Merge pull request #20150 from MegaphoneJon/backoffice-xfer
[civicrm-core.git] / CRM / ACL / API.php
1 <?php
2 /*
3 +--------------------------------------------------------------------+
4 | Copyright CiviCRM LLC. All rights reserved. |
5 | |
6 | This work is published under the GNU AGPLv3 license with some |
7 | permitted exceptions and without any warranty. For full license |
8 | and copyright information, see https://civicrm.org/licensing |
9 +--------------------------------------------------------------------+
10 */
11
12 /**
13 *
14 * @package CRM
15 * @copyright CiviCRM LLC https://civicrm.org/licensing
16 */
17 class CRM_ACL_API {
18
19 /**
20 * The various type of permissions.
21 *
22 * @var int
23 */
24 const EDIT = 1;
25 const VIEW = 2;
26 const DELETE = 3;
27 const CREATE = 4;
28 const SEARCH = 5;
29 const ALL = 6;
30
31 /**
32 * Given a permission string, check for access requirements
33 *
34 * @param string $str
35 * The permission to check.
36 * @param int $contactID
37 * The contactID for whom the check is made.
38 *
39 * @return bool
40 * true if yes, else false
41 */
42 public static function check($str, $contactID = NULL) {
43 \CRM_Core_Error::deprecatedWarning(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated.');
44 if ($contactID == NULL) {
45 $contactID = CRM_Core_Session::getLoggedInContactID();
46 }
47
48 if (!$contactID) {
49 // anonymous user
50 $contactID = 0;
51 }
52
53 return CRM_ACL_BAO_ACL::check($str, $contactID);
54 }
55
56 /**
57 * Get the permissioned where clause for the user.
58 *
59 * @param int $type
60 * The type of permission needed.
61 * @param array $tables
62 * (reference ) add the tables that are needed for the select clause.
63 * @param array $whereTables
64 * (reference ) add the tables that are needed for the where clause.
65 * @param int $contactID
66 * The contactID for whom the check is made.
67 * @param bool $onlyDeleted
68 * Whether to include only deleted contacts.
69 * @param bool $skipDeleteClause
70 * Don't add delete clause if this is true,.
71 * this means it is handled by generating query
72 * @param bool $skipOwnContactClause
73 * Do not add 'OR contact_id = $userID' to the where clause.
74 * This is a hideously inefficient query and should be avoided
75 * wherever possible.
76 *
77 * @return string
78 * the group where clause for this user
79 */
80 public static function whereClause(
81 $type,
82 &$tables,
83 &$whereTables,
84 $contactID = NULL,
85 $onlyDeleted = FALSE,
86 $skipDeleteClause = FALSE,
87 $skipOwnContactClause = FALSE
88 ) {
89 // the default value which is valid for the final AND
90 $deleteClause = ' ( 1 ) ';
91 if (!$skipDeleteClause) {
92 if (CRM_Core_Permission::check('access deleted contacts')) {
93 if ($onlyDeleted) {
94 $deleteClause = '(contact_a.is_deleted)';
95 }
96 }
97 else {
98 // Exclude deleted contacts due to permissions
99 $deleteClause = '(contact_a.is_deleted = 0)';
100 }
101 }
102
103 if (!$contactID) {
104 $contactID = CRM_Core_Session::getLoggedInContactID();
105 }
106 $contactID = (int) $contactID;
107
108 // first see if the contact has edit / view all permission
109 if (CRM_Core_Permission::check('edit all contacts', $contactID) ||
110 ($type == self::VIEW && CRM_Core_Permission::check('view all contacts', $contactID))
111 ) {
112 return $deleteClause;
113 }
114
115 $whereClause = CRM_ACL_BAO_ACL::whereClause($type,
116 $tables,
117 $whereTables,
118 $contactID
119 );
120 $where = implode(' AND ', [$whereClause, $deleteClause]);
121
122 // Add permission on self if we really hate our server or have hardly any contacts.
123 if (!$skipOwnContactClause && $contactID && (CRM_Core_Permission::check('edit my contact') ||
124 $type == self::VIEW && CRM_Core_Permission::check('view my contact'))
125 ) {
126 $where = "(contact_a.id = $contactID OR ($where))";
127 }
128 return $where;
129 }
130
131 /**
132 * Get all the groups the user has access to for the given operation.
133 *
134 * @param int $type
135 * The type of permission needed.
136 * @param int $contactID
137 * The contactID for whom the check is made.
138 *
139 * @param string $tableName
140 * @param null $allGroups
141 * @param null $includedGroups
142 *
143 * @return array
144 * the ids of the groups for which the user has permissions
145 */
146 public static function group(
147 $type,
148 $contactID = NULL,
149 $tableName = 'civicrm_saved_search',
150 $allGroups = NULL,
151 $includedGroups = NULL
152 ) {
153 if ($contactID == NULL) {
154 $contactID = CRM_Core_Session::getLoggedInContactID();
155 }
156
157 if (!$contactID) {
158 // anonymous user
159 $contactID = 0;
160 }
161
162 return CRM_ACL_BAO_ACL::group($type, $contactID, $tableName, $allGroups, $includedGroups);
163 }
164
165 /**
166 * Check if the user has access to this group for operation $type
167 *
168 * @param int $type
169 * The type of permission needed.
170 * @param int $groupID
171 * @param int $contactID
172 * The contactID for whom the check is made.
173 * @param string $tableName
174 * @param null $allGroups
175 * @param null $includedGroups
176 *
177 * @return bool
178 */
179 public static function groupPermission(
180 $type,
181 $groupID,
182 $contactID = NULL,
183 $tableName = 'civicrm_saved_search',
184 $allGroups = NULL,
185 $includedGroups = NULL
186 ) {
187
188 if (!isset(Civi::$statics[__CLASS__]) || !isset(Civi::$statics[__CLASS__]['group_permission'])) {
189 Civi::$statics[__CLASS__]['group_permission'] = [];
190 }
191
192 if (!$contactID) {
193 $contactID = CRM_Core_Session::getLoggedInContactID();
194 }
195
196 $key = "{$tableName}_{$type}_{$contactID}";
197 if (!array_key_exists($key, Civi::$statics[__CLASS__]['group_permission'])) {
198 Civi::$statics[__CLASS__]['group_permission'][$key] = self::group($type, $contactID, $tableName, $allGroups, $includedGroups);
199 }
200
201 return in_array($groupID, Civi::$statics[__CLASS__]['group_permission'][$key]);
202 }
203
204 }