CRM/Contact/BAO/Contact/Permission.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.6                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2014                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26 */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2014
  32  * $Id$
  33  *
  34  */
  35 class CRM_Contact_BAO_Contact_Permission {
  36
  37   /**
  38    * Check if the logged in user has permissions for the operation type
  39    *
  40    * @param int $id
  41    *   Contact id.
  42    * @param int|string $type the type of operation (view|edit)
  43    *
  44    * @return boolean true if the user has permission, false otherwise
  45    * @static
  46    */
  47   public static function allow($id, $type = CRM_Core_Permission::VIEW) {
  48     $tables = array();
  49     $whereTables = array();
  50
  51     # FIXME: push this somewhere below, to not give this permission so many rights
  52     $isDeleted = (bool) CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $id, 'is_deleted');
  53     if (CRM_Core_Permission::check('access deleted contacts') && $isDeleted) {
  54       return TRUE;
  55     }
  56
  57     // short circuit for admin rights here so we avoid unneeeded queries
  58     // some duplication of code, but we skip 3-5 queries
  59     if (CRM_Core_Permission::check('edit all contacts') ||
  60       ($type == CRM_ACL_API::VIEW && CRM_Core_Permission::check('view all contacts'))
  61     ) {
  62       return TRUE;
  63     }
  64
  65     //check permission based on relationship, CRM-2963
  66     if (self::relationship($id)) {
  67       return TRUE;
  68     }
  69
  70     $permission = CRM_ACL_API::whereClause($type, $tables, $whereTables);
  71
  72     $from = CRM_Contact_BAO_Query::fromClause($whereTables);
  73
  74     $query = "
  75 SELECT count(DISTINCT contact_a.id)
  76        $from
  77 WHERE contact_a.id = %1 AND $permission";
  78     $params = array(1 => array($id, 'Integer'));
  79
  80     return (CRM_Core_DAO::singleValueQuery($query, $params) > 0) ? TRUE : FALSE;
  81   }
  82
  83   /**
  84    * Fill the acl contact cache for this contact id if empty
  85    *
  86    * @param int $userID
  87    * @param int|string $type the type of operation (view|edit)
  88    * @param bool $force
  89    *   Should we force a recompute.
  90    *
  91    * @return void
  92    * @static
  93    */
  94   public static function cache($userID, $type = CRM_Core_Permission::VIEW, $force = FALSE) {
  95     static $_processed = array();
  96
  97     if ($type = CRM_Core_Permission::VIEW) {
  98       $operationClause = " operation IN ( 'Edit', 'View' ) ";
  99       $operation = 'View';
 100     }
 101     else {
 102       $operationClause = " operation = 'Edit' ";
 103       $operation = 'Edit';
 104     }
 105
 106     if (!$force) {
 107       if (!empty($_processed[$userID])) {
 108         return;
 109       }
 110
 111       // run a query to see if the cache is filled
 112       $sql = "
 113 SELECT count(id)
 114 FROM   civicrm_acl_contact_cache
 115 WHERE  user_id = %1
 116 AND    $operationClause
 117 ";
 118       $params = array(1 => array($userID, 'Integer'));
 119       $count = CRM_Core_DAO::singleValueQuery($sql, $params);
 120       if ($count > 0) {
 121         $_processed[$userID] = 1;
 122         return;
 123       }
 124     }
 125
 126     $tables = array();
 127     $whereTables = array();
 128
 129     $permission = CRM_ACL_API::whereClause($type, $tables, $whereTables, $userID);
 130
 131     $from = CRM_Contact_BAO_Query::fromClause($whereTables);
 132
 133     CRM_Core_DAO::executeQuery("
 134 INSERT INTO civicrm_acl_contact_cache ( user_id, contact_id, operation )
 135 SELECT      $userID as user_id, contact_a.id as contact_id, '$operation' as operation
 136          $from
 137 WHERE    $permission
 138 GROUP BY contact_a.id
 139 ON DUPLICATE KEY UPDATE
 140          user_id=VALUES(user_id),
 141          contact_id=VALUES(contact_id),
 142          operation=VALUES(operation)"
 143     );
 144
 145     CRM_Core_DAO::executeQuery('DELETE FROM civicrm_acl_contact_cache WHERE contact_id IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)');
 146     $_processed[$userID] = 1;
 147
 148     return;
 149   }
 150
 151   /**
 152    * Check if there are any contacts in cache table
 153    *
 154    * @param int|string $type the type of operation (view|edit)
 155    * @param int $contactID
 156    *   Contact id.
 157    *
 158    * @return boolean
 159    * @static
 160    */
 161   static function hasContactsInCache(
 162     $type = CRM_Core_Permission::VIEW,
 163     $contactID = NULL
 164   ) {
 165     if (!$contactID) {
 166       $session = CRM_Core_Session::singleton();
 167       $contactID = $session->get('userID');
 168     }
 169
 170     if ($type = CRM_Core_Permission::VIEW) {
 171       $operationClause = " operation IN ( 'Edit', 'View' ) ";
 172       $operation = 'View';
 173     }
 174     else {
 175       $operationClause = " operation = 'Edit' ";
 176       $operation = 'Edit';
 177     }
 178
 179     // fill cache
 180     self::cache($contactID);
 181
 182     $sql = "
 183 SELECT id
 184 FROM   civicrm_acl_contact_cache
 185 WHERE  user_id = %1
 186 AND    $operationClause LIMIT 1";
 187
 188     $params = array(1 => array($contactID, 'Integer'));
 189     return (bool) CRM_Core_DAO::singleValueQuery($sql, $params);
 190   }
 191
 192   /**
 193    * @param string $contactAlias
 194    * @param int $contactID
 195    *
 196    * @return array
 197    */
 198   public static function cacheClause($contactAlias = 'contact_a', $contactID = NULL) {
 199     if (CRM_Core_Permission::check('view all contacts') ||
 200       CRM_Core_Permission::check('edit all contacts')
 201     ) {
 202       if (is_array($contactAlias)) {
 203         $wheres = array();
 204         foreach ($contactAlias as $alias) {
 205           // CRM-6181
 206           $wheres[] = "$alias.is_deleted = 0";
 207         }
 208         return array(NULL, '(' . implode(' AND ', $wheres) . ')');
 209       }
 210       else {
 211         // CRM-6181
 212         return array(NULL, "$contactAlias.is_deleted = 0");
 213       }
 214     }
 215
 216     $session = CRM_Core_Session::singleton();
 217     $contactID = $session->get('userID');
 218     if (!$contactID) {
 219       $contactID = 0;
 220     }
 221     $contactID = CRM_Utils_Type::escape($contactID, 'Integer');
 222
 223     self::cache($contactID);
 224
 225     if (is_array($contactAlias) && !empty($contactAlias)) {
 226       //More than one contact alias
 227       $clauses = array();
 228       foreach ($contactAlias as $k => $alias) {
 229         $clauses[] = " INNER JOIN civicrm_acl_contact_cache aclContactCache_{$k} ON {$alias}.id = aclContactCache_{$k}.contact_id AND aclContactCache_{$k}.user_id = $contactID ";
 230       }
 231
 232       $fromClause = implode(" ", $clauses);
 233       $whereClase = NULL;
 234     }
 235     else {
 236       $fromClause = " INNER JOIN civicrm_acl_contact_cache aclContactCache ON {$contactAlias}.id = aclContactCache.contact_id ";
 237       $whereClase = " aclContactCache.user_id = $contactID ";
 238     }
 239
 240     return array($fromClause, $whereClase);
 241   }
 242
 243   /**
 244    * Get the permission base on its relationship
 245    *
 246    * @param int $selectedContactID
 247    *   Contact id of selected contact.
 248    * @param int $contactID
 249    *   Contact id of the current contact.
 250    *
 251    * @return bool true if logged in user has permission to view
 252    *   selected contact record else false
 253    * @static
 254    */
 255   public static function relationship($selectedContactID, $contactID = NULL) {
 256     $session = CRM_Core_Session::singleton();
 257     $config = CRM_Core_Config::singleton();
 258     if (!$contactID) {
 259       $contactID = $session->get('userID');
 260       if (!$contactID) {
 261         return FALSE;
 262       }
 263     }
 264     if ($contactID == $selectedContactID && CRM_Core_Permission::check('edit my contact')) {
 265       return TRUE;
 266     }
 267     else {
 268       if ($config->secondDegRelPermissions) {
 269         $query = "
 270 SELECT firstdeg.id
 271 FROM   civicrm_relationship firstdeg
 272 LEFT JOIN civicrm_relationship seconddegaa
 273   on firstdeg.contact_id_a = seconddegaa.contact_id_b
 274   and seconddegaa.is_permission_b_a = 1
 275   and firstdeg.is_permission_b_a = 1
 276   and seconddegaa.is_active = 1
 277 LEFT JOIN civicrm_relationship seconddegab
 278   on firstdeg.contact_id_a = seconddegab.contact_id_a
 279   and seconddegab.is_permission_a_b = 1
 280   and firstdeg.is_permission_b_a = 1
 281   and seconddegab.is_active = 1
 282 LEFT JOIN civicrm_relationship seconddegba
 283   on firstdeg.contact_id_b = seconddegba.contact_id_b
 284   and seconddegba.is_permission_b_a = 1
 285   and firstdeg.is_permission_a_b = 1
 286   and seconddegba.is_active = 1
 287 LEFT JOIN civicrm_relationship seconddegbb
 288   on firstdeg.contact_id_b = seconddegbb.contact_id_a
 289   and seconddegbb.is_permission_a_b = 1
 290   and firstdeg.is_permission_a_b = 1
 291   and seconddegbb.is_active = 1
 292 WHERE
 293   (
 294     ( firstdeg.contact_id_a = %1 AND firstdeg.contact_id_b = %2 AND firstdeg.is_permission_a_b = 1 )
 295     OR ( firstdeg.contact_id_a = %2 AND firstdeg.contact_id_b = %1 AND firstdeg.is_permission_b_a = 1 )
 296     OR (
 297       firstdeg.contact_id_a = %1 AND seconddegba.contact_id_a = %2
 298       AND (seconddegba.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 299     )
 300     OR (
 301       firstdeg.contact_id_a = %1 AND seconddegbb.contact_id_b = %2
 302       AND (seconddegbb.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 303     )
 304     OR (
 305       firstdeg.contact_id_b = %1 AND seconddegab.contact_id_b = %2
 306       AND (seconddegab.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 307     )
 308     OR (
 309       firstdeg.contact_id_b = %1 AND seconddegaa.contact_id_a = %2      AND (seconddegaa.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 310     )
 311   )
 312   AND (firstdeg.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 313   AND (firstdeg.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 314   AND ( firstdeg.is_active = 1)
 315       ";
 316       }
 317       else {
 318         $query = "
 319 SELECT id
 320 FROM   civicrm_relationship
 321 WHERE  (( contact_id_a = %1 AND contact_id_b = %2 AND is_permission_a_b = 1 ) OR
 322         ( contact_id_a = %2 AND contact_id_b = %1 AND is_permission_b_a = 1 )) AND
 323        (contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)) AND
 324        (contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 325   AND  ( civicrm_relationship.is_active = 1 )
 326 ";
 327       }
 328       $params = array(
 329       1 => array($contactID, 'Integer'),
 330         2 => array($selectedContactID, 'Integer'),
 331       );
 332       return CRM_Core_DAO::singleValueQuery($query, $params);
 333     }
 334   }
 335
 336
 337   /**
 338    * @param int $contactID
 339    * @param CRM_Core_Form $form
 340    * @param bool $redirect
 341    *
 342    * @return bool
 343    */
 344   public static function validateOnlyChecksum($contactID, &$form, $redirect = TRUE) {
 345     // check if this is of the format cs=XXX
 346     if (!CRM_Contact_BAO_Contact_Utils::validChecksum($contactID,
 347         CRM_Utils_Request::retrieve('cs', 'String', $form, FALSE)
 348       )) {
 349       if ($redirect) {
 350         // also set a message in the UF framework
 351         $message = ts('You do not have permission to edit this contact record. Contact the site administrator if you need assistance.');
 352         CRM_Utils_System::setUFMessage($message);
 353
 354         $config = CRM_Core_Config::singleton();
 355         CRM_Core_Error::statusBounce($message,
 356           $config->userFrameworkBaseURL
 357         );
 358         // does not come here, we redirect in the above statement
 359       }
 360       return FALSE;
 361     }
 362
 363     // set appropriate AUTH source
 364     self::initChecksumAuthSrc(TRUE, $form);
 365
 366     // so here the contact is posing as $contactID, lets set the logging contact ID variable
 367     // CRM-8965
 368     CRM_Core_DAO::executeQuery('SET @civicrm_user_id = %1',
 369       array(1 => array($contactID, 'Integer'))
 370     );
 371
 372     return TRUE;
 373   }
 374
 375   /**
 376    * @param bool $checkSumValidationResult
 377    * @param null $form
 378    */
 379   public static function initChecksumAuthSrc($checkSumValidationResult = FALSE, $form = NULL) {
 380     $session = CRM_Core_Session::singleton();
 381     if ($checkSumValidationResult && $form && CRM_Utils_Request::retrieve('cs', 'String', $form, FALSE)) {
 382       // if result is already validated, and url has cs, set the flag.
 383       $session->set('authSrc', CRM_Core_Permission::AUTH_SRC_CHECKSUM);
 384     } else if (($session->get('authSrc') & CRM_Core_Permission::AUTH_SRC_CHECKSUM) == CRM_Core_Permission::AUTH_SRC_CHECKSUM) {
 385       // if checksum wasn't present in REQUEST OR checksum result validated as FALSE,
 386       // and flag was already set exactly as AUTH_SRC_CHECKSUM, unset it.
 387       $session->set('authSrc', CRM_Core_Permission::AUTH_SRC_UNKNOWN);
 388     }
 389   }
 390
 391   /**
 392    * @param int $contactID
 393    * @param CRM_Core_Form $form
 394    * @param bool $redirect
 395    *
 396    * @return bool
 397    */
 398   public static function validateChecksumContact($contactID, &$form, $redirect = TRUE) {
 399     if (!self::allow($contactID, CRM_Core_Permission::EDIT)) {
 400       // check if this is of the format cs=XXX
 401       return self::validateOnlyChecksum($contactID, $form, $redirect);
 402     }
 403     return TRUE;
 404   }
 405 }