | |
1532 | * | |
1533 | * @param string $action | |
1534 | * | |
1535 | * @return string | |
1536 | * the standardised action name | |
1537 | */ | |
1538 | public static function getGenericAction($action) { | |
1539 | $snippet = substr($action, 0, 3); | |
1540 | if ($action == 'replace' || $snippet == 'del') { | |
1541 | // 'Replace' is a combination of get+create+update+delete; however, the permissions | |
1542 | // on each of those will be tested separately at runtime. This is just a sniff-test | |
1543 | // based on the heuristic that 'delete' tends to be the most closely guarded | |
1544 | // of the necessary permissions. | |
1545 | $action = 'delete'; | |
1546 | } | |
1547 | elseif ($action == 'setvalue' || $snippet == 'upd') { | |
1548 | $action = 'update'; | |
1549 | } | |
1550 | elseif ($action == 'getfields' || $action == 'getfield' || $action == 'getspec' || $action == 'getoptions') { | |
1551 | $action = 'meta'; | |
1552 | } | |
1553 | elseif ($snippet == 'get') { | |
1554 | $action = 'get'; | |
1555 | } | |
1556 | return $action; | |
1557 | } | |
1558 | ||
6a488035 | 1559 | /** |
d09edf64 | 1560 | * Validate user permission across. |
6a488035 TO |
1561 | * edit or view or with supportable acls. |
1562 | * | |
acb1052e WA |
1563 | * @return bool |
1564 | */ | |
00be9182 | 1565 | public static function giveMeAllACLs() { |
6a488035 TO |
1566 | if (CRM_Core_Permission::check('view all contacts') || |
1567 | CRM_Core_Permission::check('edit all contacts') | |
1568 | ) { | |
1569 | return TRUE; | |
1570 | } | |
1571 | ||
1572 | $session = CRM_Core_Session::singleton(); | |
1573 | $contactID = $session->get('userID'); | |
1574 | ||
6a488035 TO |
1575 | //check for acl. |
1576 | $aclPermission = self::getPermission(); | |
be2fb01f | 1577 | if (in_array($aclPermission, [ |
6a488035 | 1578 | CRM_Core_Permission::EDIT, |
41f314b6 | 1579 | CRM_Core_Permission::VIEW, |
be2fb01f | 1580 | ]) |
41f314b6 | 1581 | ) { |
6a488035 TO |
1582 | return TRUE; |
1583 | } | |
1584 | ||
1585 | // run acl where hook and see if the user is supplying an ACL clause | |
1586 | // that is not false | |
be2fb01f | 1587 | $tables = $whereTables = []; |
6a488035 TO |
1588 | $where = NULL; |
1589 | ||
1590 | CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW, | |
1591 | $tables, $whereTables, | |
1592 | $contactID, $where | |
1593 | ); | |
1594 | return empty($whereTables) ? FALSE : TRUE; | |
1595 | } | |
1596 | ||
1597 | /** | |
100fef9d | 1598 | * Get component name from given permission. |
6a488035 | 1599 | * |
41f314b6 | 1600 | * @param string $permission |
6a488035 | 1601 | * |
76e7a76c CW |
1602 | * @return null|string |
1603 | * the name of component. | |
6a488035 | 1604 | */ |
00be9182 | 1605 | public static function getComponentName($permission) { |
6a488035 TO |
1606 | $componentName = NULL; |
1607 | $permission = trim($permission); | |
1608 | if (empty($permission)) { | |
1609 | return $componentName; | |
1610 | } | |
1611 | ||
be2fb01f | 1612 | static $allCompPermissions = []; |
6a488035 TO |
1613 | if (empty($allCompPermissions)) { |
1614 | $components = CRM_Core_Component::getComponents(); | |
1615 | foreach ($components as $name => $comp) { | |
33777e4a PJ |
1616 | //get all permissions of each components unconditionally |
1617 | $allCompPermissions[$name] = $comp->getPermissions(TRUE); | |
6a488035 TO |
1618 | } |
1619 | } | |
1620 | ||
1621 | if (is_array($allCompPermissions)) { | |
1622 | foreach ($allCompPermissions as $name => $permissions) { | |
b9021475 | 1623 | if (array_key_exists($permission, $permissions)) { |
6a488035 TO |
1624 | $componentName = $name; |
1625 | break; | |
1626 | } | |
1627 | } | |
1628 | } | |
1629 | ||
1630 | return $componentName; | |
1631 | } | |
1632 | ||
1633 | /** | |
d09edf64 | 1634 | * Get all the contact emails for users that have a specific permission. |
6a488035 | 1635 | * |
6a0b768e TO |
1636 | * @param string $permissionName |
1637 | * Name of the permission we are interested in. | |
6a488035 | 1638 | * |
a6c01b45 CW |
1639 | * @return string |
1640 | * a comma separated list of email addresses | |
6a488035 TO |
1641 | */ |
1642 | public static function permissionEmails($permissionName) { | |
1643 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 1644 | return $config->userPermissionClass->permissionEmails($permissionName); |
6a488035 TO |
1645 | } |
1646 | ||
1647 | /** | |
d09edf64 | 1648 | * Get all the contact emails for users that have a specific role. |
6a488035 | 1649 | * |
6a0b768e TO |
1650 | * @param string $roleName |
1651 | * Name of the role we are interested in. | |
6a488035 | 1652 | * |
a6c01b45 CW |
1653 | * @return string |
1654 | * a comma separated list of email addresses | |
6a488035 TO |
1655 | */ |
1656 | public static function roleEmails($roleName) { | |
1657 | $config = CRM_Core_Config::singleton(); | |
41f314b6 | 1658 | return $config->userRoleClass->roleEmails($roleName); |
6a488035 TO |
1659 | } |
1660 | ||
a0ee3941 EM |
1661 | /** |
1662 | * @return bool | |
1663 | */ | |
00be9182 | 1664 | public static function isMultisiteEnabled() { |
63d76404 | 1665 | return (bool) Civi::settings()->get('is_enabled'); |
6a488035 | 1666 | } |
96025800 | 1667 | |
dc6b437a GC |
1668 | /** |
1669 | * Verify if the user has permission to get the invoice. | |
1670 | * | |
1671 | * @return bool | |
1672 | * TRUE if the user has download all invoices permission or download my | |
1673 | * invoices permission and the invoice author is the current user. | |
1674 | */ | |
1675 | public static function checkDownloadInvoice() { | |
4cfd4f45 | 1676 | $cid = CRM_Core_Session::getLoggedInContactID(); |
dc6b437a GC |
1677 | if (CRM_Core_Permission::check('access CiviContribute') || |
1678 | (CRM_Core_Permission::check('view my invoices') && $_GET['cid'] == $cid) | |
1679 | ) { | |
1680 | return TRUE; | |
1681 | } | |
1682 | return FALSE; | |
1683 | } | |
1684 | ||
b4d6a411 | 1685 | /** |
d2b6eac8 | 1686 | * Get permissions for components. |
1687 | * | |
b4d6a411 | 1688 | * @param bool $includeDisabled |
1689 | * | |
1690 | * @return array | |
1691 | * @throws \CRM_Core_Exception | |
1692 | */ | |
1693 | protected static function getComponentPermissions(bool $includeDisabled): array { | |
1694 | if (!$includeDisabled) { | |
1695 | $components = CRM_Core_Component::getEnabledComponents(); | |
1696 | } | |
1697 | else { | |
1698 | $components = CRM_Core_Component::getComponents(); | |
1699 | } | |
1700 | ||
1701 | $permissions = []; | |
1702 | foreach ($components as $comp) { | |
1703 | $perm = $comp->getPermissions($includeDisabled, TRUE); | |
1704 | if ($perm) { | |
1705 | $info = $comp->getInfo(); | |
1706 | foreach ($perm as $p => $attr) { | |
1707 | ||
1708 | if (!is_array($attr)) { | |
1709 | $attr = [$attr]; | |
1710 | } | |
1711 | ||
1712 | $attr[0] = $info['translatedName'] . ': ' . $attr[0]; | |
1713 | $permissions[$p] = $attr; | |
1714 | } | |
1715 | } | |
1716 | } | |
1717 | return $permissions; | |
1718 | } | |
1719 | ||
d2b6eac8 | 1720 | /** |
1721 | * Get permissions for core functionality and for that of core components. | |
1722 | * | |
1723 | * @param bool $all | |
1724 | * | |
1725 | * @return array | |
1726 | * @throws \CRM_Core_Exception | |
1727 | */ | |
1728 | protected static function getCoreAndComponentPermissions(bool $all): array { | |
1729 | $permissions = self::getCorePermissions(); | |
1730 | $permissions = array_merge($permissions, self::getComponentPermissions($all)); | |
1731 | return $permissions; | |
1732 | } | |
1733 | ||
6a488035 | 1734 | } |