CRM/Core/DAO/permissions.php

   1 <?php
   2
   3 /*
   4  +--------------------------------------------------------------------+
   5  | CiviCRM version 4.3                                                |
   6  +--------------------------------------------------------------------+
   7  | Copyright CiviCRM LLC (c) 2004-2013                                |
   8  +--------------------------------------------------------------------+
   9  | This file is a part of CiviCRM.                                    |
  10  |                                                                    |
  11  | CiviCRM is free software; you can copy, modify, and distribute it  |
  12  | under the terms of the GNU Affero General Public License           |
  13  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  14  |                                                                    |
  15  | CiviCRM is distributed in the hope that it will be useful, but     |
  16  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  17  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  18  | See the GNU Affero General Public License for more details.        |
  19  |                                                                    |
  20  | You should have received a copy of the GNU Affero General Public   |
  21  | License and the CiviCRM Licensing Exception along                  |
  22  | with this program; if not, contact CiviCRM LLC                     |
  23  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  24  | GNU Affero General Public License or the licensing of CiviCRM,     |
  25  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  26  +--------------------------------------------------------------------+
  27 */
  28
  29 /**
  30  * Decide what permissions to check for an api call
  31  * The contact must have all of the returned permissions for the api call to be allowed
  32  *
  33  * @param $entity: (str) api entity
  34  * @param $action: (str) api action
  35  * @param $params: (array) api params
  36  *
  37  * @return array of permissions to check for this entity-action combo
  38  */
  39 function _civicrm_api3_permissions($entity, $action, &$params) {
  40   $entity = _civicrm_api_get_entity_name_from_camel($entity);
  41   $action = strtolower($action);
  42
  43   /**
  44    * @var array of permissions
  45    *
  46    * For each entity, we declare an array of permissions required for each action
  47    * The action is the array key, possible values:
  48    *  * create: applies to create (with no id in params)
  49    *  * update: applies to update, setvalue, create (with id in params)
  50    *  * get: applies to getcount, getsingle, getvalue and other gets
  51    *  * delete: applies to delete, replace
  52    *  * meta: applies to getfields, getoptions, getspec
  53    *  * default: catch-all for anything not declared
  54    *
  55    *  Note: some APIs declare other actions as well
  56    */
  57   $permissions = array();
  58
  59   // These are the default permissions - if any entity does not declare permissions for a given action,
  60   // (or the entity does not declare permissions at all) - then the action will be used from here
  61   $permissions['default'] = array(
  62     // applies to getfields, getoptions, etc.
  63     'meta' => array('access CiviCRM'),
  64     // catch-all, applies to create, get, delete, etc.
  65     // If an entity declares it's own 'default' action it will override this one
  66     'default' => array('administer CiviCRM'),
  67   );
  68
  69   $permissions['activity'] = array(
  70     'delete' => array(
  71       'access CiviCRM',
  72       'delete activities',
  73     ),
  74     'get' => array(
  75       'access CiviCRM',
  76       'view all activities',
  77     ),
  78   );
  79   $permissions['address'] = array(
  80     'create' => array(
  81       'access CiviCRM',
  82       'add contacts',
  83     ),
  84     'delete' => array(
  85       'access CiviCRM',
  86       'delete contacts',
  87     ),
  88     'get' => array(
  89       'access CiviCRM',
  90       'view all contacts',
  91     ),
  92     'update' => array(
  93       'access CiviCRM',
  94       'edit all contacts',
  95     ),
  96   );
  97   $permissions['contact'] = array(
  98     'create' => array(
  99       'access CiviCRM',
 100       'add contacts',
 101     ),
 102     'delete' => array(
 103       'access CiviCRM',
 104       'delete contacts',
 105     ),
 106     // managed by query object
 107     'get' => array(),
 108     'update' => array(
 109       'access CiviCRM',
 110       'edit all contacts',
 111     ),
 112     'getquick' => array('access CiviCRM'),
 113   );
 114   $permissions['contribution'] = array(
 115     'create' => array(
 116       'access CiviCRM',
 117       'access CiviContribute',
 118       'edit contributions',
 119     ),
 120     'delete' => array(
 121       'access CiviCRM',
 122       'access CiviContribute',
 123       'delete in CiviContribute',
 124     ),
 125     'get' => array(
 126       'access CiviCRM',
 127       'access CiviContribute',
 128     ),
 129     'update' => array(
 130       'access CiviCRM',
 131       'access CiviContribute',
 132       'edit contributions',
 133     ),
 134   );
 135   $permissions['custom_field'] = array(
 136     'create' => array(
 137       'administer CiviCRM',
 138       'access CiviCRM',
 139       'access all custom data',
 140     ),
 141     'delete' => array(
 142       'administer CiviCRM',
 143       'access CiviCRM',
 144       'access all custom data',
 145     ),
 146     'get' => array(
 147       'administer CiviCRM',
 148       'access CiviCRM',
 149       'access all custom data',
 150     ),
 151     'update' => array(
 152       'administer CiviCRM',
 153       'access CiviCRM',
 154       'access all custom data',
 155     ),
 156   );
 157   $permissions['custom_group'] = array(
 158     'create' => array(
 159       'administer CiviCRM',
 160       'access CiviCRM',
 161       'access all custom data',
 162     ),
 163     'delete' => array(
 164       'administer CiviCRM',
 165       'access CiviCRM',
 166       'access all custom data',
 167     ),
 168     'get' => array(
 169       'administer CiviCRM',
 170       'access CiviCRM',
 171       'access all custom data',
 172     ),
 173     'update' => array(
 174       'administer CiviCRM',
 175       'access CiviCRM',
 176       'access all custom data',
 177     ),
 178   );
 179   $permissions['email'] = array(
 180     'create' => array(
 181       'access CiviCRM',
 182       'add contacts',
 183     ),
 184     'delete' => array(
 185       'access CiviCRM',
 186       'delete contacts',
 187     ),
 188     'get' => array(
 189       'access CiviCRM',
 190       'view all contacts',
 191     ),
 192     'update' => array(
 193       'access CiviCRM',
 194       'edit all contacts',
 195     ),
 196   );
 197   $permissions['event'] = array(
 198     'create' => array(
 199       'access CiviCRM',
 200       'access CiviEvent',
 201       'edit all events',
 202     ),
 203     'delete' => array(
 204       'access CiviCRM',
 205       'access CiviEvent',
 206       'delete in CiviEvent',
 207     ),
 208     'get' => array(
 209       'access CiviCRM',
 210       'access CiviEvent',
 211       'view event info',
 212     ),
 213     'update' => array(
 214       'access CiviCRM',
 215       'access CiviEvent',
 216       'edit all events',
 217     ),
 218   );
 219   $permissions['file'] = array(
 220     'create' => array(
 221       'access CiviCRM',
 222       'access uploaded files',
 223     ),
 224     'delete' => array(
 225       'access CiviCRM',
 226       'access uploaded files',
 227     ),
 228     'get' => array(
 229       'access CiviCRM',
 230       'access uploaded files',
 231     ),
 232     'update' => array(
 233       'access CiviCRM',
 234       'access uploaded files',
 235     ),
 236   );
 237   $permissions['files_by_entity'] = array(
 238     'create' => array(
 239       'access CiviCRM',
 240       'access uploaded files',
 241     ),
 242     'delete' => array(
 243       'access CiviCRM',
 244       'access uploaded files',
 245     ),
 246     'get' => array(
 247       'access CiviCRM',
 248       'access uploaded files',
 249     ),
 250     'update' => array(
 251       'access CiviCRM',
 252       'access uploaded files',
 253     ),
 254   );
 255   $permissions['group'] = array(
 256     'create' => array(
 257       'access CiviCRM',
 258       'edit groups',
 259     ),
 260     'delete' => array(
 261       'access CiviCRM',
 262       'edit groups',
 263     ),
 264     'update' => array(
 265       'access CiviCRM',
 266       'edit groups',
 267     ),
 268   );
 269   $permissions['group_contact'] = array(
 270     'create' => array(
 271       'access CiviCRM',
 272       'edit groups',
 273     ),
 274     'delete' => array(
 275       'access CiviCRM',
 276       'edit groups',
 277     ),
 278     'update' => array(
 279       'access CiviCRM',
 280       'edit groups',
 281     ),
 282   );
 283   $permissions['group_nesting'] = array(
 284     'create' => array(
 285       'access CiviCRM',
 286       'edit groups',
 287     ),
 288     'delete' => array(
 289       'access CiviCRM',
 290       'edit groups',
 291     ),
 292     'update' => array(
 293       'access CiviCRM',
 294       'edit groups',
 295     ),
 296   );
 297   $permissions['group_organization'] = array(
 298     'create' => array(
 299       'access CiviCRM',
 300       'edit groups',
 301     ),
 302     'delete' => array(
 303       'access CiviCRM',
 304       'edit groups',
 305     ),
 306     'update' => array(
 307       'access CiviCRM',
 308       'edit groups',
 309     ),
 310   );
 311   $permissions['location'] = array(
 312     'create' => array(
 313       'access CiviCRM',
 314       'add contacts',
 315     ),
 316     'delete' => array(
 317       'access CiviCRM',
 318       'delete contacts',
 319     ),
 320     'get' => array(
 321       'access CiviCRM',
 322       'view all contacts',
 323     ),
 324     'update' => array(
 325       'access CiviCRM',
 326       'edit all contacts',
 327     ),
 328   );
 329   $permissions['membership'] = array(
 330     'create' => array(
 331       'access CiviCRM',
 332       'access CiviMember',
 333       'edit memberships',
 334     ),
 335     'delete' => array(
 336       'access CiviCRM',
 337       'access CiviMember',
 338       'delete in CiviMember',
 339     ),
 340     'get' => array(
 341       'access CiviCRM',
 342       'access CiviMember',
 343     ),
 344     'update' => array(
 345       'access CiviCRM',
 346       'access CiviMember',
 347       'edit memberships',
 348     ),
 349   );
 350   $permissions['membership_payment'] = array(
 351     'create' => array(
 352       'access CiviCRM',
 353       'access CiviMember',
 354       'edit memberships',
 355       'access CiviContribute',
 356       'edit contributions',
 357     ),
 358     'delete' => array(
 359       'access CiviCRM',
 360       'access CiviMember',
 361       'delete in CiviMember',
 362       'access CiviContribute',
 363       'delete in CiviContribute',
 364     ),
 365     'get' => array(
 366       'access CiviCRM',
 367       'access CiviMember',
 368       'access CiviContribute',
 369     ),
 370     'update' => array(
 371       'access CiviCRM',
 372       'access CiviMember',
 373       'edit memberships',
 374       'access CiviContribute',
 375       'edit contributions',
 376     ),
 377   );
 378   $permissions['membership_status'] = array(
 379     'create' => array(
 380       'access CiviCRM',
 381       'access CiviMember',
 382       'edit memberships',
 383     ),
 384     'delete' => array(
 385       'access CiviCRM',
 386       'access CiviMember',
 387       'delete in CiviMember',
 388     ),
 389     'get' => array(
 390       'access CiviCRM',
 391       'access CiviMember',
 392     ),
 393     'update' => array(
 394       'access CiviCRM',
 395       'access CiviMember',
 396       'edit memberships',
 397     ),
 398   );
 399   $permissions['membership_type'] = array(
 400     'create' => array(
 401       'access CiviCRM',
 402       'access CiviMember',
 403       'edit memberships'
 404     ),
 405     'delete' => array(
 406       'access CiviCRM',
 407       'access CiviMember',
 408       'delete in CiviMember',
 409     ),
 410     'get' => array(
 411       'access CiviCRM',
 412       'access CiviMember',
 413     ),
 414     'update' => array(
 415       'access CiviCRM',
 416       'access CiviMember',
 417       'edit memberships',
 418     ),
 419   );
 420   $permissions['note'] = array(
 421     'create' => array(
 422       'access CiviCRM',
 423       'add contacts'
 424     ),
 425     'delete' => array(
 426       'access CiviCRM',
 427       'delete contacts',
 428     ),
 429     'get' => array(
 430       'access CiviCRM',
 431       'view all contacts',
 432     ),
 433     'update' => array(
 434       'access CiviCRM',
 435       'edit all contacts',
 436     ),
 437   );
 438   $permissions['participant'] = array(
 439     'create' => array(
 440       'access CiviCRM',
 441       'access CiviEvent',
 442       'register for events',
 443     ),
 444     'delete' => array(
 445       'access CiviCRM',
 446       'access CiviEvent',
 447       'edit event participants',
 448     ),
 449     'get' => array(
 450       'access CiviCRM',
 451       'access CiviEvent',
 452       'view event participants',
 453     ),
 454     'update' => array(
 455       'access CiviCRM',
 456       'access CiviEvent',
 457       'edit event participants',
 458     ),
 459   );
 460   $permissions['participant_payment'] = array(
 461     'create' => array(
 462       'access CiviCRM',
 463       'access CiviEvent',
 464       'register for events',
 465       'access CiviContribute',
 466       'edit contributions',
 467     ),
 468     'delete' => array(
 469       'access CiviCRM',
 470       'access CiviEvent',
 471       'edit event participants',
 472       'access CiviContribute',
 473       'delete in CiviContribute',
 474     ),
 475     'get' => array(
 476       'access CiviCRM',
 477       'access CiviEvent',
 478       'view event participants',
 479       'access CiviContribute',
 480     ),
 481     'update' => array(
 482       'access CiviCRM',
 483       'access CiviEvent',
 484       'edit event participants',
 485       'access CiviContribute',
 486       'edit contributions',
 487     ),
 488   );
 489   $permissions['phone'] = array(
 490     'create' => array(
 491       'access CiviCRM',
 492       'add contacts',
 493     ),
 494     'delete' => array(
 495       'access CiviCRM',
 496       'delete contacts',
 497     ),
 498     'get' => array(
 499       'access CiviCRM',
 500       'view all contacts',
 501     ),
 502     'update' => array(
 503       'access CiviCRM',
 504       'edit all contacts',
 505     ),
 506   );
 507   $permissions['pledge'] = array(
 508     'create' => array(
 509       'access CiviCRM',
 510       'access CiviPledge',
 511       'edit pledges',
 512     ),
 513     'delete' => array(
 514       'access CiviCRM',
 515       'access CiviPledge',
 516       'delete in CiviPledge',
 517     ),
 518     'get' => array(
 519       'access CiviCRM',
 520       'access CiviPledge',
 521     ),
 522     'update' => array(
 523       'access CiviCRM',
 524       'access CiviPledge',
 525       'edit pledges',
 526     ),
 527   );
 528   $permissions['pledge_payment'] = array(
 529     'create' => array(
 530       'access CiviCRM',
 531       'access CiviPledge',
 532       'edit pledges',
 533       'access CiviContribute',
 534       'edit contributions',
 535     ),
 536     'delete' => array(
 537       'access CiviCRM',
 538       'access CiviPledge',
 539       'delete in CiviPledge',
 540       'access CiviContribute',
 541       'delete in CiviContribute',
 542     ),
 543     'get' => array(
 544       'access CiviCRM',
 545       'access CiviPledge',
 546       'access CiviContribute',
 547     ),
 548     'update' => array(
 549       'access CiviCRM',
 550       'access CiviPledge',
 551       'edit pledges',
 552       'access CiviContribute',
 553       'edit contributions',
 554     ),
 555   );
 556   $permissions['system'] = array(
 557     'flush' => array('administer CiviCRM'),
 558   );
 559   $permissions['website'] = array(
 560     'create' => array(
 561       'access CiviCRM',
 562       'add contacts',
 563     ),
 564     'delete' => array(
 565       'access CiviCRM',
 566       'delete contacts',
 567     ),
 568     'get' => array(
 569       'access CiviCRM',
 570       'view all contacts',
 571     ),
 572     'update' => array(
 573       'access CiviCRM',
 574       'edit all contacts',
 575     ),
 576   );
 577
 578   // Translate 'create' action to 'update' if id is set
 579   if ($action == 'create' && (!empty($params['id']) || !empty($params[$entity . '_id']))) {
 580     $action = 'update';
 581   }
 582
 583   // let third parties modify the permissions
 584   CRM_Utils_Hook::alterAPIPermissions($entity, $action, $params, $permissions);
 585
 586   // Merge permissions for this entity with the defaults
 587   $perm = CRM_Utils_Array::value($entity, $permissions, array()) + $permissions['default'];
 588
 589   // Return exact match if permission for this action has been declared
 590   if (isset($perm[$action])) {
 591     return $perm[$action];
 592   }
 593
 594   // Translate specific actions into their generic equivalents
 595   $snippet = substr($action, 0, 3);
 596   if ($action == 'replace' || $snippet == 'del') {
 597     $action = 'delete';
 598   }
 599   elseif ($action == 'setvalue' || $snippet == 'upd') {
 600     $action = 'update';
 601   }
 602   elseif ($action == 'getfields' || $action == 'getspec' || $action == 'getoptions') {
 603     $action = 'meta';
 604   }
 605   elseif ($snippet == 'get') {
 606     $action = 'get';
 607   }
 608   return isset($perm[$action]) ? $perm[$action] : $perm['default'];
 609 }
 610
 611 # FIXME: not sure how to permission the following API 3 calls:
 612 # contribution_transact (make online contributions)
 613 # entity_tag_display
 614 # group_contact_pending
 615 # group_contact_update_status
 616 # mailing_event_bounce
 617 # mailing_event_click
 618 # mailing_event_confirm
 619 # mailing_event_forward
 620 # mailing_event_open
 621 # mailing_event_reply
 622 # mailing_group_event_domain_unsubscribe
 623 # mailing_group_event_resubscribe
 624 # mailing_group_event_subscribe
 625 # mailing_group_event_unsubscribe
 626 # membership_status_calc
 627 # survey_respondant_count