CRM/ACL/API.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | Copyright CiviCRM LLC. All rights reserved.                        |
   5  |                                                                    |
   6  | This work is published under the GNU AGPLv3 license with some      |
   7  | permitted exceptions and without any warranty. For full license    |
   8  | and copyright information, see https://civicrm.org/licensing       |
   9  +--------------------------------------------------------------------+
  10  */
  11
  12 /**
  13  *
  14  * @package CRM
  15  * @copyright CiviCRM LLC https://civicrm.org/licensing
  16  */
  17 class CRM_ACL_API {
  18
  19   /**
  20    * The various type of permissions.
  21    *
  22    * @var int
  23    */
  24   const EDIT = 1;
  25   const VIEW = 2;
  26   const DELETE = 3;
  27   const CREATE = 4;
  28   const SEARCH = 5;
  29   const ALL = 6;
  30
  31   /**
  32    * Given a permission string, check for access requirements
  33    *
  34    * @param string $str
  35    *   The permission to check.
  36    * @param int $contactID
  37    *   The contactID for whom the check is made.
  38    *
  39    * @return bool
  40    *   true if yes, else false
  41    *
  42    * @deprecated
  43    */
  44   public static function check($str, $contactID = NULL) {
  45     \CRM_Core_Error::deprecatedWarning(__CLASS__ . '::' . __FUNCTION__ . ' is deprecated.');
  46     if ($contactID == NULL) {
  47       $contactID = CRM_Core_Session::getLoggedInContactID();
  48     }
  49
  50     if (!$contactID) {
  51       // anonymous user
  52       $contactID = 0;
  53     }
  54
  55     return CRM_ACL_BAO_ACL::check($str, $contactID);
  56   }
  57
  58   /**
  59    * Get the permissioned where clause for the user.
  60    *
  61    * @param int $type
  62    *   The type of permission needed.
  63    * @param array $tables
  64    *   (reference ) add the tables that are needed for the select clause.
  65    * @param array $whereTables
  66    *   (reference ) add the tables that are needed for the where clause.
  67    * @param int $contactID
  68    *   The contactID for whom the check is made.
  69    * @param bool $onlyDeleted
  70    *   Whether to include only deleted contacts.
  71    * @param bool $skipDeleteClause
  72    *   Don't add delete clause if this is true,.
  73    *   this means it is handled by generating query
  74    * @param bool $skipOwnContactClause
  75    *   Do not add 'OR contact_id = $userID' to the where clause.
  76    *   This is a hideously inefficient query and should be avoided
  77    *   wherever possible.
  78    *
  79    * @return string
  80    *   the group where clause for this user
  81    */
  82   public static function whereClause(
  83     $type,
  84     &$tables,
  85     &$whereTables,
  86     $contactID = NULL,
  87     $onlyDeleted = FALSE,
  88     $skipDeleteClause = FALSE,
  89     $skipOwnContactClause = FALSE
  90   ) {
  91     // the default value which is valid for the final AND
  92     $deleteClause = ' ( 1 ) ';
  93     if (!$skipDeleteClause) {
  94       if (CRM_Core_Permission::check('access deleted contacts')) {
  95         if ($onlyDeleted) {
  96           $deleteClause = '(contact_a.is_deleted)';
  97         }
  98       }
  99       else {
 100         // Exclude deleted contacts due to permissions
 101         $deleteClause = '(contact_a.is_deleted = 0)';
 102       }
 103     }
 104
 105     if (!$contactID) {
 106       $contactID = CRM_Core_Session::getLoggedInContactID();
 107     }
 108     $contactID = (int) $contactID;
 109
 110     // first see if the contact has edit / view all permission
 111     if (CRM_Core_Permission::check('edit all contacts', $contactID) ||
 112       ($type == self::VIEW && CRM_Core_Permission::check('view all contacts', $contactID))
 113     ) {
 114       return $deleteClause;
 115     }
 116
 117     $whereClause = CRM_ACL_BAO_ACL::whereClause($type,
 118       $tables,
 119       $whereTables,
 120       $contactID
 121     );
 122     $where = implode(' AND ', [$whereClause, $deleteClause]);
 123
 124     // Add permission on self if we really hate our server or have hardly any contacts.
 125     if (!$skipOwnContactClause && $contactID && (CRM_Core_Permission::check('edit my contact') ||
 126         $type == self::VIEW && CRM_Core_Permission::check('view my contact'))
 127     ) {
 128       $where = "(contact_a.id = $contactID OR ($where))";
 129     }
 130     return $where;
 131   }
 132
 133   /**
 134    * Get all the groups the user has access to for the given operation.
 135    *
 136    * @param int $type
 137    *   The type of permission needed.
 138    * @param int $contactID
 139    *   The contactID for whom the check is made.
 140    *
 141    * @param string $tableName
 142    * @param null $allGroups
 143    * @param null $includedGroups
 144    *
 145    * @return array
 146    *   the ids of the groups for which the user has permissions
 147    */
 148   public static function group(
 149     $type,
 150     $contactID = NULL,
 151     $tableName = 'civicrm_saved_search',
 152     $allGroups = NULL,
 153     $includedGroups = NULL
 154   ) {
 155     if ($contactID == NULL) {
 156       $contactID = CRM_Core_Session::getLoggedInContactID();
 157     }
 158
 159     return CRM_ACL_BAO_ACL::group($type, (int) $contactID, $tableName, $allGroups, $includedGroups);
 160   }
 161
 162   /**
 163    * Check if the user has access to this group for operation $type
 164    *
 165    * @param int $type
 166    *   The type of permission needed.
 167    * @param int $groupID
 168    * @param int $contactID
 169    *   The contactID for whom the check is made.
 170    * @param string $tableName
 171    * @param null $allGroups
 172    * @param null $includedGroups
 173    *
 174    * @return bool
 175    */
 176   public static function groupPermission(
 177     $type,
 178     $groupID,
 179     $contactID = NULL,
 180     $tableName = 'civicrm_saved_search',
 181     $allGroups = NULL,
 182     $includedGroups = NULL
 183   ) {
 184
 185     if (!isset(Civi::$statics[__CLASS__]) || !isset(Civi::$statics[__CLASS__]['group_permission'])) {
 186       Civi::$statics[__CLASS__]['group_permission'] = [];
 187     }
 188
 189     if (!$contactID) {
 190       $contactID = CRM_Core_Session::getLoggedInContactID();
 191     }
 192
 193     $key = "{$tableName}_{$type}_{$contactID}";
 194     if (!array_key_exists($key, Civi::$statics[__CLASS__]['group_permission'])) {
 195       Civi::$statics[__CLASS__]['group_permission'][$key] = self::group($type, $contactID, $tableName, $allGroups, $includedGroups);
 196     }
 197
 198     return in_array($groupID, Civi::$statics[__CLASS__]['group_permission'][$key]);
 199   }
 200
 201 }