CRM/ACL/BAO/ACL.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.5                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2014                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26 */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2014
  32  * $Id$
  33  *
  34  */
  35
  36 /**
  37  *  Access Control List
  38  */
  39 class CRM_ACL_BAO_ACL extends CRM_ACL_DAO_ACL {
  40   static $_entityTable = NULL;
  41   static $_objectTable = NULL;
  42   static $_operation = NULL;
  43
  44   static $_fieldKeys = NULL;
  45
  46   static function entityTable() {
  47     if (!self::$_entityTable) {
  48       self::$_entityTable = array(
  49         'civicrm_contact' => ts('Contact'),
  50         'civicrm_acl_role' => ts('ACL Role'),
  51       );
  52     }
  53     return self::$_entityTable;
  54   }
  55
  56   static function objectTable() {
  57     if (!self::$_objectTable) {
  58       self::$_objectTable = array(
  59         'civicrm_contact' => ts('Contact'),
  60         'civicrm_group' => ts('Group'),
  61         'civicrm_saved_search' => ts('Contact Group'),
  62         'civicrm_admin' => ts('Administer'),
  63         'civicrm_admin' => ts('Import'),
  64       );
  65     }
  66     return self::$_objectTable;
  67   }
  68
  69   static function operation() {
  70     if (!self::$_operation) {
  71       self::$_operation = array(
  72         'View' => ts('View'),
  73         'Edit' => ts('Edit'),
  74         'Create' => ts('Create'),
  75         'Delete' => ts('Delete'),
  76         'Search' => ts('Search'),
  77         'All' => ts('All'),
  78       );
  79     }
  80     return self::$_operation;
  81   }
  82
  83   /**
  84    * Construct a WHERE clause to handle permissions to $object_*
  85    *
  86    * @param array ref $tables -   Any tables that may be needed in the FROM
  87    * @param string $operation -   The operation being attempted
  88    * @param string $object_table -    The table of the object in question
  89    * @param int $object_id    -   The ID of the object in question
  90    * @param int $acl_id   -       If it's a grant/revoke operation, the ACL ID
  91    * @param boolean $acl_role -  For grant operations, this flag determines if we're granting a single acl (false) or an entire group.
  92    *
  93    * @return string           -   The WHERE clause, or 0 on failure
  94    * @access public
  95    * @static
  96    */
  97   public static function permissionClause(&$tables, $operation,
  98     $object_table = NULL, $object_id = NULL,
  99     $acl_id = NULL, $acl_role = FALSE
 100   ) {
 101     $dao = new CRM_ACL_DAO_ACL;
 102
 103     $t = array(
 104       'ACL' => self::getTableName(),
 105       'ACLRole' => 'civicrm_acl_role',
 106       'ACLEntityRole' => CRM_ACL_DAO_EntityRole::getTableName(),
 107       'Contact' => CRM_Contact_DAO_Contact::getTableName(),
 108       'Group' => CRM_Contact_DAO_Group::getTableName(),
 109       'GroupContact' => CRM_Contact_DAO_GroupContact::getTableName(),
 110     );
 111
 112     $session = CRM_Core_Session::singleton();
 113     $contact_id = $session->get('userID');
 114
 115     $where = " {$t['ACL']}.operation = '" . CRM_Utils_Type::escape($operation, 'String') . "'";
 116
 117     /* Include clause if we're looking for a specific table/id permission */
 118
 119
 120     if (!empty($object_table)) {
 121       $where .= " AND ( {$t['ACL']}.object_table IS null
 122                          OR ({$t['ACL']}.object_table   = '" . CRM_Utils_Type::escape($object_table, 'String') . "'";
 123       if (!empty($object_id)) {
 124         $where .= " AND ({$t['ACL']}.object_id IS null
 125                             OR {$t['ACL']}.object_id = " . CRM_Utils_Type::escape($object_id, 'Integer') . ')';
 126       }
 127       $where .= '))';
 128     }
 129
 130     /* Include clause if we're granting an ACL or ACL Role */
 131
 132
 133     if (!empty($acl_id)) {
 134       $where .= " AND ({$t['ACL']}.acl_id IS null
 135                         OR {$t['ACL']}.acl_id   = " . CRM_Utils_Type::escape($acl_id, 'Integer') . ')';
 136       if ($acl_role) {
 137         $where .= " AND {$t['ACL']}.acl_table = '{$t['ACLRole']}'";
 138       }
 139       else {
 140         $where .= " AND {$t['ACL']}.acl_table = '{$t['ACL']}'";
 141       }
 142     }
 143
 144     $query = array();
 145
 146     /* Query for permissions granted to all contacts in the domain */
 147
 148
 149     $query[] = "SELECT      {$t['ACL']}.*, 0 as override
 150                     FROM        {$t['ACL']}
 151
 152                     WHERE       {$t['ACL']}.entity_table    = '{$t['Domain']}'
 153                             AND ($where)";
 154
 155     /* Query for permissions granted to all contacts through an ACL group */
 156
 157
 158     $query[] = "SELECT      {$t['ACL']}.*, 0 as override
 159                     FROM        {$t['ACL']}
 160
 161                     INNER JOIN  {$t['ACLEntityRole']}
 162                             ON  ({$t['ACL']}.entity_table = '{$t['ACLRole']}'
 163                             AND     {$t['ACL']}.entity_id =
 164                                     {$t['ACLEntityRole']}.acl_role_id)
 165
 166                     INNER JOIN  {$t['ACLRole']}
 167                             ON      {$t['ACL']}.entity_id =
 168                                     {$t['ACLRole']}.id
 169
 170                     WHERE       {$t['ACLEntityRole']}.entity_table =
 171                                     '{$t['Domain']}'
 172                             AND {$t['ACLRole']}.is_active      = 1
 173                             AND ($where)";
 174
 175     /* Query for permissions granted directly to the contact */
 176
 177
 178     $query[] = "SELECT      {$t['ACL']}.*, 1 as override
 179                     FROM        {$t['ACL']}
 180
 181                     INNER JOIN  {$t['Contact']}
 182                             ON  ({$t['ACL']}.entity_table = '{$t['Contact']}'
 183                             AND     {$t['ACL']}.entity_id = {$t['Contact']}.id)
 184
 185                     WHERE       {$t['Contact']}.id          = $contact_id
 186                             AND ($where)";
 187
 188     /* Query for permissions granted to the contact through an ACL group */
 189
 190
 191     $query[] = "SELECT      {$t['ACL']}.*, 1 as override
 192                     FROM        {$t['ACL']}
 193
 194                     INNER JOIN  {$t['ACLEntityRole']}
 195                             ON  ({$t['ACL']}.entity_table = '{$t['ACLRole']}'
 196                             AND     {$t['ACL']}.entity_id =
 197                                     {$t['ACLEntityRole']}.acl_role_id)
 198
 199                     INNER JOIN  {$t['ACLRole']}
 200                             ON  {$t['ACL']}.entity_id = {$t['ACLRole']}.id
 201
 202                     WHERE       {$t['ACLEntityRole']}.entity_table =
 203                                     '{$t['Contact']}'
 204                         AND     {$t['ACLRole']}.is_active      = 1
 205                         AND     {$t['ACLEntityRole']}.entity_id  = $contact_id
 206                         AND     ($where)";
 207
 208     /* Query for permissions granted to the contact through a group */
 209
 210
 211     $query[] = "SELECT      {$t['ACL']}.*, 0 as override
 212                     FROM        {$t['ACL']}
 213
 214                     INNER JOIN  {$t['GroupContact']}
 215                             ON  ({$t['ACL']}.entity_table = '{$t['Group']}'
 216                             AND     {$t['ACL']}.entity_id =
 217                                     {$t['GroupContact']}.group_id)
 218
 219                     WHERE       ($where)
 220                         AND     {$t['GroupContact']}.contact_id = $contact_id
 221                         AND     {$t['GroupContact']}.status     = 'Added')";
 222
 223
 224     /* Query for permissions granted through an ACL group to a Contact
 225          * group */
 226
 227
 228     $query[] = "SELECT      {$t['ACL']}.*, 0 as override
 229                     FROM        {$t['ACL']}
 230
 231                     INNER JOIN  {$t['ACLEntityRole']}
 232                             ON  ({$t['ACL']}.entity_table = '{$t['ACLRole']}'
 233                             AND     {$t['ACL']}.entity_id =
 234                                     {$t['ACLEntityRole']}.acl_role_id)
 235
 236                     INNER JOIN  {$t['ACLRole']}
 237                             ON  {$t['ACL']}.entity_id = {$t['ACLRole']}.id
 238
 239                     INNER JOIN  {$t['GroupContact']}
 240                             ON  ({$t['ACLEntityRole']}.entity_table =
 241                                     '{$t['Group']}'
 242                             AND     {$t['ACLEntityRole']}.entity_id =
 243                                     {$t['GroupContact']}.group_id)
 244
 245                     WHERE       ($where)
 246                         AND     {$t['ACLRole']}.is_active      = 1
 247                         AND     {$t['GroupContact']}.contact_id = $contact_id
 248                         AND     {$t['GroupContact']}.status     = 'Added'";
 249
 250     $union = '(' . implode(') UNION DISTINCT (', $query) . ')';
 251
 252     $dao->query($union);
 253
 254     $allow    = array(0);
 255     $deny     = array(0);
 256     $override = array();
 257
 258     while ($dao->fetch()) {
 259       /* Instant bypass for the following cases:
 260              * 1) the rule governs all tables
 261              * 2) the rule governs all objects in the table in question
 262              * 3) the rule governs the specific object we want
 263              */
 264
 265
 266       if (empty($dao->object_table) ||
 267         ($dao->object_table == $object_table
 268           && (empty($dao->object_id)
 269             || $dao->object_id == $object_id
 270           )
 271         )
 272       ) {
 273         $clause = 1;
 274       }
 275       else {
 276         /* Otherwise try to generate a clause for this rule */
 277
 278
 279         $clause = self::getClause(
 280           $dao->object_table, $dao->object_id, $tables
 281         );
 282
 283         /* If the clause returned is null, then the rule is a blanket
 284                  * (id is null) on a table other than the one we're interested
 285                  * in.  So skip it. */
 286
 287
 288         if (empty($clause)) {
 289           continue;
 290         }
 291       }
 292
 293       /* Now we figure out if this is an allow or deny rule, and possibly
 294              * a contact-level override */
 295
 296
 297       if ($dao->deny) {
 298         $deny[] = $clause;
 299       }
 300       else {
 301         $allow[] = $clause;
 302
 303         if ($dao->override) {
 304           $override[] = $clause;
 305         }
 306       }
 307     }
 308
 309     $allows = '(' . implode(' OR ', $allow) . ')';
 310     $denies = '(' . implode(' OR ', $deny) . ')';
 311     if (!empty($override)) {
 312       $denies = '(NOT (' . implode(' OR ', $override) . ") AND $denies)";
 313     }
 314
 315     return "($allows AND NOT $denies)";
 316   }
 317
 318   /**
 319    * Given a table and id pair, return the filter clause
 320    *
 321    * @param string $table -   The table owning the object
 322    * @param int $id   -       The ID of the object
 323    * @param array ref $tables - Tables that will be needed in the FROM
 324    *
 325    * @return string|null  -   WHERE-style clause to filter results,
 326    or null if $table or $id is null
 327    * @access public
 328    * @static
 329    */
 330   public static function getClause($table, $id, &$tables) {
 331     $table       = CRM_Utils_Type::escape($table, 'String');
 332     $id          = CRM_Utils_Type::escape($id, 'Integer');
 333     $whereTables = array();
 334
 335     $ssTable = CRM_Contact_BAO_SavedSearch::getTableName();
 336
 337     if (empty($table)) {
 338       return NULL;
 339     }
 340     elseif ($table == $ssTable) {
 341       return CRM_Contact_BAO_SavedSearch::whereClause($id, $tables, $whereTables);
 342     }
 343     elseif (!empty($id)) {
 344       $tables[$table] = TRUE;
 345       return "$table.id = $id";
 346     }
 347     return NULL;
 348   }
 349
 350   /**
 351    * Construct an associative array of an ACL rule's properties
 352    *
 353    * @param   string  sprintf format for array
 354    * @param   bool    empty only return elemnts that have a value set.
 355    *
 356    * @return array    - Assoc. array of the ACL rule's properties
 357    * @access public
 358    */
 359   function toArray($format = '%s', $hideEmpty = false) {
 360     $result = array();
 361
 362     if (!self::$_fieldKeys) {
 363       $fields = CRM_ACL_DAO_ACL::fields();
 364       self::$_fieldKeys = array_keys($fields);
 365     }
 366
 367     foreach (self::$_fieldKeys as $field) {
 368       $result[$field] = $this->$field;
 369     }
 370     return $result;
 371   }
 372
 373   /**
 374    * Retrieve ACLs for a contact or group.  Note that including a contact id
 375    * without a group id will return those ACL rules which are granted
 376    * directly to the contact, but not those granted to the contact through
 377    * any/all of his group memberships.
 378    *
 379    * @param int $contact_id       -   ID of a contact to search for
 380    * @param int $group_id         -   ID of a group to search for
 381    * @param boolean $aclRoles    -   Should we include ACL Roles
 382    *
 383    * @return array                -   Array of assoc. arrays of ACL rules
 384    * @access public
 385    * @static
 386    */
 387   public static function &getACLs($contact_id = NULL, $group_id = NULL, $aclRoles = FALSE) {
 388     $results = array();
 389
 390     if (empty($contact_id)) {
 391       return $results;
 392     }
 393
 394     $contact_id = CRM_Utils_Type::escape($contact_id, 'Integer');
 395     if ($group_id) {
 396       $group_id = CRM_Utils_Type::escape($group_id, 'Integer');
 397     }
 398
 399     $rule = new CRM_ACL_BAO_ACL();
 400
 401
 402     $acl     = self::getTableName();
 403     $contact = CRM_Contact_BAO_Contact::getTableName();
 404     $c2g     = CRM_Contact_BAO_GroupContact::getTableName();
 405     $group   = CRM_Contact_BAO_Group::getTableName();
 406
 407     $query = " SELECT      $acl.*
 408                         FROM        $acl ";
 409
 410     if (!empty($group_id)) {
 411       $query .= " INNER JOIN  $c2g
 412                             ON      $acl.entity_id      = $c2g.group_id
 413                         WHERE       $acl.entity_table   = '$group'
 414                             AND     $acl.is_active      = 1
 415                             AND     $c2g.group_id       = $group_id";
 416
 417       if (!empty($contact_id)) {
 418         $query .= " AND     $c2g.contact_id     = $contact_id
 419                             AND     $c2g.status         = 'Added'";
 420       }
 421     }
 422     else {
 423       if (!empty($contact_id)) {
 424         $query .= " WHERE   $acl.entity_table   = '$contact'
 425                             AND     $acl.entity_id      = $contact_id";
 426       }
 427     }
 428
 429     $rule->query($query);
 430
 431     while ($rule->fetch()) {
 432       $results[$rule->id] = $rule->toArray();
 433     }
 434
 435     if ($aclRoles) {
 436       $results += self::getACLRoles($contact_id, $group_id);
 437     }
 438
 439     return $results;
 440   }
 441
 442   /**
 443    * Get all of the ACLs through ACL groups
 444    *
 445    * @param int $contact_id   -   ID of a contact to search for
 446    * @param int $group_id     -   ID of a group to search for
 447    *
 448    * @return array            -   Array of assoc. arrays of ACL rules
 449    * @access public
 450    * @static
 451    */
 452   public static function &getACLRoles($contact_id = NULL, $group_id = NULL) {
 453     $contact_id = CRM_Utils_Type::escape($contact_id, 'Integer');
 454     if ($group_id) {
 455       $group_id = CRM_Utils_Type::escape($group_id, 'Integer');
 456     }
 457
 458     $rule = new CRM_ACL_BAO_ACL();
 459
 460     $acl         = self::getTableName();
 461     $aclRole     = 'civicrm_acl_role';
 462     $aclRoleJoin = CRM_ACL_DAO_EntityRole::getTableName();
 463     $contact     = CRM_Contact_BAO_Contact::getTableName();
 464     $c2g         = CRM_Contact_BAO_GroupContact::getTableName();
 465     $group       = CRM_Contact_BAO_Group::getTableName();
 466
 467     $query = "   SELECT          $acl.*
 468                         FROM            $acl
 469                         INNER JOIN      civicrm_option_group og
 470                                 ON      og.name = 'acl_role'
 471                         INNER JOIN      civicrm_option_value ov
 472                                 ON      $acl.entity_table   = '$aclRole'
 473                                 AND     ov.option_group_id  = og.id
 474                                 AND     $acl.entity_id      = ov.value";
 475
 476     if (!empty($group_id)) {
 477       $query .= " INNER JOIN  $c2g
 478                             ON      $acl.entity_id     = $c2g.group_id
 479                         WHERE       $acl.entity_table  = '$group'
 480                             AND     $acl.is_active     = 1
 481                             AND     $c2g.group_id           = $group_id";
 482
 483       if (!empty($contact_id)) {
 484         $query .= " AND     $c2g.contact_id = $contact_id
 485                             AND     $c2g.status = 'Added'";
 486       }
 487     }
 488     else {
 489       if (!empty($contact_id)) {
 490         $query .= " WHERE   $acl.entity_table  = '$contact'
 491                                 AND $acl.is_active     = 1
 492                                 AND $acl.entity_id     = $contact_id";
 493       }
 494     }
 495
 496     $results = array();
 497
 498     $rule->query($query);
 499
 500     while ($rule->fetch()) {
 501       $results[$rule->id] = $rule->toArray();
 502     }
 503
 504     return $results;
 505   }
 506
 507   /**
 508    * Get all ACLs granted to a contact through all group memberships
 509    *
 510    * @param int $contact_id       -   The contact's ID
 511    * @param boolean $aclRoles     -   Include ACL Roles?
 512    *
 513    * @return array                -   Assoc array of ACL rules
 514    * @access public
 515    * @static
 516    */
 517   public static function &getGroupACLs($contact_id, $aclRoles = FALSE) {
 518     $contact_id = CRM_Utils_Type::escape($contact_id, 'Integer');
 519
 520     $rule = new CRM_ACL_BAO_ACL();
 521
 522
 523     $acl     = self::getTableName();
 524     $c2g     = CRM_Contact_BAO_GroupContact::getTableName();
 525     $group   = CRM_Contact_BAO_Group::getTableName();
 526     $results = array();
 527
 528     if ($contact_id) {
 529       $query = "
 530 SELECT      $acl.*
 531   FROM      $acl
 532  INNER JOIN  $c2g
 533         ON  $acl.entity_id      = $c2g.group_id
 534      WHERE  $acl.entity_table   = '$group'
 535        AND  $c2g.contact_id     = $contact_id
 536        AND  $c2g.status         = 'Added'";
 537
 538       $rule->query($query);
 539
 540       while ($rule->fetch()) {
 541         $results[$rule->id] = $rule->toArray();
 542       }
 543     }
 544
 545     if ($aclRoles) {
 546       $results += self::getGroupACLRoles($contact_id);
 547     }
 548
 549     return $results;
 550   }
 551
 552   /**
 553    * Get all of the ACLs for a contact through ACL groups owned by Contact
 554    * groups.
 555    *
 556    * @param int $contact_id   -   ID of a contact to search for
 557    *
 558    * @return array            -   Array of assoc. arrays of ACL rules
 559    * @access public
 560    * @static
 561    */
 562   public static function &getGroupACLRoles($contact_id) {
 563     $contact_id = CRM_Utils_Type::escape($contact_id, 'Integer');
 564
 565     $rule = new CRM_ACL_BAO_ACL();
 566
 567     $acl = self::getTableName();
 568     $aclRole = 'civicrm_acl_role';
 569
 570
 571     $aclER = CRM_ACL_DAO_EntityRole::getTableName();
 572     $c2g   = CRM_Contact_BAO_GroupContact::getTableName();
 573     $group = CRM_Contact_BAO_Group::getTableName();
 574
 575     $query = "   SELECT          $acl.*
 576                         FROM            $acl
 577                         INNER JOIN      civicrm_option_group og
 578                                 ON      og.name = 'acl_role'
 579                         INNER JOIN      civicrm_option_value ov
 580                                 ON      $acl.entity_table   = '$aclRole'
 581                                 AND     ov.option_group_id  = og.id
 582                                 AND     $acl.entity_id      = ov.value
 583                                 AND     ov.is_active        = 1
 584                         INNER JOIN      $aclER
 585                                 ON      $aclER.acl_role_id = $acl.entity_id
 586                                 AND     $aclER.is_active    = 1
 587                         INNER JOIN  $c2g
 588                                 ON      $aclER.entity_id      = $c2g.group_id
 589                                 AND     $aclER.entity_table   = 'civicrm_group'
 590                         WHERE       $acl.entity_table       = '$aclRole'
 591                             AND     $acl.is_active          = 1
 592                             AND     $c2g.contact_id         = $contact_id
 593                             AND     $c2g.status             = 'Added'";
 594
 595     $results = array();
 596
 597     $rule->query($query);
 598
 599     while ($rule->fetch()) {
 600       $results[$rule->id] = $rule->toArray();
 601     }
 602
 603     // also get all acls for "Any Role" case
 604     // and authenticated User Role if present
 605     $roles = "0";
 606     $session = CRM_Core_Session::singleton();
 607     if ($session->get('ufID') > 0) {
 608       $roles .= ",2";
 609     }
 610
 611     $query = "
 612 SELECT $acl.*
 613   FROM $acl
 614  WHERE $acl.entity_id      IN ( $roles )
 615    AND $acl.entity_table   = 'civicrm_acl_role'
 616 ";
 617
 618     $rule->query($query);
 619     while ($rule->fetch()) {
 620       $results[$rule->id] = $rule->toArray();
 621     }
 622
 623     return $results;
 624   }
 625
 626   /**
 627    * Get all ACLs owned by a given contact, including domain and group-level.
 628    *
 629    * @param int $contact_id   -   The contact ID
 630    *
 631    * @return array            -   Assoc array of ACL rules
 632    * @access public
 633    * @static
 634    */
 635   public static function &getAllByContact($contact_id) {
 636     $result = array();
 637
 638     /* First, the contact-specific ACLs, including ACL Roles */
 639     $result += self::getACLs($contact_id, NULL, TRUE);
 640
 641     /* Then, all ACLs granted through group membership */
 642     $result += self::getGroupACLs($contact_id, TRUE);
 643
 644     return $result;
 645   }
 646
 647   static function create(&$params) {
 648     $dao = new CRM_ACL_DAO_ACL();
 649     $dao->copyValues($params);
 650     $dao->save();
 651     return $dao;
 652   }
 653
 654   static function retrieve(&$params, &$defaults) {
 655     CRM_Core_DAO::commonRetrieve('CRM_ACL_DAO_ACL', $params, $defaults);
 656   }
 657
 658   /**
 659    * update the is_active flag in the db
 660    *
 661    * @param int      $id        id of the database record
 662    * @param boolean  $is_active value we want to set the is_active field
 663    *
 664    * @return Object             DAO object on sucess, null otherwise
 665    * @static
 666    */
 667   static function setIsActive($id, $is_active) {
 668     // note this also resets any ACL cache
 669     CRM_Core_BAO_Cache::deleteGroup('contact fields');
 670
 671     return CRM_Core_DAO::setFieldValue('CRM_ACL_DAO_ACL', $id, 'is_active', $is_active);
 672   }
 673
 674   static function check($str, $contactID) {
 675
 676     $acls = CRM_ACL_BAO_Cache::build($contactID);
 677
 678     $aclKeys = array_keys($acls);
 679     $aclKeys = implode(',', $aclKeys);
 680
 681     if (empty($aclKeys)) {
 682       return FALSE;
 683     }
 684
 685
 686     $query = "
 687 SELECT count( a.id )
 688   FROM civicrm_acl_cache c, civicrm_acl a
 689  WHERE c.acl_id       =  a.id
 690    AND a.is_active    =  1
 691    AND a.object_table =  %1
 692    AND a.id           IN ( $aclKeys )
 693 ";
 694     $params = array(1 => array($str, 'String'));
 695
 696     $count = CRM_Core_DAO::singleValueQuery($query, $params);
 697     return ($count) ? TRUE : FALSE;
 698   }
 699
 700   public static function whereClause($type, &$tables, &$whereTables, $contactID = NULL) {
 701     $acls = CRM_ACL_BAO_Cache::build($contactID);
 702     //CRM_Core_Error::debug( "a: $contactID", $acls );
 703
 704     $whereClause = NULL;
 705     $clauses = array();
 706
 707     if (!empty($acls)) {
 708       $aclKeys = array_keys($acls);
 709       $aclKeys = implode(',', $aclKeys);
 710
 711       $query = "
 712 SELECT   a.operation, a.object_id
 713   FROM   civicrm_acl_cache c, civicrm_acl a
 714  WHERE   c.acl_id       =  a.id
 715    AND   a.is_active    =  1
 716    AND   a.object_table = 'civicrm_saved_search'
 717    AND   a.id        IN ( $aclKeys )
 718 ORDER BY a.object_id
 719 ";
 720
 721       $dao = CRM_Core_DAO::executeQuery($query);
 722
 723       // do an or of all the where clauses u see
 724       $ids = array();
 725       while ($dao->fetch()) {
 726         // make sure operation matches the type TODO
 727         if (self::matchType($type, $dao->operation)) {
 728           if (!$dao->object_id) {
 729             $ids = array();
 730             $whereClause = ' ( 1 ) ';
 731             break;
 732           }
 733           $ids[] = $dao->object_id;
 734         }
 735       }
 736
 737       if (!empty($ids)) {
 738         $ids = implode(',', $ids);
 739         $query = "
 740 SELECT g.*
 741   FROM civicrm_group g
 742  WHERE g.id IN ( $ids )
 743  AND   g.is_active = 1
 744 ";
 745         $dao            = CRM_Core_DAO::executeQuery($query);
 746         $staticGroupIDs = array();
 747         $cachedGroupIDs = array();
 748         while ($dao->fetch()) {
 749           // currently operation is restrcited to VIEW/EDIT
 750           if ($dao->where_clause) {
 751             if ($dao->select_tables) {
 752               $tmpTables = array();
 753               foreach (unserialize($dao->select_tables) as $tmpName => $tmpInfo) {
 754                 if ($tmpName == '`civicrm_group_contact-' . $dao->id . '`') {
 755                   $tmpName = '`civicrm_group_contact-ACL`';
 756                   $tmpInfo = str_replace('civicrm_group_contact-' . $dao->id, 'civicrm_group_contact-ACL', $tmpInfo);
 757                 }
 758                 elseif ($tmpName == '`civicrm_group_contact_cache_' . $dao->id . '`') {
 759                   $tmpName = '`civicrm_group_contact_cache-ACL`';
 760                   $tmpInfo = str_replace('civicrm_group_contact_cache_' . $dao->id, 'civicrm_group_contact_cache-ACL', $tmpInfo);
 761                 }
 762                 $tmpTables[$tmpName] = $tmpInfo;
 763               }
 764               $tables = array_merge($tables,
 765                 $tmpTables
 766               );
 767             }
 768             if ($dao->where_tables) {
 769               $tmpTables = array();
 770               foreach (unserialize($dao->where_tables) as $tmpName => $tmpInfo) {
 771                 if ($tmpName == '`civicrm_group_contact-' . $dao->id . '`') {
 772                   $tmpName          = '`civicrm_group_contact-ACL`';
 773                   $tmpInfo          = str_replace('civicrm_group_contact-' . $dao->id, 'civicrm_group_contact-ACL', $tmpInfo);
 774                   $staticGroupIDs[] = $dao->id;
 775                 }
 776                 elseif ($tmpName == '`civicrm_group_contact_cache_' . $dao->id . '`') {
 777                   $tmpName          = '`civicrm_group_contact_cache-ACL`';
 778                   $tmpInfo          = str_replace('civicrm_group_contact_cache_' . $dao->id, 'civicrm_group_contact_cache-ACL', $tmpInfo);
 779                   $cachedGroupIDs[] = $dao->id;
 780                 }
 781                 $tmpTables[$tmpName] = $tmpInfo;
 782               }
 783               $whereTables = array_merge($whereTables, $tmpTables);
 784             }
 785           }
 786
 787           if (($dao->saved_search_id || $dao->children || $dao->parents) &&
 788             $dao->cache_date == NULL) {
 789             CRM_Contact_BAO_GroupContactCache::load($dao);
 790           }
 791         }
 792
 793         if ($staticGroupIDs) {
 794           $clauses[] = '( `civicrm_group_contact-ACL`.group_id IN (' . join(', ', $staticGroupIDs) . ') AND `civicrm_group_contact-ACL`.status IN ("Added") )';
 795         }
 796
 797         if ($cachedGroupIDs) {
 798           $clauses[] = '`civicrm_group_contact_cache-ACL`.group_id IN (' . join(', ', $cachedGroupIDs) . ')';
 799         }
 800       }
 801     }
 802
 803     if (!empty($clauses)) {
 804       $whereClause = ' ( ' . implode(' OR ', $clauses) . ' ) ';
 805     }
 806
 807     // call the hook to get additional whereClauses
 808     CRM_Utils_Hook::aclWhereClause($type, $tables, $whereTables, $contactID, $whereClause);
 809
 810     if (empty($whereClause)) {
 811       $whereClause = ' ( 0 ) ';
 812     }
 813
 814     return $whereClause;
 815   }
 816
 817   public static function group($type,
 818     $contactID      = NULL,
 819     $tableName      = 'civicrm_saved_search',
 820     $allGroups      = NULL,
 821     $includedGroups = NULL
 822   ) {
 823
 824     $acls = CRM_ACL_BAO_Cache::build($contactID);
 825
 826     $ids = array();
 827     if (!empty($acls)) {
 828       $aclKeys = array_keys($acls);
 829       $aclKeys = implode(',', $aclKeys);
 830
 831       $cacheKey = "$tableName-$aclKeys";
 832       $cache = CRM_Utils_Cache::singleton();
 833       $ids = $cache->get($cacheKey);
 834       if (!$ids) {
 835         $query = "
 836 SELECT   a.operation, a.object_id
 837   FROM   civicrm_acl_cache c, civicrm_acl a
 838  WHERE   c.acl_id       =  a.id
 839    AND   a.is_active    =  1
 840    AND   a.object_table = %1
 841    AND   a.id        IN ( $aclKeys )
 842 GROUP BY a.operation,a.object_id
 843 ORDER BY a.object_id
 844 ";
 845         $params = array(1 => array($tableName, 'String'));
 846         $dao = CRM_Core_DAO::executeQuery($query, $params);
 847         while ($dao->fetch()) {
 848           if ($dao->object_id) {
 849             if (self::matchType($type, $dao->operation)) {
 850               $ids[] = $dao->object_id;
 851             }
 852           }
 853           else {
 854             // this user has got the permission for all objects of this type
 855             // check if the type matches
 856             if (self::matchType($type, $dao->operation)) {
 857               foreach ($allGroups as $id => $dontCare) {
 858                 $ids[] = $id;
 859               }
 860             }
 861             break;
 862           }
 863         }
 864         $cache->set($cacheKey, $ids);
 865       }
 866     }
 867
 868     if (empty($ids) && !empty($includedGroups) &&
 869       is_array($includedGroups)
 870     ) {
 871       $ids = $includedGroups;
 872     }
 873
 874     CRM_Utils_Hook::aclGroup($type, $contactID, $tableName, $allGroups, $ids);
 875
 876     return $ids;
 877   }
 878
 879   static function matchType($type, $operation) {
 880     $typeCheck = FALSE;
 881     switch ($operation) {
 882       case 'All':
 883         $typeCheck = TRUE;
 884         break;
 885
 886       case 'View':
 887         if ($type == CRM_ACL_API::VIEW) {
 888           $typeCheck = TRUE;
 889         }
 890         break;
 891
 892       case 'Edit':
 893         if ($type == CRM_ACL_API::VIEW || $type == CRM_ACL_API::EDIT) {
 894           $typeCheck = TRUE;
 895         }
 896         break;
 897
 898       case 'Create':
 899         if ($type == CRM_ACL_API::CREATE) {
 900           $typeCheck = TRUE;
 901         }
 902         break;
 903
 904       case 'Delete':
 905         if ($type == CRM_ACL_API::DELETE) {
 906           $typeCheck = TRUE;
 907         }
 908         break;
 909
 910       case 'Search':
 911         if ($type == CRM_ACL_API::SEARCH) {
 912           $typeCheck = TRUE;
 913         }
 914         break;
 915     }
 916     return $typeCheck;
 917   }
 918
 919   /**
 920    * Function to delete ACL records
 921    *
 922    * @param  int  $aclId     ID of the ACL record to be deleted.
 923    *
 924    * @access public
 925    * @static
 926    */
 927   static function del($aclId) {
 928     // delete all entries from the acl cache
 929     CRM_ACL_BAO_Cache::resetCache();
 930
 931     $acl = new CRM_ACL_DAO_ACL();
 932     $acl->id = $aclId;
 933     $acl->delete();
 934   }
 935 }
 936