CRM/Contact/BAO/Contact/Permission.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.7                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2015                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2015
  32  */
  33 class CRM_Contact_BAO_Contact_Permission {
  34
  35   /**
  36    * Check if the logged in user has permissions for the operation type.
  37    *
  38    * @param int $id
  39    *   Contact id.
  40    * @param int|string $type the type of operation (view|edit)
  41    *
  42    * @return bool
  43    *   true if the user has permission, false otherwise
  44    */
  45   public static function allow($id, $type = CRM_Core_Permission::VIEW) {
  46     $tables = array();
  47     $whereTables = array();
  48
  49     # FIXME: push this somewhere below, to not give this permission so many rights
  50     $isDeleted = (bool) CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $id, 'is_deleted');
  51     if (CRM_Core_Permission::check('access deleted contacts') && $isDeleted) {
  52       return TRUE;
  53     }
  54
  55     // short circuit for admin rights here so we avoid unneeeded queries
  56     // some duplication of code, but we skip 3-5 queries
  57     if (CRM_Core_Permission::check('edit all contacts') ||
  58       ($type == CRM_ACL_API::VIEW && CRM_Core_Permission::check('view all contacts'))
  59     ) {
  60       return TRUE;
  61     }
  62
  63     //check permission based on relationship, CRM-2963
  64     if (self::relationship($id)) {
  65       return TRUE;
  66     }
  67
  68     $permission = CRM_ACL_API::whereClause($type, $tables, $whereTables);
  69
  70     $from = CRM_Contact_BAO_Query::fromClause($whereTables);
  71
  72     $query = "
  73 SELECT count(DISTINCT contact_a.id)
  74        $from
  75 WHERE contact_a.id = %1 AND $permission";
  76     $params = array(1 => array($id, 'Integer'));
  77
  78     return (CRM_Core_DAO::singleValueQuery($query, $params) > 0) ? TRUE : FALSE;
  79   }
  80
  81   /**
  82    * Fill the acl contact cache for this contact id if empty.
  83    *
  84    * @param int $userID
  85    * @param int|string $type the type of operation (view|edit)
  86    * @param bool $force
  87    *   Should we force a recompute.
  88    */
  89   public static function cache($userID, $type = CRM_Core_Permission::VIEW, $force = FALSE) {
  90     static $_processed = array();
  91
  92     if ($type = CRM_Core_Permission::VIEW) {
  93       $operationClause = " operation IN ( 'Edit', 'View' ) ";
  94       $operation = 'View';
  95     }
  96     else {
  97       $operationClause = " operation = 'Edit' ";
  98       $operation = 'Edit';
  99     }
 100
 101     if (!$force) {
 102       if (!empty($_processed[$userID])) {
 103         return;
 104       }
 105
 106       // run a query to see if the cache is filled
 107       $sql = "
 108 SELECT count(id)
 109 FROM   civicrm_acl_contact_cache
 110 WHERE  user_id = %1
 111 AND    $operationClause
 112 ";
 113       $params = array(1 => array($userID, 'Integer'));
 114       $count = CRM_Core_DAO::singleValueQuery($sql, $params);
 115       if ($count > 0) {
 116         $_processed[$userID] = 1;
 117         return;
 118       }
 119     }
 120
 121     $tables = array();
 122     $whereTables = array();
 123
 124     $permission = CRM_ACL_API::whereClause($type, $tables, $whereTables, $userID);
 125
 126     $from = CRM_Contact_BAO_Query::fromClause($whereTables);
 127
 128     CRM_Core_DAO::executeQuery("
 129 INSERT INTO civicrm_acl_contact_cache ( user_id, contact_id, operation )
 130 SELECT      $userID as user_id, contact_a.id as contact_id, '$operation' as operation
 131          $from
 132 WHERE    $permission
 133 GROUP BY contact_a.id
 134 ON DUPLICATE KEY UPDATE
 135          user_id=VALUES(user_id),
 136          contact_id=VALUES(contact_id),
 137          operation=VALUES(operation)"
 138     );
 139
 140     $_processed[$userID] = 1;
 141   }
 142
 143   /**
 144    * Check if there are any contacts in cache table.
 145    *
 146    * @param int|string $type the type of operation (view|edit)
 147    * @param int $contactID
 148    *   Contact id.
 149    *
 150    * @return bool
 151    */
 152   public static function hasContactsInCache(
 153     $type = CRM_Core_Permission::VIEW,
 154     $contactID = NULL
 155   ) {
 156     if (!$contactID) {
 157       $session = CRM_Core_Session::singleton();
 158       $contactID = $session->get('userID');
 159     }
 160
 161     if ($type = CRM_Core_Permission::VIEW) {
 162       $operationClause = " operation IN ( 'Edit', 'View' ) ";
 163       $operation = 'View';
 164     }
 165     else {
 166       $operationClause = " operation = 'Edit' ";
 167       $operation = 'Edit';
 168     }
 169
 170     // fill cache
 171     self::cache($contactID);
 172
 173     $sql = "
 174 SELECT id
 175 FROM   civicrm_acl_contact_cache
 176 WHERE  user_id = %1
 177 AND    $operationClause LIMIT 1";
 178
 179     $params = array(1 => array($contactID, 'Integer'));
 180     return (bool) CRM_Core_DAO::singleValueQuery($sql, $params);
 181   }
 182
 183   /**
 184    * @param string $contactAlias
 185    * @param int $contactID
 186    *
 187    * @return array
 188    */
 189   public static function cacheClause($contactAlias = 'contact_a', $contactID = NULL) {
 190     if (CRM_Core_Permission::check('view all contacts') ||
 191       CRM_Core_Permission::check('edit all contacts')
 192     ) {
 193       if (is_array($contactAlias)) {
 194         $wheres = array();
 195         foreach ($contactAlias as $alias) {
 196           // CRM-6181
 197           $wheres[] = "$alias.is_deleted = 0";
 198         }
 199         return array(NULL, '(' . implode(' AND ', $wheres) . ')');
 200       }
 201       else {
 202         // CRM-6181
 203         return array(NULL, "$contactAlias.is_deleted = 0");
 204       }
 205     }
 206
 207     $session = CRM_Core_Session::singleton();
 208     $contactID = $session->get('userID');
 209     if (!$contactID) {
 210       $contactID = 0;
 211     }
 212     $contactID = CRM_Utils_Type::escape($contactID, 'Integer');
 213
 214     self::cache($contactID);
 215
 216     if (is_array($contactAlias) && !empty($contactAlias)) {
 217       //More than one contact alias
 218       $clauses = array();
 219       foreach ($contactAlias as $k => $alias) {
 220         $clauses[] = " INNER JOIN civicrm_acl_contact_cache aclContactCache_{$k} ON {$alias}.id = aclContactCache_{$k}.contact_id AND aclContactCache_{$k}.user_id = $contactID ";
 221       }
 222
 223       $fromClause = implode(" ", $clauses);
 224       $whereClase = NULL;
 225     }
 226     else {
 227       $fromClause = " INNER JOIN civicrm_acl_contact_cache aclContactCache ON {$contactAlias}.id = aclContactCache.contact_id ";
 228       $whereClase = " aclContactCache.user_id = $contactID AND $contactAlias.is_deleted = 0";
 229     }
 230
 231     return array($fromClause, $whereClase);
 232   }
 233
 234   /**
 235    * Get the permission base on its relationship.
 236    *
 237    * @param int $selectedContactID
 238    *   Contact id of selected contact.
 239    * @param int $contactID
 240    *   Contact id of the current contact.
 241    *
 242    * @return bool
 243    *   true if logged in user has permission to view
 244    *   selected contact record else false
 245    */
 246   public static function relationship($selectedContactID, $contactID = NULL) {
 247     $session = CRM_Core_Session::singleton();
 248     $config = CRM_Core_Config::singleton();
 249     if (!$contactID) {
 250       $contactID = $session->get('userID');
 251       if (!$contactID) {
 252         return FALSE;
 253       }
 254     }
 255     if ($contactID == $selectedContactID &&
 256       (CRM_Core_Permission::check('edit my contact') || CRM_Core_Permission::check('view my contact'))
 257     ) {
 258       return TRUE;
 259     }
 260     else {
 261       if ($config->secondDegRelPermissions) {
 262         $query = "
 263 SELECT firstdeg.id
 264 FROM   civicrm_relationship firstdeg
 265 LEFT JOIN civicrm_relationship seconddegaa
 266   on firstdeg.contact_id_a = seconddegaa.contact_id_b
 267   and seconddegaa.is_permission_b_a = 1
 268   and firstdeg.is_permission_b_a = 1
 269   and seconddegaa.is_active = 1
 270 LEFT JOIN civicrm_relationship seconddegab
 271   on firstdeg.contact_id_a = seconddegab.contact_id_a
 272   and seconddegab.is_permission_a_b = 1
 273   and firstdeg.is_permission_b_a = 1
 274   and seconddegab.is_active = 1
 275 LEFT JOIN civicrm_relationship seconddegba
 276   on firstdeg.contact_id_b = seconddegba.contact_id_b
 277   and seconddegba.is_permission_b_a = 1
 278   and firstdeg.is_permission_a_b = 1
 279   and seconddegba.is_active = 1
 280 LEFT JOIN civicrm_relationship seconddegbb
 281   on firstdeg.contact_id_b = seconddegbb.contact_id_a
 282   and seconddegbb.is_permission_a_b = 1
 283   and firstdeg.is_permission_a_b = 1
 284   and seconddegbb.is_active = 1
 285 WHERE
 286   (
 287     ( firstdeg.contact_id_a = %1 AND firstdeg.contact_id_b = %2 AND firstdeg.is_permission_a_b = 1 )
 288     OR ( firstdeg.contact_id_a = %2 AND firstdeg.contact_id_b = %1 AND firstdeg.is_permission_b_a = 1 )
 289     OR (
 290       firstdeg.contact_id_a = %1 AND seconddegba.contact_id_a = %2
 291       AND (seconddegba.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 292     )
 293     OR (
 294       firstdeg.contact_id_a = %1 AND seconddegbb.contact_id_b = %2
 295       AND (seconddegbb.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 296     )
 297     OR (
 298       firstdeg.contact_id_b = %1 AND seconddegab.contact_id_b = %2
 299       AND (seconddegab.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 300     )
 301     OR (
 302       firstdeg.contact_id_b = %1 AND seconddegaa.contact_id_a = %2      AND (seconddegaa.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 303     )
 304   )
 305   AND (firstdeg.contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 306   AND (firstdeg.contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 307   AND ( firstdeg.is_active = 1)
 308       ";
 309       }
 310       else {
 311         $query = "
 312 SELECT id
 313 FROM   civicrm_relationship
 314 WHERE  (( contact_id_a = %1 AND contact_id_b = %2 AND is_permission_a_b = 1 ) OR
 315         ( contact_id_a = %2 AND contact_id_b = %1 AND is_permission_b_a = 1 )) AND
 316        (contact_id_a NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1)) AND
 317        (contact_id_b NOT IN (SELECT id FROM civicrm_contact WHERE is_deleted = 1))
 318   AND  ( civicrm_relationship.is_active = 1 )
 319 ";
 320       }
 321       $params = array(
 322         1 => array($contactID, 'Integer'),
 323         2 => array($selectedContactID, 'Integer'),
 324       );
 325       return CRM_Core_DAO::singleValueQuery($query, $params);
 326     }
 327   }
 328
 329
 330   /**
 331    * @param int $contactID
 332    * @param CRM_Core_Form $form
 333    * @param bool $redirect
 334    *
 335    * @return bool
 336    */
 337   public static function validateOnlyChecksum($contactID, &$form, $redirect = TRUE) {
 338     // check if this is of the format cs=XXX
 339     if (!CRM_Contact_BAO_Contact_Utils::validChecksum($contactID,
 340       CRM_Utils_Request::retrieve('cs', 'String', $form, FALSE)
 341     )
 342     ) {
 343       if ($redirect) {
 344         // also set a message in the UF framework
 345         $message = ts('You do not have permission to edit this contact record. Contact the site administrator if you need assistance.');
 346         CRM_Utils_System::setUFMessage($message);
 347
 348         $config = CRM_Core_Config::singleton();
 349         CRM_Core_Error::statusBounce($message,
 350           $config->userFrameworkBaseURL
 351         );
 352         // does not come here, we redirect in the above statement
 353       }
 354       return FALSE;
 355     }
 356
 357     // set appropriate AUTH source
 358     self::initChecksumAuthSrc(TRUE, $form);
 359
 360     // so here the contact is posing as $contactID, lets set the logging contact ID variable
 361     // CRM-8965
 362     CRM_Core_DAO::executeQuery('SET @civicrm_user_id = %1',
 363       array(1 => array($contactID, 'Integer'))
 364     );
 365
 366     return TRUE;
 367   }
 368
 369   /**
 370    * @param bool $checkSumValidationResult
 371    * @param null $form
 372    */
 373   public static function initChecksumAuthSrc($checkSumValidationResult = FALSE, $form = NULL) {
 374     $session = CRM_Core_Session::singleton();
 375     if ($checkSumValidationResult && $form && CRM_Utils_Request::retrieve('cs', 'String', $form, FALSE)) {
 376       // if result is already validated, and url has cs, set the flag.
 377       $session->set('authSrc', CRM_Core_Permission::AUTH_SRC_CHECKSUM);
 378     }
 379     elseif (($session->get('authSrc') & CRM_Core_Permission::AUTH_SRC_CHECKSUM) == CRM_Core_Permission::AUTH_SRC_CHECKSUM) {
 380       // if checksum wasn't present in REQUEST OR checksum result validated as FALSE,
 381       // and flag was already set exactly as AUTH_SRC_CHECKSUM, unset it.
 382       $session->set('authSrc', CRM_Core_Permission::AUTH_SRC_UNKNOWN);
 383     }
 384   }
 385
 386   /**
 387    * @param int $contactID
 388    * @param CRM_Core_Form $form
 389    * @param bool $redirect
 390    *
 391    * @return bool
 392    */
 393   public static function validateChecksumContact($contactID, &$form, $redirect = TRUE) {
 394     if (!self::allow($contactID, CRM_Core_Permission::EDIT)) {
 395       // check if this is of the format cs=XXX
 396       return self::validateOnlyChecksum($contactID, $form, $redirect);
 397     }
 398     return TRUE;
 399   }
 400
 401 }