3 +--------------------------------------------------------------------+
4 | CiviCRM version 4.7 |
5 +--------------------------------------------------------------------+
6 | Copyright CiviCRM LLC (c) 2004-2015 |
7 +--------------------------------------------------------------------+
8 | This file is a part of CiviCRM. |
10 | CiviCRM is free software; you can copy, modify, and distribute it |
11 | under the terms of the GNU Affero General Public License |
12 | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. |
14 | CiviCRM is distributed in the hope that it will be useful, but |
15 | WITHOUT ANY WARRANTY; without even the implied warranty of |
16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
17 | See the GNU Affero General Public License for more details. |
19 | You should have received a copy of the GNU Affero General Public |
20 | License and the CiviCRM Licensing Exception along |
21 | with this program; if not, contact CiviCRM LLC |
22 | at info[AT]civicrm[DOT]org. If you have questions about the |
23 | GNU Affero General Public License or the licensing of CiviCRM, |
24 | see the CiviCRM license FAQ at http://civicrm.org/licensing |
25 +--------------------------------------------------------------------+
31 * @copyright CiviCRM LLC (c) 2004-2015
33 class CRM_Contact_BAO_Contact_Permission
{
36 * Check if the logged in user has permissions for the operation type.
40 * @param int|string $type the type of operation (view|edit)
43 * true if the user has permission, false otherwise
45 public static function allow($id, $type = CRM_Core_Permission
::VIEW
) {
47 $whereTables = array();
49 # FIXME: push this somewhere below, to not give this permission so many rights
50 $isDeleted = (bool) CRM_Core_DAO
::getFieldValue('CRM_Contact_DAO_Contact', $id, 'is_deleted');
51 if (CRM_Core_Permission
::check('access deleted contacts') && $isDeleted) {
55 // short circuit for admin rights here so we avoid unneeeded queries
56 // some duplication of code, but we skip 3-5 queries
57 if (CRM_Core_Permission
::check('edit all contacts') ||
58 ($type == CRM_ACL_API
::VIEW
&& CRM_Core_Permission
::check('view all contacts'))
63 //check permission based on relationship, CRM-2963
64 if (self
::relationship($id)) {
68 $permission = CRM_ACL_API
::whereClause($type, $tables, $whereTables);
70 $from = CRM_Contact_BAO_Query
::fromClause($whereTables);
73 SELECT count(DISTINCT contact_a.id)
75 WHERE contact_a.id = %1 AND $permission";
76 $params = array(1 => array($id, 'Integer'));
78 return (CRM_Core_DAO
::singleValueQuery($query, $params) > 0) ?
TRUE : FALSE;
82 * Fill the acl contact cache for this contact id if empty.
85 * @param int|string $type the type of operation (view|edit)
87 * Should we force a recompute.
89 public static function cache($userID, $type = CRM_Core_Permission
::VIEW
, $force = FALSE) {
90 static $_processed = array();
92 if ($type = CRM_Core_Permission
::VIEW
) {
93 $operationClause = " operation IN ( 'Edit', 'View' ) ";
97 $operationClause = " operation = 'Edit' ";
102 if (!empty($_processed[$userID])) {
106 // run a query to see if the cache is filled
109 FROM civicrm_acl_contact_cache
113 $params = array(1 => array($userID, 'Integer'));
114 $count = CRM_Core_DAO
::singleValueQuery($sql, $params);
116 $_processed[$userID] = 1;
122 $whereTables = array();
124 $permission = CRM_ACL_API
::whereClause($type, $tables, $whereTables, $userID);
126 $from = CRM_Contact_BAO_Query
::fromClause($whereTables);
128 CRM_Core_DAO
::executeQuery("
129 INSERT INTO civicrm_acl_contact_cache ( user_id, contact_id, operation )
130 SELECT $userID as user_id, contact_a.id as contact_id, '$operation' as operation
133 GROUP BY contact_a.id
134 ON DUPLICATE KEY UPDATE
135 user_id=VALUES(user_id),
136 contact_id=VALUES(contact_id),
137 operation=VALUES(operation)"
140 $_processed[$userID] = 1;
144 * Check if there are any contacts in cache table.
146 * @param int|string $type the type of operation (view|edit)
147 * @param int $contactID
152 public static function hasContactsInCache(
153 $type = CRM_Core_Permission
::VIEW
,
157 $session = CRM_Core_Session
::singleton();
158 $contactID = $session->get('userID');
161 if ($type = CRM_Core_Permission
::VIEW
) {
162 $operationClause = " operation IN ( 'Edit', 'View' ) ";
166 $operationClause = " operation = 'Edit' ";
171 self
::cache($contactID);
175 FROM civicrm_acl_contact_cache
177 AND $operationClause LIMIT 1";
179 $params = array(1 => array($contactID, 'Integer'));
180 return (bool) CRM_Core_DAO
::singleValueQuery($sql, $params);
184 * @param string $contactAlias
188 public static function cacheClause($contactAlias = 'contact_a') {
189 if (CRM_Core_Permission
::check('view all contacts') ||
190 CRM_Core_Permission
::check('edit all contacts')
192 if (is_array($contactAlias)) {
194 foreach ($contactAlias as $alias) {
196 $wheres[] = "$alias.is_deleted = 0";
198 return array(NULL, '(' . implode(' AND ', $wheres) . ')');
202 return array(NULL, "$contactAlias.is_deleted = 0");
206 $contactID = (int) CRM_Core_Session
::getLoggedInContactID();
207 self
::cache($contactID);
209 if (is_array($contactAlias) && !empty($contactAlias)) {
210 //More than one contact alias
212 foreach ($contactAlias as $k => $alias) {
213 $clauses[] = " INNER JOIN civicrm_acl_contact_cache aclContactCache_{$k} ON {$alias}.id = aclContactCache_{$k}.contact_id AND aclContactCache_{$k}.user_id = $contactID ";
216 $fromClause = implode(" ", $clauses);
220 $fromClause = " INNER JOIN civicrm_acl_contact_cache aclContactCache ON {$contactAlias}.id = aclContactCache.contact_id ";
221 $whereClase = " aclContactCache.user_id = $contactID AND $contactAlias.is_deleted = 0";
224 return array($fromClause, $whereClase);
228 * Generate acl subquery that can be placed in the WHERE clause of a query or the ON clause of a JOIN
230 * @param string $contactIdField
231 * Full "table_name.field_name" for the field containing a contact id
232 * @return string|NULL
234 public static function cacheSubquery($contactIdField) {
236 if (!CRM_Core_Permission
::check(array(array('view all contacts', 'edit all contacts')))) {
237 $contactID = (int) CRM_Core_Session
::getLoggedInContactID();
238 self
::cache($contactID);
239 $clauses[] = "$contactIdField IN (SELECT contact_id FROM civicrm_acl_contact_cache WHERE user_id = $contactID)";
241 if (!CRM_Core_Permission
::check('access deleted contacts')) {
242 $clauses[] = "$contactIdField NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)";
244 return $clauses ?
implode(' AND ', $clauses) : NULL;
248 * Get the permission base on its relationship.
250 * @param int $selectedContactID
251 * Contact id of selected contact.
252 * @param int $contactID
253 * Contact id of the current contact.
256 * true if logged in user has permission to view
257 * selected contact record else false
259 public static function relationship($selectedContactID, $contactID = NULL) {
260 $session = CRM_Core_Session
::singleton();
261 $config = CRM_Core_Config
::singleton();
263 $contactID = $session->get('userID');
268 if ($contactID == $selectedContactID &&
269 (CRM_Core_Permission
::check('edit my contact') || CRM_Core_Permission
::check('view my contact'))
274 if ($config->secondDegRelPermissions
) {
277 FROM civicrm_relationship firstdeg
278 LEFT JOIN civicrm_relationship seconddegaa
279 on firstdeg.contact_id_a = seconddegaa.contact_id_b
280 and seconddegaa.is_permission_b_a = 1
281 and firstdeg.is_permission_b_a = 1
282 and seconddegaa.is_active = 1
283 LEFT JOIN civicrm_relationship seconddegab
284 on firstdeg.contact_id_a = seconddegab.contact_id_a
285 and seconddegab.is_permission_a_b = 1
286 and firstdeg.is_permission_b_a = 1
287 and seconddegab.is_active = 1
288 LEFT JOIN civicrm_relationship seconddegba
289 on firstdeg.contact_id_b = seconddegba.contact_id_b
290 and seconddegba.is_permission_b_a = 1
291 and firstdeg.is_permission_a_b = 1
292 and seconddegba.is_active = 1
293 LEFT JOIN civicrm_relationship seconddegbb
294 on firstdeg.contact_id_b = seconddegbb.contact_id_a
295 and seconddegbb.is_permission_a_b = 1
296 and firstdeg.is_permission_a_b = 1
297 and seconddegbb.is_active = 1
300 ( firstdeg.contact_id_a = %1 AND firstdeg.contact_id_b = %2 AND firstdeg.is_permission_a_b = 1 )
301 OR ( firstdeg.contact_id_a = %2 AND firstdeg.contact_id_b = %1 AND firstdeg.is_permission_b_a = 1 )
303 firstdeg.contact_id_a = %1 AND seconddegba.contact_id_a = %2
304 AND (seconddegba.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
307 firstdeg.contact_id_a = %1 AND seconddegbb.contact_id_b = %2
308 AND (seconddegbb.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
311 firstdeg.contact_id_b = %1 AND seconddegab.contact_id_b = %2
312 AND (seconddegab.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
315 firstdeg.contact_id_b = %1 AND seconddegaa.contact_id_a = %2 AND (seconddegaa.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
318 AND (firstdeg.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
319 AND (firstdeg.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
320 AND ( firstdeg.is_active = 1)
326 FROM civicrm_relationship
327 WHERE (( contact_id_a = %1 AND contact_id_b = %2 AND is_permission_a_b = 1 ) OR
328 ( contact_id_a = %2 AND contact_id_b = %1 AND is_permission_b_a = 1 )) AND
329 (contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)) AND
330 (contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
331 AND ( civicrm_relationship.is_active = 1 )
335 1 => array($contactID, 'Integer'),
336 2 => array($selectedContactID, 'Integer'),
338 return CRM_Core_DAO
::singleValueQuery($query, $params);
344 * @param int $contactID
345 * @param CRM_Core_Form $form
346 * @param bool $redirect
350 public static function validateOnlyChecksum($contactID, &$form, $redirect = TRUE) {
351 // check if this is of the format cs=XXX
352 if (!CRM_Contact_BAO_Contact_Utils
::validChecksum($contactID,
353 CRM_Utils_Request
::retrieve('cs', 'String', $form, FALSE)
357 // also set a message in the UF framework
358 $message = ts('You do not have permission to edit this contact record. Contact the site administrator if you need assistance.');
359 CRM_Utils_System
::setUFMessage($message);
361 $config = CRM_Core_Config
::singleton();
362 CRM_Core_Error
::statusBounce($message,
363 $config->userFrameworkBaseURL
365 // does not come here, we redirect in the above statement
370 // set appropriate AUTH source
371 self
::initChecksumAuthSrc(TRUE, $form);
373 // so here the contact is posing as $contactID, lets set the logging contact ID variable
375 CRM_Core_DAO
::executeQuery('SET @civicrm_user_id = %1',
376 array(1 => array($contactID, 'Integer'))
383 * @param bool $checkSumValidationResult
386 public static function initChecksumAuthSrc($checkSumValidationResult = FALSE, $form = NULL) {
387 $session = CRM_Core_Session
::singleton();
388 if ($checkSumValidationResult && $form && CRM_Utils_Request
::retrieve('cs', 'String', $form, FALSE)) {
389 // if result is already validated, and url has cs, set the flag.
390 $session->set('authSrc', CRM_Core_Permission
::AUTH_SRC_CHECKSUM
);
392 elseif (($session->get('authSrc') & CRM_Core_Permission
::AUTH_SRC_CHECKSUM
) == CRM_Core_Permission
::AUTH_SRC_CHECKSUM
) {
393 // if checksum wasn't present in REQUEST OR checksum result validated as FALSE,
394 // and flag was already set exactly as AUTH_SRC_CHECKSUM, unset it.
395 $session->set('authSrc', CRM_Core_Permission
::AUTH_SRC_UNKNOWN
);
400 * @param int $contactID
401 * @param CRM_Core_Form $form
402 * @param bool $redirect
406 public static function validateChecksumContact($contactID, &$form, $redirect = TRUE) {
407 if (!self
::allow($contactID, CRM_Core_Permission
::EDIT
)) {
408 // check if this is of the format cs=XXX
409 return self
::validateOnlyChecksum($contactID, $form, $redirect);