4 +--------------------------------------------------------------------+
5 | CiviCRM version 4.3 |
6 +--------------------------------------------------------------------+
7 | Copyright CiviCRM LLC (c) 2004-2013 |
8 +--------------------------------------------------------------------+
9 | This file is a part of CiviCRM. |
11 | CiviCRM is free software; you can copy, modify, and distribute it |
12 | under the terms of the GNU Affero General Public License |
13 | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. |
15 | CiviCRM is distributed in the hope that it will be useful, but |
16 | WITHOUT ANY WARRANTY; without even the implied warranty of |
17 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
18 | See the GNU Affero General Public License for more details. |
20 | You should have received a copy of the GNU Affero General Public |
21 | License and the CiviCRM Licensing Exception along |
22 | with this program; if not, contact CiviCRM LLC |
23 | at info[AT]civicrm[DOT]org. If you have questions about the |
24 | GNU Affero General Public License or the licensing of CiviCRM, |
25 | see the CiviCRM license FAQ at http://civicrm.org/licensing |
26 +--------------------------------------------------------------------+
30 * Decide what permissions to check for an api call
31 * The contact must have all of the returned permissions for the api call to be allowed
33 * @param $entity: (str) api entity
34 * @param $action: (str) api action
35 * @param $params: (array) api params
37 * @return array of permissions to check for this entity-action combo
39 function _civicrm_api3_permissions($entity, $action, &$params) {
40 $entity = strtolower($entity);
41 $action = strtolower($action);
42 $permissions = array();
44 $permissions['activity'] = array(
51 'view all activities',
54 $permissions['address'] = array(
72 $permissions['contact'] = array(
81 // managed by query object
87 'getquick' => array('access CiviCRM'),
89 $permissions['contribution'] = array(
92 'access CiviContribute',
97 'access CiviContribute',
98 'delete in CiviContribute',
102 'access CiviContribute',
106 'access CiviContribute',
107 'edit contributions',
110 $permissions['custom_field'] = array(
112 'administer CiviCRM',
114 'access all custom data',
117 'administer CiviCRM',
119 'access all custom data',
122 'administer CiviCRM',
124 'access all custom data',
127 'administer CiviCRM',
129 'access all custom data',
132 $permissions['custom_group'] = array(
134 'administer CiviCRM',
136 'access all custom data',
139 'administer CiviCRM',
141 'access all custom data',
144 'administer CiviCRM',
146 'access all custom data',
149 'administer CiviCRM',
151 'access all custom data',
154 $permissions['email'] = array(
172 $permissions['event'] = array(
181 'delete in CiviEvent',
194 $permissions['file'] = array(
197 'access uploaded files',
201 'access uploaded files',
205 'access uploaded files',
209 'access uploaded files',
212 $permissions['files_by_entity'] = array(
215 'access uploaded files',
219 'access uploaded files',
223 'access uploaded files',
227 'access uploaded files',
230 $permissions['group'] = array(
244 $permissions['group_contact'] = array(
258 $permissions['group_nesting'] = array(
272 $permissions['group_organization'] = array(
286 $permissions['location'] = array(
304 $permissions['membership'] = array(
313 'delete in CiviMember',
325 $permissions['membership_payment'] = array(
330 'access CiviContribute',
331 'edit contributions',
336 'delete in CiviMember',
337 'access CiviContribute',
338 'delete in CiviContribute',
343 'access CiviContribute',
349 'access CiviContribute',
350 'edit contributions',
353 $permissions['membership_status'] = array(
362 'delete in CiviMember',
374 $permissions['membership_type'] = array(
383 'delete in CiviMember',
395 $permissions['note'] = array(
413 $permissions['participant'] = array(
417 'register for events',
422 'edit event participants',
427 'view event participants',
432 'edit event participants',
435 $permissions['participant_payment'] = array(
439 'register for events',
440 'access CiviContribute',
441 'edit contributions',
446 'edit event participants',
447 'access CiviContribute',
448 'delete in CiviContribute',
453 'view event participants',
454 'access CiviContribute',
459 'edit event participants',
460 'access CiviContribute',
461 'edit contributions',
464 $permissions['phone'] = array(
482 $permissions['pledge'] = array(
491 'delete in CiviPledge',
503 $permissions['pledge_payment'] = array(
508 'access CiviContribute',
509 'edit contributions',
514 'delete in CiviPledge',
515 'access CiviContribute',
516 'delete in CiviContribute',
521 'access CiviContribute',
527 'access CiviContribute',
528 'edit contributions',
531 $permissions['system'] = array(
532 'flush' => array('administer CiviCRM'),
534 $permissions['website'] = array(
553 // let third parties modify the permissions
554 CRM_Utils_Hook
::alterAPIPermissions($entity, $action, $params, $permissions);
556 return isset($permissions[$entity][$action]) ?
$permissions[$entity][$action] : array('administer CiviCRM');
559 # FIXME: not sure how to permission the following API 3 calls:
560 # contribution_transact (make online contributions)
562 # group_contact_pending
563 # group_contact_update_status
564 # mailing_event_bounce
565 # mailing_event_click
566 # mailing_event_confirm
567 # mailing_event_forward
569 # mailing_event_reply
570 # mailing_group_event_domain_unsubscribe
571 # mailing_group_event_resubscribe
572 # mailing_group_event_subscribe
573 # mailing_group_event_unsubscribe
574 # membership_status_calc
575 # survey_respondant_count