CRM/ACL/API.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | Copyright CiviCRM LLC. All rights reserved.                        |
   5  |                                                                    |
   6  | This work is published under the GNU AGPLv3 license with some      |
   7  | permitted exceptions and without any warranty. For full license    |
   8  | and copyright information, see https://civicrm.org/licensing       |
   9  +--------------------------------------------------------------------+
  10  */
  11
  12 /**
  13  *
  14  * @package CRM
  15  * @copyright CiviCRM LLC https://civicrm.org/licensing
  16  */
  17 class CRM_ACL_API {
  18
  19   /**
  20    * The various type of permissions.
  21    *
  22    * @var int
  23    */
  24   const EDIT = 1;
  25   const VIEW = 2;
  26   const DELETE = 3;
  27   const CREATE = 4;
  28   const SEARCH = 5;
  29   const ALL = 6;
  30
  31   /**
  32    * Given a permission string, check for access requirements
  33    *
  34    * @param string $str
  35    *   The permission to check.
  36    * @param int $contactID
  37    *   The contactID for whom the check is made.
  38    *
  39    * @return bool
  40    *   true if yes, else false
  41    */
  42   public static function check($str, $contactID = NULL) {
  43     if ($contactID == NULL) {
  44       $contactID = CRM_Core_Session::getLoggedInContactID();
  45     }
  46
  47     if (!$contactID) {
  48       // anonymous user
  49       $contactID = 0;
  50     }
  51
  52     return CRM_ACL_BAO_ACL::check($str, $contactID);
  53   }
  54
  55   /**
  56    * Get the permissioned where clause for the user.
  57    *
  58    * @param int $type
  59    *   The type of permission needed.
  60    * @param array $tables
  61    *   (reference ) add the tables that are needed for the select clause.
  62    * @param array $whereTables
  63    *   (reference ) add the tables that are needed for the where clause.
  64    * @param int $contactID
  65    *   The contactID for whom the check is made.
  66    * @param bool $onlyDeleted
  67    *   Whether to include only deleted contacts.
  68    * @param bool $skipDeleteClause
  69    *   Don't add delete clause if this is true,.
  70    *   this means it is handled by generating query
  71    * @param bool $skipOwnContactClause
  72    *   Do not add 'OR contact_id = $userID' to the where clause.
  73    *   This is a hideously inefficient query and should be avoided
  74    *   wherever possible.
  75    *
  76    * @return string
  77    *   the group where clause for this user
  78    */
  79   public static function whereClause(
  80     $type,
  81     &$tables,
  82     &$whereTables,
  83     $contactID = NULL,
  84     $onlyDeleted = FALSE,
  85     $skipDeleteClause = FALSE,
  86     $skipOwnContactClause = FALSE
  87   ) {
  88     // the default value which is valid for the final AND
  89     $deleteClause = ' ( 1 ) ';
  90     if (!$skipDeleteClause) {
  91       if (CRM_Core_Permission::check('access deleted contacts')) {
  92         if ($onlyDeleted) {
  93           $deleteClause = '(contact_a.is_deleted)';
  94         }
  95       }
  96       else {
  97         // Exclude deleted contacts due to permissions
  98         $deleteClause = '(contact_a.is_deleted = 0)';
  99       }
 100     }
 101
 102     if (!$contactID) {
 103       $contactID = CRM_Core_Session::getLoggedInContactID();
 104     }
 105     $contactID = (int) $contactID;
 106
 107     // first see if the contact has edit / view all permission
 108     if (CRM_Core_Permission::check('edit all contacts', $contactID) ||
 109       ($type == self::VIEW && CRM_Core_Permission::check('view all contacts', $contactID))
 110     ) {
 111       return $deleteClause;
 112     }
 113
 114     $whereClause = CRM_ACL_BAO_ACL::whereClause($type,
 115       $tables,
 116       $whereTables,
 117       $contactID
 118     );
 119     $where = implode(' AND ', [$whereClause, $deleteClause]);
 120
 121     // Add permission on self if we really hate our server or have hardly any contacts.
 122     if (!$skipOwnContactClause && $contactID && (CRM_Core_Permission::check('edit my contact') ||
 123         $type == self::VIEW && CRM_Core_Permission::check('view my contact'))
 124     ) {
 125       $where = "(contact_a.id = $contactID OR ($where))";
 126     }
 127     return $where;
 128   }
 129
 130   /**
 131    * Get all the groups the user has access to for the given operation.
 132    *
 133    * @param int $type
 134    *   The type of permission needed.
 135    * @param int $contactID
 136    *   The contactID for whom the check is made.
 137    *
 138    * @param string $tableName
 139    * @param null $allGroups
 140    * @param null $includedGroups
 141    *
 142    * @return array
 143    *   the ids of the groups for which the user has permissions
 144    */
 145   public static function group(
 146     $type,
 147     $contactID = NULL,
 148     $tableName = 'civicrm_saved_search',
 149     $allGroups = NULL,
 150     $includedGroups = NULL
 151   ) {
 152     if ($contactID == NULL) {
 153       $contactID = CRM_Core_Session::getLoggedInContactID();
 154     }
 155
 156     if (!$contactID) {
 157       // anonymous user
 158       $contactID = 0;
 159     }
 160
 161     return CRM_ACL_BAO_ACL::group($type, $contactID, $tableName, $allGroups, $includedGroups);
 162   }
 163
 164   /**
 165    * Check if the user has access to this group for operation $type
 166    *
 167    * @param int $type
 168    *   The type of permission needed.
 169    * @param int $groupID
 170    * @param int $contactID
 171    *   The contactID for whom the check is made.
 172    * @param string $tableName
 173    * @param null $allGroups
 174    * @param null $includedGroups
 175    *
 176    * @return bool
 177    */
 178   public static function groupPermission(
 179     $type,
 180     $groupID,
 181     $contactID = NULL,
 182     $tableName = 'civicrm_saved_search',
 183     $allGroups = NULL,
 184     $includedGroups = NULL
 185   ) {
 186
 187     if (!isset(Civi::$statics[__CLASS__]) || !isset(Civi::$statics[__CLASS__]['group_permission'])) {
 188       Civi::$statics[__CLASS__]['group_permission'] = [];
 189     }
 190
 191     if (!$contactID) {
 192       $contactID = CRM_Core_Session::getLoggedInContactID();
 193     }
 194
 195     $key = "{$tableName}_{$type}_{$contactID}";
 196     if (!array_key_exists($key, Civi::$statics[__CLASS__]['group_permission'])) {
 197       Civi::$statics[__CLASS__]['group_permission'][$key] = self::group($type, $contactID, $tableName, $allGroups, $includedGroups);
 198     }
 199
 200     return in_array($groupID, Civi::$statics[__CLASS__]['group_permission'][$key]);
 201   }
 202
 203 }