CRM/ACL/API.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | Copyright CiviCRM LLC. All rights reserved.                        |
   5  |                                                                    |
   6  | This work is published under the GNU AGPLv3 license with some      |
   7  | permitted exceptions and without any warranty. For full license    |
   8  | and copyright information, see https://civicrm.org/licensing       |
   9  +--------------------------------------------------------------------+
  10  */
  11
  12 /**
  13  *
  14  * @package CRM
  15  * @copyright CiviCRM LLC https://civicrm.org/licensing
  16  */
  17 class CRM_ACL_API {
  18
  19   /**
  20    * The various type of permissions.
  21    *
  22    * @var int
  23    */
  24   const EDIT = 1;
  25   const VIEW = 2;
  26   const DELETE = 3;
  27   const CREATE = 4;
  28   const SEARCH = 5;
  29   const ALL = 6;
  30
  31   /**
  32    * Given a permission string, check for access requirements
  33    *
  34    * @param string $str
  35    *   The permission to check.
  36    * @param int $contactID
  37    *   The contactID for whom the check is made.
  38    *
  39    * @return bool
  40    *   true if yes, else false
  41    */
  42   public static function check($str, $contactID = NULL) {
  43     if ($contactID == NULL) {
  44       $contactID = CRM_Core_Session::getLoggedInContactID();
  45     }
  46
  47     if (!$contactID) {
  48       // anonymous user
  49       $contactID = 0;
  50     }
  51
  52     return CRM_ACL_BAO_ACL::check($str, $contactID);
  53   }
  54
  55   /**
  56    * Get the permissioned where clause for the user.
  57    *
  58    * @param int $type
  59    *   The type of permission needed.
  60    * @param array $tables
  61    *   (reference ) add the tables that are needed for the select clause.
  62    * @param array $whereTables
  63    *   (reference ) add the tables that are needed for the where clause.
  64    * @param int $contactID
  65    *   The contactID for whom the check is made.
  66    * @param bool $onlyDeleted
  67    *   Whether to include only deleted contacts.
  68    * @param bool $skipDeleteClause
  69    *   Don't add delete clause if this is true,.
  70    *   this means it is handled by generating query
  71    * @param bool $skipOwnContactClause
  72    *   Do not add 'OR contact_id = $userID' to the where clause.
  73    *   This is a hideously inefficient query and should be avoided
  74    *   wherever possible.
  75    *
  76    * @return string
  77    *   the group where clause for this user
  78    */
  79   public static function whereClause(
  80     $type,
  81     &$tables,
  82     &$whereTables,
  83     $contactID = NULL,
  84     $onlyDeleted = FALSE,
  85     $skipDeleteClause = FALSE,
  86     $skipOwnContactClause = FALSE
  87   ) {
  88     // the default value which is valid for the final AND
  89     $deleteClause = ' ( 1 ) ';
  90     if (!$skipDeleteClause) {
  91       if (CRM_Core_Permission::check('access deleted contacts') and $onlyDeleted) {
  92         $deleteClause = '(contact_a.is_deleted)';
  93       }
  94       else {
  95         // CRM-6181
  96         $deleteClause = '(contact_a.is_deleted = 0)';
  97       }
  98     }
  99
 100     if (!$contactID) {
 101       $contactID = CRM_Core_Session::getLoggedInContactID();
 102     }
 103     $contactID = (int) $contactID;
 104
 105     // first see if the contact has edit / view all permission
 106     if (CRM_Core_Permission::check('edit all contacts', $contactID) ||
 107       ($type == self::VIEW && CRM_Core_Permission::check('view all contacts', $contactID))
 108     ) {
 109       return $deleteClause;
 110     }
 111
 112     $whereClause = CRM_ACL_BAO_ACL::whereClause($type,
 113       $tables,
 114       $whereTables,
 115       $contactID
 116     );
 117     $where = implode(' AND ', [$whereClause, $deleteClause]);
 118
 119     // Add permission on self if we really hate our server or have hardly any contacts.
 120     if (!$skipOwnContactClause && $contactID && (CRM_Core_Permission::check('edit my contact') ||
 121         $type == self::VIEW && CRM_Core_Permission::check('view my contact'))
 122     ) {
 123       $where = "(contact_a.id = $contactID OR ($where))";
 124     }
 125     return $where;
 126   }
 127
 128   /**
 129    * Get all the groups the user has access to for the given operation.
 130    *
 131    * @param int $type
 132    *   The type of permission needed.
 133    * @param int $contactID
 134    *   The contactID for whom the check is made.
 135    *
 136    * @param string $tableName
 137    * @param null $allGroups
 138    * @param null $includedGroups
 139    *
 140    * @return array
 141    *   the ids of the groups for which the user has permissions
 142    */
 143   public static function group(
 144     $type,
 145     $contactID = NULL,
 146     $tableName = 'civicrm_saved_search',
 147     $allGroups = NULL,
 148     $includedGroups = NULL
 149   ) {
 150     if ($contactID == NULL) {
 151       $contactID = CRM_Core_Session::getLoggedInContactID();
 152     }
 153
 154     if (!$contactID) {
 155       // anonymous user
 156       $contactID = 0;
 157     }
 158
 159     return CRM_ACL_BAO_ACL::group($type, $contactID, $tableName, $allGroups, $includedGroups);
 160   }
 161
 162   /**
 163    * Check if the user has access to this group for operation $type
 164    *
 165    * @param int $type
 166    *   The type of permission needed.
 167    * @param int $groupID
 168    * @param int $contactID
 169    *   The contactID for whom the check is made.
 170    * @param string $tableName
 171    * @param null $allGroups
 172    * @param null $includedGroups
 173    *
 174    * @return bool
 175    */
 176   public static function groupPermission(
 177     $type,
 178     $groupID,
 179     $contactID = NULL,
 180     $tableName = 'civicrm_saved_search',
 181     $allGroups = NULL,
 182     $includedGroups = NULL
 183   ) {
 184
 185     if (!isset(Civi::$statics[__CLASS__]) || !isset(Civi::$statics[__CLASS__]['group_permission'])) {
 186       Civi::$statics[__CLASS__]['group_permission'] = [];
 187     }
 188
 189     if (!$contactID) {
 190       $contactID = CRM_Core_Session::singleton()->getLoggedInContactID();
 191     }
 192
 193     $key = "{$tableName}_{$type}_{$contactID}";
 194     if (!array_key_exists($key, Civi::$statics[__CLASS__]['group_permission'])) {
 195       Civi::$statics[__CLASS__]['group_permission'][$key] = self::group($type, $contactID, $tableName, $allGroups, $includedGroups);
 196     }
 197
 198     return in_array($groupID, Civi::$statics[__CLASS__]['group_permission'][$key]);
 199   }
 200
 201 }