3 +--------------------------------------------------------------------+
4 | Copyright CiviCRM LLC. All rights reserved. |
6 | This work is published under the GNU AGPLv3 license with some |
7 | permitted exceptions and without any warranty. For full license |
8 | and copyright information, see https://civicrm.org/licensing |
9 +--------------------------------------------------------------------+
15 * @copyright CiviCRM LLC https://civicrm.org/licensing
19 * This is the basic permission class wrapper
21 class CRM_Core_Permission
{
24 * Static strings used to compose permissions.
29 const EDIT_GROUPS
= 'edit contacts in ', VIEW_GROUPS
= 'view contacts in ';
32 * The various type of permissions.
36 const EDIT
= 1, VIEW
= 2, DELETE
= 3, CREATE
= 4, SEARCH
= 5, ALL
= 6, ADMIN
= 7;
39 * A placeholder permission which always fails.
41 const ALWAYS_DENY_PERMISSION
= "*always deny*";
44 * A placeholder permission which always fails.
46 const ALWAYS_ALLOW_PERMISSION
= "*always allow*";
49 * Various authentication sources.
53 const AUTH_SRC_UNKNOWN
= 0, AUTH_SRC_CHECKSUM
= 1, AUTH_SRC_SITEKEY
= 2, AUTH_SRC_LOGIN
= 4;
56 * Get the current permission of this user.
59 * the permission of the user (edit or view or null)
61 public static function getPermission() {
62 $config = CRM_Core_Config
::singleton();
63 return $config->userPermissionClass
->getPermission();
67 * Given a permission string or array, check for access requirements
69 * Ex 1: Must have 'access CiviCRM'
70 * (string) 'access CiviCRM'
72 * Ex 2: Must have 'access CiviCRM' and 'access AJAX API'
73 * ['access CiviCRM', 'access AJAX API']
75 * Ex 3: Must have 'access CiviCRM' or 'access AJAX API'
77 * ['access CiviCRM', 'access AJAX API'],
80 * Ex 4: Must have 'access CiviCRM' or 'access AJAX API' AND 'access CiviEvent'
82 * ['access CiviCRM', 'access AJAX API'],
86 * Note that in permissions.php this is keyed by the action eg.
87 * (access Civi || access AJAX) && (access CiviEvent || access CiviContribute)
89 * ['access CiviCRM', 'access AJAX API'],
90 * ['access CiviEvent', 'access CiviContribute']
93 * @param string|array $permissions
94 * The permission to check as an array or string -see examples.
96 * @param int $contactId
97 * Contact id to check permissions for. Defaults to current logged-in user.
100 * true if contact has permission(s), else false
102 public static function check($permissions, $contactId = NULL) {
103 $permissions = (array) $permissions;
104 $userId = CRM_Core_BAO_UFMatch
::getUFId($contactId);
106 /** @var CRM_Core_Permission_Temp $tempPerm */
107 $tempPerm = CRM_Core_Config
::singleton()->userPermissionTemp
;
109 foreach ($permissions as $permission) {
110 if (is_array($permission)) {
111 foreach ($permission as $orPerm) {
112 if (self
::check($orPerm, $contactId)) {
113 //one of our 'or' permissions has succeeded - stop checking this permission
117 //none of our our conditions was met
121 // This is an individual permission
122 $impliedPermissions = self
::getImpliedPermissionsFor($permission);
123 $impliedPermissions[] = $permission;
124 foreach ($impliedPermissions as $permissionOption) {
125 $granted = CRM_Core_Config
::singleton()->userPermissionClass
->check($permissionOption, $userId);
126 // Call the permission_check hook to permit dynamic escalation (CRM-19256)
127 CRM_Utils_Hook
::permission_check($permissionOption, $granted, $contactId);
135 && !($tempPerm && $tempPerm->check($permission))
137 //one of our 'and' conditions has not been met
146 * Determine if any one of the permissions strings applies to current user.
148 * @param array $perms
151 public static function checkAnyPerm($perms) {
152 foreach ($perms as $perm) {
153 if (CRM_Core_Permission
::check($perm)) {
161 * Given a group/role array, check for access requirements
163 * @param array $array
164 * The group/role to check.
167 * true if yes, else false
169 public static function checkGroupRole($array) {
170 $config = CRM_Core_Config
::singleton();
171 return $config->userPermissionClass
->checkGroupRole($array);
175 * Get the permissioned where clause for the user.
178 * The type of permission needed.
179 * @param array $tables
180 * (reference ) add the tables that are needed for the select clause.
181 * @param array $whereTables
182 * (reference ) add the tables that are needed for the where clause.
185 * the group where clause for this user
187 public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) {
188 $config = CRM_Core_Config
::singleton();
189 return $config->userPermissionClass
->getPermissionedStaticGroupClause($type, $tables, $whereTables);
193 * Get all groups from database, filtered by permissions
196 * @param string $groupType
197 * Type of group(Access/Mailing).
198 * @param bool $excludeHidden
199 * exclude hidden groups.
203 * array reference of all groups.
205 public static function group($groupType, $excludeHidden = TRUE) {
206 $config = CRM_Core_Config
::singleton();
207 return $config->userPermissionClass
->group($groupType, $excludeHidden);
214 public static function customGroupAdmin($userId = NULL) {
215 // check if user has all powerful permission
216 // or administer civicrm permission (CRM-1905)
217 if (self
::check('access all custom data', $userId)) {
222 self
::check('administer Multiple Organizations', $userId) &&
223 self
::isMultisiteEnabled()
228 if (self
::check('administer CiviCRM data', $userId)) {
242 public static function customGroup($type = CRM_Core_Permission
::VIEW
, $reset = FALSE, $userId = NULL) {
243 $customGroups = CRM_Core_PseudoConstant
::get('CRM_Core_DAO_CustomField', 'custom_group_id',
244 ['fresh' => $reset]);
247 // check if user has all powerful permission
248 // or administer civicrm permission (CRM-1905)
249 if (self
::customGroupAdmin($userId)) {
250 return array_keys($customGroups);
253 return CRM_ACL_API
::group($type, $userId, 'civicrm_custom_group', $customGroups, $defaultGroups);
258 * @param string|null $prefix
263 public static function customGroupClause($type = CRM_Core_Permission
::VIEW
, $prefix = NULL, $reset = FALSE) {
264 if (self
::customGroupAdmin()) {
268 $groups = self
::customGroup($type, $reset);
269 if (empty($groups)) {
273 return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
283 public static function ufGroupValid($gid, $type = CRM_Core_Permission
::VIEW
) {
288 $groups = self
::ufGroup($type);
289 return !empty($groups) && in_array($gid, $groups);
297 public static function ufGroup($type = CRM_Core_Permission
::VIEW
) {
298 $ufGroups = CRM_Core_PseudoConstant
::get('CRM_Core_DAO_UFField', 'uf_group_id');
300 $allGroups = array_keys($ufGroups);
302 // check if user has all powerful permission
303 if (self
::check('profile listings and forms')) {
308 case CRM_Core_Permission
::VIEW
:
309 if (self
::check('profile view')) {
314 case CRM_Core_Permission
::CREATE
:
315 if (self
::check('profile create')) {
320 case CRM_Core_Permission
::EDIT
:
321 if (self
::check('profile edit')) {
326 case CRM_Core_Permission
::SEARCH
:
327 if (self
::check('profile listings')) {
333 return CRM_ACL_API
::group($type, NULL, 'civicrm_uf_group', $ufGroups);
338 * @param string $prefix
339 * @param bool $returnUFGroupIds
341 * @return array|string
343 public static function ufGroupClause($type = CRM_Core_Permission
::VIEW
, $prefix = NULL, $returnUFGroupIds = FALSE) {
344 $groups = self
::ufGroup($type);
345 if ($returnUFGroupIds) {
348 elseif (empty($groups)) {
352 return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
358 * @param int $eventID
359 * @param string $context
363 public static function event($type = CRM_Core_Permission
::VIEW
, $eventID = NULL, $context = '') {
364 if (!empty($context)) {
365 if (CRM_Core_Permission
::check($context)) {
369 $events = CRM_Event_PseudoConstant
::event(NULL, TRUE);
372 // check if user has all powerful permission
373 if (self
::check('register for events')) {
374 $includeEvents = array_keys($events);
377 if ($type == CRM_Core_Permission
::VIEW
&&
378 self
::check('view event info')
380 $includeEvents = array_keys($events);
383 $permissionedEvents = CRM_ACL_API
::group($type, NULL, 'civicrm_event', $events, $includeEvents);
385 return $permissionedEvents;
387 if (!empty($permissionedEvents)) {
388 return array_search($eventID, $permissionedEvents) === FALSE ?
NULL : $eventID;
395 * @param null $prefix
399 public static function eventClause($type = CRM_Core_Permission
::VIEW
, $prefix = NULL) {
400 $events = self
::event($type);
401 if (empty($events)) {
405 return "{$prefix}id IN ( " . implode(',', $events) . ' ) ';
410 * Checks that component is enabled and optionally that user has basic perm.
412 * @param string $module
413 * Specifies the name of the CiviCRM component.
414 * @param bool $checkPermission
415 * Check not only that module is enabled, but that user has necessary
417 * @param bool $requireAllCasesPermOnCiviCase
418 * Significant only if $module == CiviCase
419 * Require "access all cases and activities", not just
420 * "access my cases and activities".
423 * Access to specified $module is granted.
425 public static function access($module, $checkPermission = TRUE, $requireAllCasesPermOnCiviCase = FALSE) {
426 if (!CRM_Core_Component
::isEnabled($module)) {
430 if ($checkPermission) {
433 $access_all_cases = CRM_Core_Permission
::check("access all cases and activities");
434 $access_my_cases = CRM_Core_Permission
::check("access my cases and activities");
435 return $access_all_cases ||
(!$requireAllCasesPermOnCiviCase && $access_my_cases);
438 return CRM_Core_Permission
::check("administer $module");
441 return CRM_Core_Permission
::check("access $module");
449 * Check permissions for delete and edit actions.
451 * @param string $module
454 * Action to be check across component.
459 public static function checkActionPermission($module, $action) {
460 //check delete related permissions.
461 if ($action & CRM_Core_Action
::DELETE
) {
462 $permissionName = "delete in $module";
466 'CiviEvent' => 'edit event participants',
467 'CiviMember' => 'edit memberships',
468 'CiviPledge' => 'edit pledges',
469 'CiviContribute' => 'edit contributions',
470 'CiviGrant' => 'edit grants',
471 'CiviMail' => 'access CiviMail',
472 'CiviAuction' => 'add auction items',
474 $permissionName = $editPermissions[$module] ??
NULL;
477 if ($module == 'CiviCase' && !$permissionName) {
478 return CRM_Case_BAO_Case
::accessCiviCase();
481 //check for permission.
482 return CRM_Core_Permission
::check($permissionName);
492 public static function checkMenu(&$args, $op = 'and') {
493 if (!is_array($args)) {
496 foreach ($args as $str) {
497 $res = CRM_Core_Permission
::check($str);
498 if ($op == 'or' && $res) {
501 elseif ($op == 'and' && !$res) {
505 return ($op == 'or') ?
FALSE : TRUE;
514 public static function checkMenuItem(&$item) {
515 if (!array_key_exists('access_callback', $item)) {
516 CRM_Core_Error
::backtrace();
517 throw new CRM_Core_Exception('Missing Access Callback key in menu item');
520 // if component_id is present, ensure it is enabled
521 if (isset($item['component_id']) && $item['component_id']) {
522 if (!isset(Civi
::$statics[__CLASS__
]['componentNameId'])) {
523 Civi
::$statics[__CLASS__
]['componentNameId'] = array_flip(CRM_Core_Component
::getComponentIDs());
525 $componentName = Civi
::$statics[__CLASS__
]['componentNameId'][$item['component_id']];
527 $config = CRM_Core_Config
::singleton();
528 if (is_array($config->enableComponents
) && in_array($componentName, $config->enableComponents
)) {
529 // continue with process
536 // the following is imitating drupal 6 code in includes/menu.inc
537 if (empty($item['access_callback']) ||
538 is_numeric($item['access_callback'])
540 return (bool) $item['access_callback'];
543 // check whether the following Ajax requests submitted the right key
544 // FIXME: this should be integrated into ACLs proper
545 if (CRM_Utils_Array
::value('page_type', $item) == 3) {
546 if (!CRM_Core_Key
::validate($_REQUEST['key'], $item['path'])) {
551 // check if callback is for checkMenu, if so optimize it
552 if (is_array($item['access_callback']) &&
553 $item['access_callback'][0] == 'CRM_Core_Permission' &&
554 $item['access_callback'][1] == 'checkMenu'
556 $op = CRM_Utils_Array
::value(1, $item['access_arguments'], 'and');
557 return self
::checkMenu($item['access_arguments'][0], $op);
560 return call_user_func_array($item['access_callback'], $item['access_arguments']);
566 * Include disabled components
567 * @param bool $descriptions
568 * Whether to return descriptions
572 public static function basicPermissions($all = FALSE, $descriptions = FALSE) {
573 $cacheKey = implode('-', [$all, $descriptions]);
574 if (empty(Civi
::$statics[__CLASS__
][__FUNCTION__
][$cacheKey])) {
575 Civi
::$statics[__CLASS__
][__FUNCTION__
][$cacheKey] = self
::assembleBasicPermissions($all, $descriptions);
577 return Civi
::$statics[__CLASS__
][__FUNCTION__
][$cacheKey];
582 * @param bool $descriptions
583 * whether to return descriptions
586 * @throws \CRM_Core_Exception
588 public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE): array {
589 $permissions = self
::getCoreAndComponentPermissions($all);
591 // Add any permissions defined in hook_civicrm_permission implementations.
592 $module_permissions = CRM_Core_Config
::singleton()->userPermissionClass
->getAllModulePermissions(TRUE);
593 $permissions = array_merge($permissions, $module_permissions);
594 if (!$descriptions) {
595 foreach ($permissions as $name => $attr) {
596 $permissions[$name] = array_shift($attr);
605 public static function getAnonymousPermissionsWarnings() {
606 static $permissions = [];
607 if (empty($permissions)) {
609 'administer CiviCRM',
611 $components = CRM_Core_Component
::getComponents();
612 foreach ($components as $comp) {
613 if (!method_exists($comp, 'getAnonymousPermissionWarnings')) {
616 $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings());
623 * @param $anonymous_perms
627 public static function validateForPermissionWarnings($anonymous_perms) {
628 return array_intersect($anonymous_perms, self
::getAnonymousPermissionsWarnings());
632 * Get core permissions.
636 public static function getCorePermissions() {
637 $prefix = ts('CiviCRM') . ': ';
640 $prefix . ts('add contacts'),
641 ts('Create a new contact record in CiviCRM'),
643 'view all contacts' => [
644 $prefix . ts('view all contacts'),
645 ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'),
647 'edit all contacts' => [
648 $prefix . ts('edit all contacts'),
649 ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'),
651 'view my contact' => [
652 $prefix . ts('view my contact'),
654 'edit my contact' => [
655 $prefix . ts('edit my contact'),
657 'delete contacts' => [
658 $prefix . ts('delete contacts'),
660 'access deleted contacts' => [
661 $prefix . ts('access deleted contacts'),
662 ts('Access contacts in the trash'),
664 'import contacts' => [
665 $prefix . ts('import contacts'),
666 ts('Import contacts and activities'),
668 'import SQL datasource' => [
669 $prefix . ts('import SQL datasource'),
670 ts('When importing, consume data directly from a SQL datasource'),
673 $prefix . ts('edit groups'),
674 ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'),
676 'administer CiviCRM' => [
677 $prefix . ts('administer CiviCRM'),
678 ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'),
680 'skip IDS check' => [
681 $prefix . ts('skip IDS check'),
682 ts('Warning: Give to trusted roles only; this permission has security implications. IDS system is bypassed for users with this permission. Prevents false errors for admin users.'),
684 'access uploaded files' => [
685 $prefix . ts('access uploaded files'),
686 ts('View / download files including images and photos'),
688 'profile listings and forms' => [
689 $prefix . ts('profile listings and forms'),
690 ts('Warning: Give to trusted roles only; this permission has privacy implications. Add/edit data in online forms and access public searchable directories.'),
692 'profile listings' => [
693 $prefix . ts('profile listings'),
694 ts('Warning: Give to trusted roles only; this permission has privacy implications. Access public searchable directories.'),
696 'profile create' => [
697 $prefix . ts('profile create'),
698 ts('Add data in a profile form.'),
701 $prefix . ts('profile edit'),
702 ts('Edit data in a profile form.'),
705 $prefix . ts('profile view'),
706 ts('View data in a profile.'),
708 'access all custom data' => [
709 $prefix . ts('access all custom data'),
710 ts('View all custom fields regardless of ACL rules'),
712 'view all activities' => [
713 $prefix . ts('view all activities'),
714 ts('View all activities (for visible contacts)'),
716 'delete activities' => [
717 $prefix . ts('Delete activities'),
719 'edit inbound email basic information' => [
720 $prefix . ts('edit inbound email basic information'),
721 ts('Edit all inbound email activities (for visible contacts) basic information. Content editing not allowed.'),
723 'edit inbound email basic information and content' => [
724 $prefix . ts('edit inbound email basic information and content'),
725 ts('Edit all inbound email activities (for visible contacts) basic information and content.'),
727 'access CiviCRM' => [
728 $prefix . ts('access CiviCRM backend and API'),
729 ts('Master control for access to the main CiviCRM backend and API. Give to trusted roles only.'),
731 'access Contact Dashboard' => [
732 $prefix . ts('access Contact Dashboard'),
733 ts('View Contact Dashboard (for themselves and visible contacts)'),
735 'translate CiviCRM' => [
736 $prefix . ts('translate CiviCRM'),
737 ts('Allow User to enable multilingual'),
740 $prefix . ts('manage tags'),
741 ts('Create and rename tags'),
743 'administer reserved groups' => [
744 $prefix . ts('administer reserved groups'),
745 ts('Edit and disable Reserved Groups (Needs Edit Groups)'),
747 'administer Tagsets' => [
748 $prefix . ts('administer Tagsets'),
750 'administer reserved tags' => [
751 $prefix . ts('administer reserved tags'),
753 'administer queues' => [
754 $prefix . ts('administer queues'),
755 ts('Initialize, browse, and cancel background processing queues'),
756 // At time of writing, we have specifically omitted the ability to edit fine-grained
757 // data about specific queue-tasks. Tasks are usually defined as PHP callables...
758 // and one should hesitate before allowing open-ended edits of PHP callables.
759 // However, it seems fine for web-admins to browse and cancel these things.
761 'administer dedupe rules' => [
762 $prefix . ts('administer dedupe rules'),
763 ts('Create and edit rules, change the supervised and unsupervised rules'),
765 'merge duplicate contacts' => [
766 $prefix . ts('merge duplicate contacts'),
767 ts('Delete Contacts must also be granted in order for this to work.'),
769 'force merge duplicate contacts' => [
770 $prefix . ts('force merge duplicate contacts'),
771 ts('Delete Contacts must also be granted in order for this to work.'),
773 'view debug output' => [
774 $prefix . ts('view debug output'),
775 ts('View results of debug and backtrace'),
778 'view all notes' => [
779 $prefix . ts('view all notes'),
780 ts("View notes (for visible contacts) even if they're marked admin only"),
782 'add contact notes' => [
783 $prefix . ts('add contact notes'),
784 ts("Create notes for contacts"),
786 'access AJAX API' => [
787 $prefix . ts('access AJAX API'),
788 ts('Allow API access even if Access CiviCRM is not granted'),
790 'access contact reference fields' => [
791 $prefix . ts('access contact reference fields'),
792 ts('Allow entering data into contact reference fields'),
794 'create manual batch' => [
795 $prefix . ts('create manual batch'),
796 ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'),
798 'edit own manual batches' => [
799 $prefix . ts('edit own manual batches'),
800 ts('Edit accounting batches created by user'),
802 'edit all manual batches' => [
803 $prefix . ts('edit all manual batches'),
804 ts('Edit all accounting batches'),
806 'close own manual batches' => [
807 $prefix . ts('close own manual batches'),
808 ts('Close accounting batches created by user (with Access to CiviContribute)'),
810 'close all manual batches' => [
811 $prefix . ts('close all manual batches'),
812 ts('Close all accounting batches (with Access to CiviContribute)'),
814 'reopen own manual batches' => [
815 $prefix . ts('reopen own manual batches'),
816 ts('Reopen accounting batches created by user (with Access to CiviContribute)'),
818 'reopen all manual batches' => [
819 $prefix . ts('reopen all manual batches'),
820 ts('Reopen all accounting batches (with Access to CiviContribute)'),
822 'view own manual batches' => [
823 $prefix . ts('view own manual batches'),
824 ts('View accounting batches created by user (with Access to CiviContribute)'),
826 'view all manual batches' => [
827 $prefix . ts('view all manual batches'),
828 ts('View all accounting batches (with Access to CiviContribute)'),
830 'delete own manual batches' => [
831 $prefix . ts('delete own manual batches'),
832 ts('Delete accounting batches created by user'),
834 'delete all manual batches' => [
835 $prefix . ts('delete all manual batches'),
836 ts('Delete all accounting batches'),
838 'export own manual batches' => [
839 $prefix . ts('export own manual batches'),
840 ts('Export accounting batches created by user'),
842 'export all manual batches' => [
843 $prefix . ts('export all manual batches'),
844 ts('Export all accounting batches'),
846 'administer payment processors' => [
847 $prefix . ts('administer payment processors'),
848 ts('Add, Update, or Disable Payment Processors'),
850 'render templates' => [
851 $prefix . ts('render templates'),
852 ts('Render open-ended template content. (Additional constraints may apply to autoloaded records and specific notations.)'),
854 'edit message templates' => [
855 $prefix . ts('edit message templates'),
857 'edit system workflow message templates' => [
858 $prefix . ts('edit system workflow message templates'),
860 'edit user-driven message templates' => [
861 $prefix . ts('edit user-driven message templates'),
863 'view my invoices' => [
864 $prefix . ts('view my invoices'),
865 ts('Allow users to view/ download their own invoices'),
868 $prefix . ts('edit api keys'),
871 'edit own api keys' => [
872 $prefix . ts('edit own api keys'),
873 ts('Edit user\'s own API keys'),
876 $prefix . ts('send SMS'),
879 'administer CiviCRM system' => [
880 'label' => $prefix . ts('administer CiviCRM System'),
881 'description' => ts('Perform all system administration tasks in CiviCRM'),
883 'administer CiviCRM data' => [
884 'label' => $prefix . ts('administer CiviCRM Data'),
885 'description' => ts('Permit altering all restricted data options'),
887 'all CiviCRM permissions and ACLs' => [
888 'label' => $prefix . ts('all CiviCRM permissions and ACLs'),
889 'description' => ts('Administer and use CiviCRM bypassing any other permission or ACL checks and enabling the creation of displays and forms that allow others to bypass checks. This permission should be given out with care'),
892 if (self
::isMultisiteEnabled()) {
893 // This could arguably be moved to the multisite extension but
894 // within core it does permit editing group-organization records.
895 $permissions['administer Multiple Organizations'] = [
896 'label' => $prefix . ts('administer Multiple Organizations'),
897 'description' => ts('Administer multiple organizations. In practice this allows editing the group organization link'),
904 * Get permissions implied by 'superset' permissions.
908 public static function getImpliedAdminPermissions(): array {
910 'administer CiviCRM' => ['implied_permissions' => ['administer CiviCRM system', 'administer CiviCRM data']],
911 'administer CiviCRM data' => ['implied_permissions' => ['edit message templates', 'administer dedupe rules']],
912 'administer CiviCRM system' => ['implied_permissions' => ['edit system workflow message templates']],
917 * Get any super-permissions that imply the given permission.
919 * @param string $permission
923 public static function getImpliedPermissionsFor(string $permission): array {
924 if (in_array($permission[0], ['@', '*'], TRUE)) {
925 // Special permissions like '*always deny*' - see DynamicFKAuthorizationTest.
926 // Also '@afform - see AfformUsageTest.
929 $implied = Civi
::cache('metadata')->get('implied_permissions', []);
930 if (isset($implied[$permission])) {
931 return $implied[$permission];
933 $implied[$permission] = ['all CiviCRM permissions and ACLs'];
934 foreach (self
::getImpliedAdminPermissions() as $key => $details) {
935 if (in_array($permission, $details['implied_permissions'] ??
[], TRUE)) {
936 $implied[$permission][] = $key;
939 Civi
::cache('metadata')->set('implied_permissions', $implied);
940 return $implied[$permission];
944 * For each entity provides an array of permissions required for each action
946 * The action is the array key, possible values:
947 * * create: applies to create (with no id in params)
948 * * update: applies to update, setvalue, create (with id in params)
949 * * get: applies to getcount, getsingle, getvalue and other gets
950 * * delete: applies to delete, replace
951 * * meta: applies to getfields, getoptions, getspec
952 * * default: catch-all for anything not declared
954 * Note: some APIs declare other actions as well
956 * Permissions should use arrays for AND and arrays of arrays for OR
957 * @see CRM_Core_Permission::check
959 * @return array of permissions
961 public static function getEntityActionPermissions() {
963 // These are the default permissions - if any entity does not declare permissions for a given action,
964 // (or the entity does not declare permissions at all) - then the action will be used from here
965 $permissions['default'] = [
966 // applies to getfields, getoptions, etc.
967 'meta' => ['access CiviCRM'],
968 // catch-all, applies to create, get, delete, etc.
969 // If an entity declares it's own 'default' action it will override this one
970 'default' => ['administer CiviCRM'],
973 // Note: Additional permissions in DynamicFKAuthorization
974 $permissions['attachment'] = [
976 ['access CiviCRM', 'access AJAX API'],
980 // Contact permissions
981 $permissions['contact'] = [
990 // managed by query object
992 // managed by _civicrm_api3_check_edit_permissions
995 ['access CiviCRM', 'access AJAX API'],
997 'duplicatecheck' => [
1000 'merge' => ['merge duplicate contacts'],
1003 $permissions['dedupe'] = [
1004 'getduplicates' => ['access CiviCRM'],
1005 'getstatistics' => ['access CiviCRM'],
1008 // CRM-16963 - Permissions for country.
1009 $permissions['country'] = [
1014 'administer CiviCRM',
1018 // Contact-related data permissions.
1019 $permissions['address'] = [
1020 // get is managed by BAO::addSelectWhereClause
1021 // create/delete are managed by _civicrm_api3_check_edit_permissions
1024 $permissions['email'] = $permissions['address'];
1025 $permissions['phone'] = $permissions['address'];
1026 $permissions['website'] = $permissions['address'];
1027 $permissions['im'] = $permissions['address'];
1028 $permissions['open_i_d'] = $permissions['address'];
1030 // Also managed by ACLs - CRM-19448
1031 $permissions['entity_tag'] = ['default' => []];
1032 $permissions['note'] = $permissions['entity_tag'];
1034 // Allow non-admins to get and create tags to support tagset widget
1035 // Delete is still reserved for admins
1036 $permissions['tag'] = [
1037 'get' => ['access CiviCRM'],
1038 'create' => ['access CiviCRM'],
1039 'update' => ['access CiviCRM'],
1042 //relationship permissions
1043 $permissions['relationship'] = [
1044 // get is managed by BAO::addSelectWhereClause
1048 'edit all contacts',
1052 'edit all contacts',
1055 // Readonly relationship_cache table
1056 $permissions['relationship_cache'] = [
1057 // get is managed by BAO::addSelectWhereClause
1061 // CRM-17741 - Permissions for RelationshipType.
1062 $permissions['relationship_type'] = [
1067 'administer CiviCRM',
1071 // Activity permissions
1072 $permissions['activity'] = [
1075 'delete activities',
1079 // Note that view all activities is also required within the api
1080 // if the id is not passed in. Where the id is passed in the activity
1081 // specific check functions are used and tested.
1085 'view all activities',
1088 $permissions['activity_contact'] = $permissions['activity'];
1091 $permissions['case'] = [
1098 'delete in CiviCase',
1101 'administer CiviCase',
1104 'administer CiviCase',
1107 // At minimum the user needs one of the following. Finer-grained access is controlled by CRM_Case_BAO_Case::addSelectWhereClause
1108 ['access my cases and activities', 'access all cases and activities'],
1111 $permissions['case_contact'] = $permissions['case'];
1112 $permissions['case_activity'] = $permissions['case'];
1114 $permissions['case_type'] = [
1115 'default' => ['administer CiviCase'],
1117 // nested array = OR
1118 ['access my cases and activities', 'access all cases and activities'],
1122 // Campaign permissions
1123 $permissions['campaign'] = [
1124 'get' => ['access CiviCRM'],
1126 // nested array = OR
1127 ['administer CiviCampaign', 'manage campaign'],
1130 $permissions['survey'] = $permissions['campaign'];
1132 // Financial permissions
1133 $permissions['contribution'] = [
1136 'access CiviContribute',
1140 'access CiviContribute',
1141 'delete in CiviContribute',
1143 'completetransaction' => [
1144 'edit contributions',
1148 'access CiviContribute',
1149 'edit contributions',
1152 $permissions['line_item'] = $permissions['contribution'];
1153 $permissions['product'] = $permissions['contribution'];
1155 $permissions['financial_item'] = $permissions['contribution'];
1156 $permissions['financial_type']['get'] = $permissions['contribution']['get'];
1157 $permissions['entity_financial_account']['get'] = $permissions['contribution']['get'];
1158 $permissions['financial_account']['get'] = $permissions['contribution']['get'];
1159 $permissions['financial_trxn']['get'] = $permissions['contribution']['get'];
1161 // Payment permissions
1162 $permissions['payment'] = [
1165 'access CiviContribute',
1169 'access CiviContribute',
1170 'delete in CiviContribute',
1174 'access CiviContribute',
1175 'edit contributions',
1179 'access CiviContribute',
1180 'edit contributions',
1184 'access CiviContribute',
1185 'edit contributions',
1188 $permissions['contribution_recur'] = $permissions['payment'];
1190 // Custom field permissions
1191 $permissions['custom_field'] = [
1193 'administer CiviCRM',
1194 'access all custom data',
1197 $permissions['custom_group'] = $permissions['custom_field'];
1199 // Event permissions
1200 $permissions['event'] = [
1209 'delete in CiviEvent',
1222 // Exception refers to dedupe_exception.
1223 $permissions['exception'] = [
1224 'default' => ['merge duplicate contacts'],
1227 $permissions['job'] = [
1228 'process_batch_merge' => ['merge duplicate contacts'],
1230 $permissions['rule_group']['get'] = [['merge duplicate contacts', 'administer CiviCRM']];
1231 // Loc block is only used for events
1232 $permissions['loc_block'] = $permissions['event'];
1234 $permissions['state_province'] = [
1240 // Price sets are shared by several components, user needs access to at least one of them
1241 $permissions['price_set'] = [
1243 ['access CiviEvent', 'access CiviContribute', 'access CiviMember'],
1246 ['access CiviCRM', 'view event info', 'make online contributions'],
1251 $permissions['file'] = [
1254 'access uploaded files',
1257 $permissions['files_by_entity'] = $permissions['file'];
1259 // Group permissions
1260 $permissions['group'] = [
1270 $permissions['group_nesting'] = $permissions['group'];
1271 $permissions['group_organization'] = $permissions['group'];
1273 //Group Contact permission
1274 $permissions['group_contact'] = [
1280 'edit all contacts',
1284 // CiviMail Permissions
1285 $civiMailBasePerms = [
1286 // To get/preview/update, one must have least one of these perms:
1287 // Mailing API implementations enforce nuances of create/approve/schedule permissions.
1290 'schedule mailings',
1293 $permissions['mailing'] = [
1301 'delete in CiviMail',
1305 ['access CiviMail', 'schedule mailings'],
1312 $permissions['mailing_group'] = $permissions['mailing'];
1313 $permissions['mailing_job'] = $permissions['mailing'];
1314 $permissions['mailing_recipients'] = $permissions['mailing'];
1316 $permissions['mailing_a_b'] = [
1324 'delete in CiviMail',
1328 ['access CiviMail', 'schedule mailings'],
1336 // Membership permissions
1337 $permissions['membership'] = [
1340 'access CiviMember',
1344 'access CiviMember',
1345 'delete in CiviMember',
1349 'access CiviMember',
1353 $permissions['membership_status'] = $permissions['membership'];
1354 $permissions['membership_type'] = $permissions['membership'];
1355 $permissions['membership_payment'] = [
1358 'access CiviMember',
1360 'access CiviContribute',
1361 'edit contributions',
1365 'access CiviMember',
1366 'delete in CiviMember',
1367 'access CiviContribute',
1368 'delete in CiviContribute',
1372 'access CiviMember',
1373 'access CiviContribute',
1377 'access CiviMember',
1379 'access CiviContribute',
1380 'edit contributions',
1384 // Participant permissions
1385 $permissions['participant'] = [
1389 'register for events',
1394 'edit event participants',
1399 'view event participants',
1404 'edit event participants',
1407 $permissions['participant_payment'] = [
1411 'register for events',
1412 'access CiviContribute',
1413 'edit contributions',
1418 'edit event participants',
1419 'access CiviContribute',
1420 'delete in CiviContribute',
1425 'view event participants',
1426 'access CiviContribute',
1431 'edit event participants',
1432 'access CiviContribute',
1433 'edit contributions',
1437 // Pledge permissions
1438 $permissions['pledge'] = [
1441 'access CiviPledge',
1446 'access CiviPledge',
1447 'delete in CiviPledge',
1451 'access CiviPledge',
1455 'access CiviPledge',
1460 //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission.
1461 $permissions['action_schedule'] = [
1470 $permissions['pledge_payment'] = [
1473 'access CiviPledge',
1475 'access CiviContribute',
1476 'edit contributions',
1480 'access CiviPledge',
1481 'delete in CiviPledge',
1482 'access CiviContribute',
1483 'delete in CiviContribute',
1487 'access CiviPledge',
1488 'access CiviContribute',
1492 'access CiviPledge',
1494 'access CiviContribute',
1495 'edit contributions',
1499 // Dashboard permissions
1500 $permissions['dashboard'] = [
1505 $permissions['dashboard_contact'] = [
1511 $permissions['saved_search'] = [
1512 'default' => ['administer CiviCRM data'],
1515 // Profile permissions
1516 $permissions['profile'] = [
1517 // the profile will take care of this
1521 $permissions['uf_group'] = [
1525 'administer CiviCRM',
1526 'manage event profiles',
1535 'administer CiviCRM',
1536 'manage event profiles',
1540 $permissions['uf_field'] = $permissions['uf_join'] = $permissions['uf_group'];
1541 $permissions['uf_field']['delete'] = [
1544 'administer CiviCRM',
1545 'manage event profiles',
1548 $permissions['option_value'] = $permissions['uf_group'];
1549 $permissions['option_group'] = $permissions['option_value'];
1551 // User Job permissions - we access these using acls on the get action.
1552 // For create it probably makes sense (at least initially) to be stricter
1553 // as the forms doing the work can set the permission check to FALSE.
1554 $permissions['user_job'] = [
1559 'administer CiviCRM',
1563 $permissions['custom_value'] = [
1564 'gettree' => ['access CiviCRM'],
1567 $permissions['message_template'] = [
1568 'get' => ['access CiviCRM'],
1569 'create' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']],
1570 'update' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']],
1573 $permissions['report_template']['update'] = 'save Report Criteria';
1574 $permissions['report_template']['create'] = 'save Report Criteria';
1575 return $permissions;
1579 * Translate an unknown action to a canonical form.
1581 * @param string $action
1584 * the standardised action name
1586 public static function getGenericAction($action) {
1587 $snippet = substr($action, 0, 3);
1588 if ($action == 'replace' ||
$snippet == 'del') {
1589 // 'Replace' is a combination of get+create+update+delete; however, the permissions
1590 // on each of those will be tested separately at runtime. This is just a sniff-test
1591 // based on the heuristic that 'delete' tends to be the most closely guarded
1592 // of the necessary permissions.
1595 elseif ($action == 'setvalue' ||
$snippet == 'upd') {
1598 elseif ($action == 'getfields' ||
$action == 'getfield' ||
$action == 'getspec' ||
$action == 'getoptions') {
1601 elseif ($snippet == 'get') {
1608 * Validate user permission across.
1609 * edit or view or with supportable acls.
1613 public static function giveMeAllACLs() {
1614 if (CRM_Core_Permission
::check('view all contacts') ||
1615 CRM_Core_Permission
::check('edit all contacts')
1620 $session = CRM_Core_Session
::singleton();
1621 $contactID = $session->get('userID');
1624 $aclPermission = self
::getPermission();
1625 if (in_array($aclPermission, [
1626 CRM_Core_Permission
::EDIT
,
1627 CRM_Core_Permission
::VIEW
,
1633 // run acl where hook and see if the user is supplying an ACL clause
1634 // that is not false
1635 $tables = $whereTables = [];
1638 CRM_Utils_Hook
::aclWhereClause(CRM_Core_Permission
::VIEW
,
1639 $tables, $whereTables,
1642 return empty($whereTables) ?
FALSE : TRUE;
1646 * Get component name from given permission.
1648 * @param string $permission
1650 * @return null|string
1651 * the name of component.
1653 public static function getComponentName($permission) {
1654 $componentName = NULL;
1655 $permission = trim($permission);
1656 if (empty($permission)) {
1657 return $componentName;
1660 static $allCompPermissions = [];
1661 if (empty($allCompPermissions)) {
1662 $components = CRM_Core_Component
::getComponents();
1663 foreach ($components as $name => $comp) {
1664 //get all permissions of each components unconditionally
1665 $allCompPermissions[$name] = $comp->getPermissions(TRUE);
1669 if (is_array($allCompPermissions)) {
1670 foreach ($allCompPermissions as $name => $permissions) {
1671 if (array_key_exists($permission, $permissions)) {
1672 $componentName = $name;
1678 return $componentName;
1682 * Get all the contact emails for users that have a specific permission.
1684 * @param string $permissionName
1685 * Name of the permission we are interested in.
1688 * a comma separated list of email addresses
1690 public static function permissionEmails($permissionName) {
1691 $config = CRM_Core_Config
::singleton();
1692 return $config->userPermissionClass
->permissionEmails($permissionName);
1696 * Get all the contact emails for users that have a specific role.
1698 * @param string $roleName
1699 * Name of the role we are interested in.
1702 * a comma separated list of email addresses
1704 public static function roleEmails($roleName) {
1705 $config = CRM_Core_Config
::singleton();
1706 return $config->userRoleClass
->roleEmails($roleName);
1712 public static function isMultisiteEnabled() {
1713 return (bool) Civi
::settings()->get('is_enabled');
1717 * Verify if the user has permission to get the invoice.
1720 * TRUE if the user has download all invoices permission or download my
1721 * invoices permission and the invoice author is the current user.
1723 public static function checkDownloadInvoice() {
1724 $cid = CRM_Core_Session
::getLoggedInContactID();
1725 if (CRM_Core_Permission
::check('access CiviContribute') ||
1726 (CRM_Core_Permission
::check('view my invoices') && $_GET['cid'] == $cid)
1734 * Get permissions for components.
1736 * @param bool $includeDisabled
1739 * @throws \CRM_Core_Exception
1741 protected static function getComponentPermissions(bool $includeDisabled): array {
1742 if (!$includeDisabled) {
1743 $components = CRM_Core_Component
::getEnabledComponents();
1746 $components = CRM_Core_Component
::getComponents();
1750 foreach ($components as $comp) {
1751 $perm = $comp->getPermissions($includeDisabled, TRUE);
1753 $info = $comp->getInfo();
1754 foreach ($perm as $p => $attr) {
1756 if (!is_array($attr)) {
1760 $attr[0] = $info['translatedName'] . ': ' . $attr[0];
1761 $permissions[$p] = $attr;
1765 return $permissions;
1769 * Get permissions for core functionality and for that of core components.
1774 * @throws \CRM_Core_Exception
1776 protected static function getCoreAndComponentPermissions(bool $all): array {
1777 $permissions = self
::getCorePermissions();
1778 $permissions = array_merge($permissions, self
::getComponentPermissions($all));
1779 $permissions['all CiviCRM permissions and ACLs']['implied_permissions'] = array_keys($permissions);
1780 return $permissions;