CRM/Contact/BAO/Contact/Permission.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.7                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2015                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2015
  32  */
  33 class CRM_Contact_BAO_Contact_Permission {
  34
  35   /**
  36    * Check if the logged in user has permissions for the operation type.
  37    *
  38    * @param int $id
  39    *   Contact id.
  40    * @param int|string $type the type of operation (view|edit)
  41    *
  42    * @return bool
  43    *   true if the user has permission, false otherwise
  44    */
  45   public static function allow($id, $type = CRM_Core_Permission::VIEW) {
  46     $tables = array();
  47     $whereTables = array();
  48
  49     # FIXME: push this somewhere below, to not give this permission so many rights
  50     $isDeleted = (bool) CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $id, 'is_deleted');
  51     if (CRM_Core_Permission::check('access deleted contacts') && $isDeleted) {
  52       return TRUE;
  53     }
  54
  55     // short circuit for admin rights here so we avoid unneeeded queries
  56     // some duplication of code, but we skip 3-5 queries
  57     if (CRM_Core_Permission::check('edit all contacts') ||
  58       ($type == CRM_ACL_API::VIEW && CRM_Core_Permission::check('view all contacts'))
  59     ) {
  60       return TRUE;
  61     }
  62
  63     //check permission based on relationship, CRM-2963
  64     if (self::relationship($id)) {
  65       return TRUE;
  66     }
  67
  68     $permission = CRM_ACL_API::whereClause($type, $tables, $whereTables);
  69
  70     $from = CRM_Contact_BAO_Query::fromClause($whereTables);
  71
  72     $query = "
  73 SELECT count(DISTINCT contact_a.id)
  74        $from
  75 WHERE contact_a.id = %1 AND $permission";
  76     $params = array(1 => array($id, 'Integer'));
  77
  78     return (CRM_Core_DAO::singleValueQuery($query, $params) > 0) ? TRUE : FALSE;
  79   }
  80
  81   /**
  82    * Fill the acl contact cache for this contact id if empty.
  83    *
  84    * @param int $userID
  85    * @param int|string $type the type of operation (view|edit)
  86    * @param bool $force
  87    *   Should we force a recompute.
  88    */
  89   public static function cache($userID, $type = CRM_Core_Permission::VIEW, $force = FALSE) {
  90     static $_processed = array();
  91
  92     if ($type = CRM_Core_Permission::VIEW) {
  93       $operationClause = " operation IN ( 'Edit', 'View' ) ";
  94       $operation = 'View';
  95     }
  96     else {
  97       $operationClause = " operation = 'Edit' ";
  98       $operation = 'Edit';
  99     }
 100
 101     if (!$force) {
 102       if (!empty($_processed[$userID])) {
 103         return;
 104       }
 105
 106       // run a query to see if the cache is filled
 107       $sql = "
 108 SELECT count(id)
 109 FROM   civicrm_acl_contact_cache
 110 WHERE  user_id = %1
 111 AND    $operationClause
 112 ";
 113       $params = array(1 => array($userID, 'Integer'));
 114       $count = CRM_Core_DAO::singleValueQuery($sql, $params);
 115       if ($count > 0) {
 116         $_processed[$userID] = 1;
 117         return;
 118       }
 119     }
 120
 121     $tables = array();
 122     $whereTables = array();
 123
 124     $permission = CRM_ACL_API::whereClause($type, $tables, $whereTables, $userID);
 125
 126     $from = CRM_Contact_BAO_Query::fromClause($whereTables);
 127
 128     CRM_Core_DAO::executeQuery("
 129 INSERT INTO civicrm_acl_contact_cache ( user_id, contact_id, operation )
 130 SELECT      $userID as user_id, contact_a.id as contact_id, '$operation' as operation
 131          $from
 132 WHERE    $permission
 133 GROUP BY contact_a.id
 134 ON DUPLICATE KEY UPDATE
 135          user_id=VALUES(user_id),
 136          contact_id=VALUES(contact_id),
 137          operation=VALUES(operation)"
 138     );
 139
 140     $_processed[$userID] = 1;
 141   }
 142
 143   /**
 144    * Check if there are any contacts in cache table.
 145    *
 146    * @param int|string $type the type of operation (view|edit)
 147    * @param int $contactID
 148    *   Contact id.
 149    *
 150    * @return bool
 151    */
 152   public static function hasContactsInCache(
 153     $type = CRM_Core_Permission::VIEW,
 154     $contactID = NULL
 155   ) {
 156     if (!$contactID) {
 157       $session = CRM_Core_Session::singleton();
 158       $contactID = $session->get('userID');
 159     }
 160
 161     if ($type = CRM_Core_Permission::VIEW) {
 162       $operationClause = " operation IN ( 'Edit', 'View' ) ";
 163       $operation = 'View';
 164     }
 165     else {
 166       $operationClause = " operation = 'Edit' ";
 167       $operation = 'Edit';
 168     }
 169
 170     // fill cache
 171     self::cache($contactID);
 172
 173     $sql = "
 174 SELECT id
 175 FROM   civicrm_acl_contact_cache
 176 WHERE  user_id = %1
 177 AND    $operationClause LIMIT 1";
 178
 179     $params = array(1 => array($contactID, 'Integer'));
 180     return (bool) CRM_Core_DAO::singleValueQuery($sql, $params);
 181   }
 182
 183   /**
 184    * @param string $contactAlias
 185    *
 186    * @return array
 187    */
 188   public static function cacheClause($contactAlias = 'contact_a') {
 189     if (CRM_Core_Permission::check('view all contacts') ||
 190       CRM_Core_Permission::check('edit all contacts')
 191     ) {
 192       if (is_array($contactAlias)) {
 193         $wheres = array();
 194         foreach ($contactAlias as $alias) {
 195           // CRM-6181
 196           $wheres[] = "$alias.is_deleted = 0";
 197         }
 198         return array(NULL, '(' . implode(' AND ', $wheres) . ')');
 199       }
 200       else {
 201         // CRM-6181
 202         return array(NULL, "$contactAlias.is_deleted = 0");
 203       }
 204     }
 205
 206     $contactID = (int) CRM_Core_Session::getLoggedInContactID();
 207     self::cache($contactID);
 208
 209     if (is_array($contactAlias) && !empty($contactAlias)) {
 210       //More than one contact alias
 211       $clauses = array();
 212       foreach ($contactAlias as $k => $alias) {
 213         $clauses[] = " INNER JOIN civicrm_acl_contact_cache aclContactCache_{$k} ON {$alias}.id = aclContactCache_{$k}.contact_id AND aclContactCache_{$k}.user_id = $contactID ";
 214       }
 215
 216       $fromClause = implode(" ", $clauses);
 217       $whereClase = NULL;
 218     }
 219     else {
 220       $fromClause = " INNER JOIN civicrm_acl_contact_cache aclContactCache ON {$contactAlias}.id = aclContactCache.contact_id ";
 221       $whereClase = " aclContactCache.user_id = $contactID AND $contactAlias.is_deleted = 0";
 222     }
 223
 224     return array($fromClause, $whereClase);
 225   }
 226
 227   /**
 228    * Generate acl subquery that can be placed in the WHERE clause of a query or the ON clause of a JOIN
 229    *
 230    * @param string $contactIdField
 231    *   Full "table_name.field_name" for the field containing a contact id
 232    * @return string|NULL
 233    */
 234   public static function cacheSubquery($contactIdField) {
 235     $clauses = array();
 236     if (!CRM_Core_Permission::check(array(array('view all contacts', 'edit all contacts')))) {
 237       $contactID = (int) CRM_Core_Session::getLoggedInContactID();
 238       self::cache($contactID);
 239       $clauses[] = "$contactIdField IN (SELECT contact_id FROM civicrm_acl_contact_cache WHERE user_id = $contactID)";
 240     }
 241     if (!CRM_Core_Permission::check('access deleted contacts')) {
 242       $clauses[] = "$contactIdField NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)";
 243     }
 244     return $clauses ? implode(' AND ', $clauses) : NULL;
 245   }
 246
 247   /**
 248    * Get the permission base on its relationship.
 249    *
 250    * @param int $selectedContactID
 251    *   Contact id of selected contact.
 252    * @param int $contactID
 253    *   Contact id of the current contact.
 254    *
 255    * @return bool
 256    *   true if logged in user has permission to view
 257    *   selected contact record else false
 258    */
 259   public static function relationship($selectedContactID, $contactID = NULL) {
 260     $session = CRM_Core_Session::singleton();
 261     $config = CRM_Core_Config::singleton();
 262     if (!$contactID) {
 263       $contactID = $session->get('userID');
 264       if (!$contactID) {
 265         return FALSE;
 266       }
 267     }
 268     if ($contactID == $selectedContactID &&
 269       (CRM_Core_Permission::check('edit my contact') || CRM_Core_Permission::check('view my contact'))
 270     ) {
 271       return TRUE;
 272     }
 273     else {
 274       if ($config->secondDegRelPermissions) {
 275         $query = "
 276 SELECT firstdeg.id
 277 FROM   civicrm_relationship firstdeg
 278 LEFT JOIN civicrm_relationship seconddegaa
 279   on firstdeg.contact_id_a = seconddegaa.contact_id_b
 280   and seconddegaa.is_permission_b_a = 1
 281   and firstdeg.is_permission_b_a = 1
 282   and seconddegaa.is_active = 1
 283 LEFT JOIN civicrm_relationship seconddegab
 284   on firstdeg.contact_id_a = seconddegab.contact_id_a
 285   and seconddegab.is_permission_a_b = 1
 286   and firstdeg.is_permission_b_a = 1
 287   and seconddegab.is_active = 1
 288 LEFT JOIN civicrm_relationship seconddegba
 289   on firstdeg.contact_id_b = seconddegba.contact_id_b
 290   and seconddegba.is_permission_b_a = 1
 291   and firstdeg.is_permission_a_b = 1
 292   and seconddegba.is_active = 1
 293 LEFT JOIN civicrm_relationship seconddegbb
 294   on firstdeg.contact_id_b = seconddegbb.contact_id_a
 295   and seconddegbb.is_permission_a_b = 1
 296   and firstdeg.is_permission_a_b = 1
 297   and seconddegbb.is_active = 1
 298 WHERE
 299   (
 300     ( firstdeg.contact_id_a = %1 AND firstdeg.contact_id_b = %2 AND firstdeg.is_permission_a_b = 1 )
 301     OR ( firstdeg.contact_id_a = %2 AND firstdeg.contact_id_b = %1 AND firstdeg.is_permission_b_a = 1 )
 302     OR (
 303       firstdeg.contact_id_a = %1 AND seconddegba.contact_id_a = %2
 304       AND (seconddegba.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 305     )
 306     OR (
 307       firstdeg.contact_id_a = %1 AND seconddegbb.contact_id_b = %2
 308       AND (seconddegbb.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 309     )
 310     OR (
 311       firstdeg.contact_id_b = %1 AND seconddegab.contact_id_b = %2
 312       AND (seconddegab.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 313     )
 314     OR (
 315       firstdeg.contact_id_b = %1 AND seconddegaa.contact_id_a = %2      AND (seconddegaa.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 316     )
 317   )
 318   AND (firstdeg.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 319   AND (firstdeg.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 320   AND ( firstdeg.is_active = 1)
 321       ";
 322       }
 323       else {
 324         $query = "
 325 SELECT id
 326 FROM   civicrm_relationship
 327 WHERE  (( contact_id_a = %1 AND contact_id_b = %2 AND is_permission_a_b = 1 ) OR
 328         ( contact_id_a = %2 AND contact_id_b = %1 AND is_permission_b_a = 1 )) AND
 329        (contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)) AND
 330        (contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 331   AND  ( civicrm_relationship.is_active = 1 )
 332 ";
 333       }
 334       $params = array(
 335         1 => array($contactID, 'Integer'),
 336         2 => array($selectedContactID, 'Integer'),
 337       );
 338       return CRM_Core_DAO::singleValueQuery($query, $params);
 339     }
 340   }
 341
 342
 343   /**
 344    * @param int $contactID
 345    * @param CRM_Core_Form $form
 346    * @param bool $redirect
 347    *
 348    * @return bool
 349    */
 350   public static function validateOnlyChecksum($contactID, &$form, $redirect = TRUE) {
 351     // check if this is of the format cs=XXX
 352     if (!CRM_Contact_BAO_Contact_Utils::validChecksum($contactID,
 353       CRM_Utils_Request::retrieve('cs', 'String', $form, FALSE)
 354     )
 355     ) {
 356       if ($redirect) {
 357         // also set a message in the UF framework
 358         $message = ts('You do not have permission to edit this contact record. Contact the site administrator if you need assistance.');
 359         CRM_Utils_System::setUFMessage($message);
 360
 361         $config = CRM_Core_Config::singleton();
 362         CRM_Core_Error::statusBounce($message,
 363           $config->userFrameworkBaseURL
 364         );
 365         // does not come here, we redirect in the above statement
 366       }
 367       return FALSE;
 368     }
 369
 370     // set appropriate AUTH source
 371     self::initChecksumAuthSrc(TRUE, $form);
 372
 373     // so here the contact is posing as $contactID, lets set the logging contact ID variable
 374     // CRM-8965
 375     CRM_Core_DAO::executeQuery('SET @civicrm_user_id = %1',
 376       array(1 => array($contactID, 'Integer'))
 377     );
 378
 379     return TRUE;
 380   }
 381
 382   /**
 383    * @param bool $checkSumValidationResult
 384    * @param null $form
 385    */
 386   public static function initChecksumAuthSrc($checkSumValidationResult = FALSE, $form = NULL) {
 387     $session = CRM_Core_Session::singleton();
 388     if ($checkSumValidationResult && $form && CRM_Utils_Request::retrieve('cs', 'String', $form, FALSE)) {
 389       // if result is already validated, and url has cs, set the flag.
 390       $session->set('authSrc', CRM_Core_Permission::AUTH_SRC_CHECKSUM);
 391     }
 392     elseif (($session->get('authSrc') & CRM_Core_Permission::AUTH_SRC_CHECKSUM) == CRM_Core_Permission::AUTH_SRC_CHECKSUM) {
 393       // if checksum wasn't present in REQUEST OR checksum result validated as FALSE,
 394       // and flag was already set exactly as AUTH_SRC_CHECKSUM, unset it.
 395       $session->set('authSrc', CRM_Core_Permission::AUTH_SRC_UNKNOWN);
 396     }
 397   }
 398
 399   /**
 400    * @param int $contactID
 401    * @param CRM_Core_Form $form
 402    * @param bool $redirect
 403    *
 404    * @return bool
 405    */
 406   public static function validateChecksumContact($contactID, &$form, $redirect = TRUE) {
 407     if (!self::allow($contactID, CRM_Core_Permission::EDIT)) {
 408       // check if this is of the format cs=XXX
 409       return self::validateOnlyChecksum($contactID, $form, $redirect);
 410     }
 411     return TRUE;
 412   }
 413
 414 }