CRM/Core/Permission.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.7                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2016                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2016
  32  * $Id$
  33  *
  34  */
  35
  36 /**
  37  * This is the basic permission class wrapper
  38  */
  39 class CRM_Core_Permission {
  40
  41   /**
  42    * Static strings used to compose permissions.
  43    *
  44    * @const
  45    * @var string
  46    */
  47   const EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in ';
  48
  49   /**
  50    * The various type of permissions.
  51    *
  52    * @var int
  53    */
  54   const EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7;
  55
  56   /**
  57    * A placeholder permission which always fails.
  58    */
  59   const ALWAYS_DENY_PERMISSION = "*always deny*";
  60
  61   /**
  62    * A placeholder permission which always fails.
  63    */
  64   const ALWAYS_ALLOW_PERMISSION = "*always allow*";
  65
  66   /**
  67    * Various authentication sources.
  68    *
  69    * @var int
  70    */
  71   const AUTH_SRC_UNKNOWN = 0, AUTH_SRC_CHECKSUM = 1, AUTH_SRC_SITEKEY = 2, AUTH_SRC_LOGIN = 4;
  72
  73   /**
  74    * Get the current permission of this user.
  75    *
  76    * @return string
  77    *   the permission of the user (edit or view or null)
  78    */
  79   public static function getPermission() {
  80     $config = CRM_Core_Config::singleton();
  81     return $config->userPermissionClass->getPermission();
  82   }
  83
  84   /**
  85    * Given a permission string or array, check for access requirements
  86    * @param mixed $permissions
  87    *   The permission to check as an array or string -see examples.
  88    *   arrays
  89    *
  90    *  Ex 1
  91    *
  92    *  Must have 'access CiviCRM'
  93    *  (string) 'access CiviCRM'
  94    *
  95    *
  96    *  Ex 2 Must have 'access CiviCRM' and 'access Ajax API'
  97    *   array('access CiviCRM', 'access Ajax API')
  98    *
  99    *  Ex 3 Must have 'access CiviCRM' or 'access Ajax API'
 100    *   array(
 101    *      array('access CiviCRM', 'access Ajax API'),
 102    *   ),
 103    *
 104    *  Ex 4 Must have 'access CiviCRM' or 'access Ajax API' AND 'access CiviEvent'
 105    *  array(
 106    *    array('access CiviCRM', 'access Ajax API'),
 107    *    'access CiviEvent',
 108    *   ),
 109    *
 110    *  Note that in permissions.php this is keyed by the action eg.
 111    *  (access Civi || access AJAX) && (access CiviEvent || access CiviContribute)
 112    *  'myaction' => array(
 113    *    array('access CiviCRM', 'access Ajax API'),
 114    *    array('access CiviEvent', 'access CiviContribute')
 115    *  ),
 116    *
 117    * @return bool
 118    *   true if yes, else false
 119    */
 120   public static function check($permissions) {
 121     $permissions = (array) $permissions;
 122
 123     $tempPerm = CRM_Core_Config::singleton()->userPermissionTemp;
 124
 125     foreach ($permissions as $permission) {
 126       if (is_array($permission)) {
 127         foreach ($permission as $orPerm) {
 128           if (self::check($orPerm)) {
 129             //one of our 'or' permissions has succeeded - stop checking this permission
 130             return TRUE;;
 131           }
 132         }
 133         //none of our our conditions was met
 134         return FALSE;
 135       }
 136       else {
 137         if (
 138           !CRM_Core_Config::singleton()->userPermissionClass->check($permission)
 139           && !($tempPerm && $tempPerm->check($permission))
 140         ) {
 141           //one of our 'and' conditions has not been met
 142           return FALSE;
 143         }
 144       }
 145     }
 146     return TRUE;
 147   }
 148
 149   /**
 150    * Determine if any one of the permissions strings applies to current user.
 151    *
 152    * @param array $perms
 153    * @return bool
 154    */
 155   public static function checkAnyPerm($perms) {
 156     foreach ($perms as $perm) {
 157       if (CRM_Core_Permission::check($perm)) {
 158         return TRUE;
 159       }
 160     }
 161     return FALSE;
 162   }
 163
 164   /**
 165    * Given a group/role array, check for access requirements
 166    *
 167    * @param array $array
 168    *   The group/role to check.
 169    *
 170    * @return bool
 171    *   true if yes, else false
 172    */
 173   public static function checkGroupRole($array) {
 174     $config = CRM_Core_Config::singleton();
 175     return $config->userPermissionClass->checkGroupRole($array);
 176   }
 177
 178   /**
 179    * Get the permissioned where clause for the user.
 180    *
 181    * @param int $type
 182    *   The type of permission needed.
 183    * @param array $tables
 184    *   (reference ) add the tables that are needed for the select clause.
 185    * @param array $whereTables
 186    *   (reference ) add the tables that are needed for the where clause.
 187    *
 188    * @return string
 189    *   the group where clause for this user
 190    */
 191   public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) {
 192     $config = CRM_Core_Config::singleton();
 193     return $config->userPermissionClass->getPermissionedStaticGroupClause($type, $tables, $whereTables);
 194   }
 195
 196   /**
 197    * Get all groups from database, filtered by permissions
 198    * for this user
 199    *
 200    * @param string $groupType
 201    *   Type of group(Access/Mailing).
 202    * @param bool $excludeHidden
 203    *   exclude hidden groups.
 204    *
 205    *
 206    * @return array
 207    *   array reference of all groups.
 208    */
 209   public static function group($groupType, $excludeHidden = TRUE) {
 210     $config = CRM_Core_Config::singleton();
 211     return $config->userPermissionClass->group($groupType, $excludeHidden);
 212   }
 213
 214   /**
 215    * @return bool
 216    */
 217   public static function customGroupAdmin() {
 218     $admin = FALSE;
 219
 220     // check if user has all powerful permission
 221     // or administer civicrm permission (CRM-1905)
 222     if (self::check('access all custom data')) {
 223       return TRUE;
 224     }
 225
 226     if (
 227       self::check('administer Multiple Organizations') &&
 228       self::isMultisiteEnabled()
 229     ) {
 230       return TRUE;
 231     }
 232
 233     if (self::check('administer CiviCRM')) {
 234       return TRUE;
 235     }
 236
 237     return FALSE;
 238   }
 239
 240   /**
 241    * @param int $type
 242    * @param bool $reset
 243    *
 244    * @return array
 245    */
 246   public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) {
 247     $customGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_CustomField', 'custom_group_id',
 248       array('fresh' => $reset));
 249     $defaultGroups = array();
 250
 251     // check if user has all powerful permission
 252     // or administer civicrm permission (CRM-1905)
 253     if (self::customGroupAdmin()) {
 254       $defaultGroups = array_keys($customGroups);
 255     }
 256
 257     return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups);
 258   }
 259
 260   /**
 261    * @param int $type
 262    * @param null $prefix
 263    * @param bool $reset
 264    *
 265    * @return string
 266    */
 267   public static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) {
 268     if (self::customGroupAdmin()) {
 269       return ' ( 1 ) ';
 270     }
 271
 272     $groups = self::customGroup($type, $reset);
 273     if (empty($groups)) {
 274       return ' ( 0 ) ';
 275     }
 276     else {
 277       return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
 278     }
 279   }
 280
 281   /**
 282    * @param int $gid
 283    * @param int $type
 284    *
 285    * @return bool
 286    */
 287   public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) {
 288     if (empty($gid)) {
 289       return TRUE;
 290     }
 291
 292     $groups = self::ufGroup($type);
 293     return !empty($groups) && in_array($gid, $groups) ? TRUE : FALSE;
 294   }
 295
 296   /**
 297    * @param int $type
 298    *
 299    * @return array
 300    */
 301   public static function ufGroup($type = CRM_Core_Permission::VIEW) {
 302     $ufGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_UFField', 'uf_group_id');
 303
 304     $allGroups = array_keys($ufGroups);
 305
 306     // check if user has all powerful permission
 307     if (self::check('profile listings and forms')) {
 308       return $allGroups;
 309     }
 310
 311     switch ($type) {
 312       case CRM_Core_Permission::VIEW:
 313         if (self::check('profile view')) {
 314           return $allGroups;
 315         }
 316         break;
 317
 318       case CRM_Core_Permission::CREATE:
 319         if (self::check('profile create')) {
 320           return $allGroups;
 321         }
 322         break;
 323
 324       case CRM_Core_Permission::EDIT:
 325         if (self::check('profile edit')) {
 326           return $allGroups;
 327         }
 328         break;
 329
 330       case CRM_Core_Permission::SEARCH:
 331         if (self::check('profile listings')) {
 332           return $allGroups;
 333         }
 334         break;
 335     }
 336
 337     return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups);
 338   }
 339
 340   /**
 341    * @param int $type
 342    * @param null $prefix
 343    * @param bool $returnUFGroupIds
 344    *
 345    * @return array|string
 346    */
 347   public static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) {
 348     $groups = self::ufGroup($type);
 349     if ($returnUFGroupIds) {
 350       return $groups;
 351     }
 352     elseif (empty($groups)) {
 353       return ' ( 0 ) ';
 354     }
 355     else {
 356       return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
 357     }
 358   }
 359
 360   /**
 361    * @param int $type
 362    * @param int $eventID
 363    * @param string $context
 364    *
 365    * @return array|null
 366    */
 367   public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL, $context = '') {
 368     if (!empty($context)) {
 369       if (CRM_Core_Permission::check($context)) {
 370         return TRUE;
 371       }
 372     }
 373     $events = CRM_Event_PseudoConstant::event(NULL, TRUE);
 374     $includeEvents = array();
 375
 376     // check if user has all powerful permission
 377     if (self::check('register for events')) {
 378       $includeEvents = array_keys($events);
 379     }
 380
 381     if ($type == CRM_Core_Permission::VIEW &&
 382       self::check('view event info')
 383     ) {
 384       $includeEvents = array_keys($events);
 385     }
 386
 387     $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents);
 388     if (!$eventID) {
 389       return $permissionedEvents;
 390     }
 391     if (!empty($permissionedEvents)) {
 392       return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID;
 393     }
 394     return NULL;
 395   }
 396
 397   /**
 398    * @param int $type
 399    * @param null $prefix
 400    *
 401    * @return string
 402    */
 403   public static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) {
 404     $events = self::event($type);
 405     if (empty($events)) {
 406       return ' ( 0 ) ';
 407     }
 408     else {
 409       return "{$prefix}id IN ( " . implode(',', $events) . ' ) ';
 410     }
 411   }
 412
 413   /**
 414    * Checks that component is enabled and optionally that user has basic perm.
 415    *
 416    * @param string $module
 417    *   Specifies the name of the CiviCRM component.
 418    * @param bool $checkPermission
 419    *   Check not only that module is enabled, but that user has necessary
 420    *   permission.
 421    * @param bool $requireAllCasesPermOnCiviCase
 422    *   Significant only if $module == CiviCase
 423    *   Require "access all cases and activities", not just
 424    *   "access my cases and activities".
 425    *
 426    * @return bool
 427    *   Access to specified $module is granted.
 428    */
 429   public static function access($module, $checkPermission = TRUE, $requireAllCasesPermOnCiviCase = FALSE) {
 430     $config = CRM_Core_Config::singleton();
 431
 432     if (!in_array($module, $config->enableComponents)) {
 433       return FALSE;
 434     }
 435
 436     if ($checkPermission) {
 437       switch ($module) {
 438         case 'CiviCase':
 439           $access_all_cases = CRM_Core_Permission::check("access all cases and activities");
 440           $access_my_cases  = CRM_Core_Permission::check("access my cases and activities");
 441           return $access_all_cases || (!$requireAllCasesPermOnCiviCase && $access_my_cases);
 442
 443         case 'CiviCampaign':
 444           return CRM_Core_Permission::check("administer $module");
 445
 446         default:
 447           return CRM_Core_Permission::check("access $module");
 448       }
 449     }
 450
 451     return TRUE;
 452   }
 453
 454   /**
 455    * Check permissions for delete and edit actions.
 456    *
 457    * @param string $module
 458    *   Component name.
 459    * @param int $action
 460    *   Action to be check across component.
 461    *
 462    *
 463    * @return bool
 464    */
 465   public static function checkActionPermission($module, $action) {
 466     //check delete related permissions.
 467     if ($action & CRM_Core_Action::DELETE) {
 468       $permissionName = "delete in $module";
 469     }
 470     else {
 471       $editPermissions = array(
 472         'CiviEvent' => 'edit event participants',
 473         'CiviMember' => 'edit memberships',
 474         'CiviPledge' => 'edit pledges',
 475         'CiviContribute' => 'edit contributions',
 476         'CiviGrant' => 'edit grants',
 477         'CiviMail' => 'access CiviMail',
 478         'CiviAuction' => 'add auction items',
 479       );
 480       $permissionName = CRM_Utils_Array::value($module, $editPermissions);
 481     }
 482
 483     if ($module == 'CiviCase' && !$permissionName) {
 484       return CRM_Case_BAO_Case::accessCiviCase();
 485     }
 486     else {
 487       //check for permission.
 488       return CRM_Core_Permission::check($permissionName);
 489     }
 490   }
 491
 492   /**
 493    * @param $args
 494    * @param string $op
 495    *
 496    * @return bool
 497    */
 498   public static function checkMenu(&$args, $op = 'and') {
 499     if (!is_array($args)) {
 500       return $args;
 501     }
 502     foreach ($args as $str) {
 503       $res = CRM_Core_Permission::check($str);
 504       if ($op == 'or' && $res) {
 505         return TRUE;
 506       }
 507       elseif ($op == 'and' && !$res) {
 508         return FALSE;
 509       }
 510     }
 511     return ($op == 'or') ? FALSE : TRUE;
 512   }
 513
 514   /**
 515    * @param $item
 516    *
 517    * @return bool|mixed
 518    * @throws Exception
 519    */
 520   public static function checkMenuItem(&$item) {
 521     if (!array_key_exists('access_callback', $item)) {
 522       CRM_Core_Error::backtrace();
 523       CRM_Core_Error::fatal();
 524     }
 525
 526     // if component_id is present, ensure it is enabled
 527     if (isset($item['component_id']) && $item['component_id']) {
 528       if (!isset(Civi::$statics[__CLASS__]['componentNameId'])) {
 529         Civi::$statics[__CLASS__]['componentNameId'] = array_flip(CRM_Core_Component::getComponentIDs());
 530       }
 531       $componentName = Civi::$statics[__CLASS__]['componentNameId'][$item['component_id']];
 532
 533       $config = CRM_Core_Config::singleton();
 534       if (is_array($config->enableComponents) && in_array($componentName, $config->enableComponents)) {
 535         // continue with process
 536       }
 537       else {
 538         return FALSE;
 539       }
 540     }
 541
 542     // the following is imitating drupal 6 code in includes/menu.inc
 543     if (empty($item['access_callback']) ||
 544       is_numeric($item['access_callback'])
 545     ) {
 546       return (boolean ) $item['access_callback'];
 547     }
 548
 549     // check whether the following Ajax requests submitted the right key
 550     // FIXME: this should be integrated into ACLs proper
 551     if (CRM_Utils_Array::value('page_type', $item) == 3) {
 552       if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) {
 553         return FALSE;
 554       }
 555     }
 556
 557     // check if callback is for checkMenu, if so optimize it
 558     if (is_array($item['access_callback']) &&
 559       $item['access_callback'][0] == 'CRM_Core_Permission' &&
 560       $item['access_callback'][1] == 'checkMenu'
 561     ) {
 562       $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and');
 563       return self::checkMenu($item['access_arguments'][0], $op);
 564     }
 565     else {
 566       return call_user_func_array($item['access_callback'], $item['access_arguments']);
 567     }
 568   }
 569
 570   /**
 571    * @param bool $all
 572    *   Include disabled components
 573    * @param bool $descriptions
 574    *   Whether to return descriptions
 575    *
 576    * @return array
 577    */
 578   public static function basicPermissions($all = FALSE, $descriptions = FALSE) {
 579     $cacheKey = implode('-', array($all, $descriptions));
 580     if (empty(Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey])) {
 581       Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey] = self::assembleBasicPermissions($all, $descriptions);
 582     }
 583     return Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey];
 584   }
 585
 586   /**
 587    * @param bool $all
 588    * @param bool $descriptions
 589    *   whether to return descriptions
 590    *
 591    * @return array
 592    */
 593   public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE) {
 594     $config = CRM_Core_Config::singleton();
 595     $prefix = ts('CiviCRM') . ': ';
 596     $permissions = self::getCorePermissions($descriptions);
 597
 598     if (self::isMultisiteEnabled()) {
 599       $permissions['administer Multiple Organizations'] = array($prefix . ts('administer Multiple Organizations'));
 600     }
 601
 602     if (!$descriptions) {
 603       foreach ($permissions as $name => $attr) {
 604         $permissions[$name] = array_shift($attr);
 605       }
 606     }
 607     if (!$all) {
 608       $components = CRM_Core_Component::getEnabledComponents();
 609     }
 610     else {
 611       $components = CRM_Core_Component::getComponents();
 612     }
 613
 614     foreach ($components as $comp) {
 615       $perm = $comp->getPermissions(FALSE, $descriptions);
 616       if ($perm) {
 617         $info = $comp->getInfo();
 618         foreach ($perm as $p => $attr) {
 619
 620           if (!is_array($attr)) {
 621             $attr = array($attr);
 622           }
 623
 624           $attr[0] = $info['translatedName'] . ': ' . $attr[0];
 625
 626           if ($descriptions) {
 627             $permissions[$p] = $attr;
 628           }
 629           else {
 630             $permissions[$p] = $attr[0];
 631           }
 632         }
 633       }
 634     }
 635
 636     // Add any permissions defined in hook_civicrm_permission implementations.
 637     $module_permissions = $config->userPermissionClass->getAllModulePermissions($descriptions);
 638     $permissions = array_merge($permissions, $module_permissions);
 639     CRM_Financial_BAO_FinancialType::permissionedFinancialTypes($permissions, $descriptions);
 640     return $permissions;
 641   }
 642
 643   /**
 644    * @return array
 645    */
 646   public static function getAnonymousPermissionsWarnings() {
 647     static $permissions = array();
 648     if (empty($permissions)) {
 649       $permissions = array(
 650         'administer CiviCRM',
 651       );
 652       $components = CRM_Core_Component::getComponents();
 653       foreach ($components as $comp) {
 654         if (!method_exists($comp, 'getAnonymousPermissionWarnings')) {
 655           continue;
 656         }
 657         $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings());
 658       }
 659     }
 660     return $permissions;
 661   }
 662
 663   /**
 664    * @param $anonymous_perms
 665    *
 666    * @return array
 667    */
 668   public static function validateForPermissionWarnings($anonymous_perms) {
 669     return array_intersect($anonymous_perms, self::getAnonymousPermissionsWarnings());
 670   }
 671
 672   /**
 673    * Get core permissions.
 674    *
 675    * @return array
 676    */
 677   public static function getCorePermissions() {
 678     $prefix = ts('CiviCRM') . ': ';
 679     $permissions = array(
 680       'add contacts' => array(
 681         $prefix . ts('add contacts'),
 682         ts('Create a new contact record in CiviCRM'),
 683       ),
 684       'view all contacts' => array(
 685         $prefix . ts('view all contacts'),
 686         ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'),
 687       ),
 688       'edit all contacts' => array(
 689         $prefix . ts('edit all contacts'),
 690         ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'),
 691       ),
 692       'view my contact' => array(
 693         $prefix . ts('view my contact'),
 694       ),
 695       'edit my contact' => array(
 696         $prefix . ts('edit my contact'),
 697       ),
 698       'delete contacts' => array(
 699         $prefix . ts('delete contacts'),
 700       ),
 701       'access deleted contacts' => array(
 702         $prefix . ts('access deleted contacts'),
 703         ts('Access contacts in the trash'),
 704       ),
 705       'import contacts' => array(
 706         $prefix . ts('import contacts'),
 707         ts('Import contacts and activities'),
 708       ),
 709       'import SQL datasource' => array(
 710         $prefix . ts('import SQL datasource'),
 711         ts('When importing, consume data directly from a SQL datasource'),
 712       ),
 713       'edit groups' => array(
 714         $prefix . ts('edit groups'),
 715         ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'),
 716       ),
 717       'administer CiviCRM' => array(
 718         $prefix . ts('administer CiviCRM'),
 719         ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'),
 720       ),
 721       'skip IDS check' => array(
 722         $prefix . ts('skip IDS check'),
 723         ts('IDS system is bypassed for users with this permission. Prevents false errors for admin users.'),
 724       ),
 725       'access uploaded files' => array(
 726         $prefix . ts('access uploaded files'),
 727         ts('View / download files including images and photos'),
 728       ),
 729       'profile listings and forms' => array(
 730         $prefix . ts('profile listings and forms'),
 731         ts('Access the profile Search form and listings'),
 732       ),
 733       'profile listings' => array(
 734         $prefix . ts('profile listings'),
 735       ),
 736       'profile create' => array(
 737         $prefix . ts('profile create'),
 738         ts('Use profiles in Create mode'),
 739       ),
 740       'profile edit' => array(
 741         $prefix . ts('profile edit'),
 742         ts('Use profiles in Edit mode'),
 743       ),
 744       'profile view' => array(
 745         $prefix . ts('profile view'),
 746       ),
 747       'access all custom data' => array(
 748         $prefix . ts('access all custom data'),
 749         ts('View all custom fields regardless of ACL rules'),
 750       ),
 751       'view all activities' => array(
 752         $prefix . ts('view all activities'),
 753         ts('View all activities (for visible contacts)'),
 754       ),
 755       'delete activities' => array(
 756         $prefix . ts('Delete activities'),
 757       ),
 758       'access CiviCRM' => array(
 759         $prefix . ts('access CiviCRM'),
 760         ts('Master control for access to the main CiviCRM backend and API'),
 761       ),
 762       'access Contact Dashboard' => array(
 763         $prefix . ts('access Contact Dashboard'),
 764         ts('View Contact Dashboard (for themselves and visible contacts)'),
 765       ),
 766       'translate CiviCRM' => array(
 767         $prefix . ts('translate CiviCRM'),
 768         ts('Allow User to enable multilingual'),
 769       ),
 770       'administer reserved groups' => array(
 771         $prefix . ts('administer reserved groups'),
 772         ts('Edit and disable Reserved Groups (Needs Edit Groups)'),
 773       ),
 774       'administer Tagsets' => array(
 775         $prefix . ts('administer Tagsets'),
 776       ),
 777       'administer reserved tags' => array(
 778         $prefix . ts('administer reserved tags'),
 779       ),
 780       'administer dedupe rules' => array(
 781         $prefix . ts('administer dedupe rules'),
 782         ts('Create and edit rules, change the supervised and unsupervised rules'),
 783       ),
 784       'merge duplicate contacts' => array(
 785         $prefix . ts('merge duplicate contacts'),
 786         ts('Delete Contacts must also be granted in order for this to work.'),
 787       ),
 788       'force merge duplicate contacts' => array(
 789         $prefix . ts('force merge duplicate contacts'),
 790         ts('Delete Contacts must also be granted in order for this to work.'),
 791       ),
 792       'view debug output' => array(
 793         $prefix . ts('view debug output'),
 794         ts('View results of debug and backtrace'),
 795       ),
 796
 797       'view all notes' => array(
 798         $prefix . ts('view all notes'),
 799         ts("View notes (for visible contacts) even if they're marked admin only"),
 800       ),
 801       'access AJAX API' => array(
 802         $prefix . ts('access AJAX API'),
 803         ts('Allow API access even if Access CiviCRM is not granted'),
 804       ),
 805       'access contact reference fields' => array(
 806         $prefix . ts('access contact reference fields'),
 807         ts('Allow entering data into contact reference fields'),
 808       ),
 809       'create manual batch' => array(
 810         $prefix . ts('create manual batch'),
 811         ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'),
 812       ),
 813       'edit own manual batches' => array(
 814         $prefix . ts('edit own manual batches'),
 815         ts('Edit accounting batches created by user'),
 816       ),
 817       'edit all manual batches' => array(
 818         $prefix . ts('edit all manual batches'),
 819         ts('Edit all accounting batches'),
 820       ),
 821       'view own manual batches' => array(
 822         $prefix . ts('view own manual batches'),
 823         ts('View accounting batches created by user (with Access to CiviContribute)'),
 824       ),
 825       'view all manual batches' => array(
 826         $prefix . ts('view all manual batches'),
 827         ts('View all accounting batches (with Access to CiviContribute)'),
 828       ),
 829       'delete own manual batches' => array(
 830         $prefix . ts('delete own manual batches'),
 831         ts('Delete accounting batches created by user'),
 832       ),
 833       'delete all manual batches' => array(
 834         $prefix . ts('delete all manual batches'),
 835         ts('Delete all accounting batches'),
 836       ),
 837       'export own manual batches' => array(
 838         $prefix . ts('export own manual batches'),
 839         ts('Export accounting batches created by user'),
 840       ),
 841       'export all manual batches' => array(
 842         $prefix . ts('export all manual batches'),
 843         ts('Export all accounting batches'),
 844       ),
 845       'administer payment processors' => array(
 846         $prefix . ts('administer payment processors'),
 847         ts('Add, Update, or Disable Payment Processors'),
 848       ),
 849       'edit message templates' => array(
 850         $prefix . ts('edit message templates'),
 851       ),
 852       'view my invoices' => array(
 853         $prefix . ts('view my invoices'),
 854         ts('Allow users to view/ download their own invoices'),
 855       ),
 856       'edit api keys' => array(
 857         $prefix . ts('edit api keys'),
 858         ts('Edit API keys'),
 859       ),
 860       'edit own api keys' => array(
 861         $prefix . ts('edit own api keys'),
 862         ts('Edit user\'s own API keys'),
 863       ),
 864     );
 865
 866     return $permissions;
 867   }
 868
 869   /**
 870    * Validate user permission across.
 871    * edit or view or with supportable acls.
 872    *
 873    * @return bool
 874    */
 875   public static function giveMeAllACLs() {
 876     if (CRM_Core_Permission::check('view all contacts') ||
 877       CRM_Core_Permission::check('edit all contacts')
 878     ) {
 879       return TRUE;
 880     }
 881
 882     $session = CRM_Core_Session::singleton();
 883     $contactID = $session->get('userID');
 884
 885     //check for acl.
 886     $aclPermission = self::getPermission();
 887     if (in_array($aclPermission, array(
 888       CRM_Core_Permission::EDIT,
 889       CRM_Core_Permission::VIEW,
 890     ))
 891     ) {
 892       return TRUE;
 893     }
 894
 895     // run acl where hook and see if the user is supplying an ACL clause
 896     // that is not false
 897     $tables = $whereTables = array();
 898     $where = NULL;
 899
 900     CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW,
 901       $tables, $whereTables,
 902       $contactID, $where
 903     );
 904     return empty($whereTables) ? FALSE : TRUE;
 905   }
 906
 907   /**
 908    * Get component name from given permission.
 909    *
 910    * @param string $permission
 911    *
 912    * @return null|string
 913    *   the name of component.
 914    */
 915   public static function getComponentName($permission) {
 916     $componentName = NULL;
 917     $permission = trim($permission);
 918     if (empty($permission)) {
 919       return $componentName;
 920     }
 921
 922     static $allCompPermissions = array();
 923     if (empty($allCompPermissions)) {
 924       $components = CRM_Core_Component::getComponents();
 925       foreach ($components as $name => $comp) {
 926         //get all permissions of each components unconditionally
 927         $allCompPermissions[$name] = $comp->getPermissions(TRUE);
 928       }
 929     }
 930
 931     if (is_array($allCompPermissions)) {
 932       foreach ($allCompPermissions as $name => $permissions) {
 933         if (array_key_exists($permission, $permissions)) {
 934           $componentName = $name;
 935           break;
 936         }
 937       }
 938     }
 939
 940     return $componentName;
 941   }
 942
 943   /**
 944    * Get all the contact emails for users that have a specific permission.
 945    *
 946    * @param string $permissionName
 947    *   Name of the permission we are interested in.
 948    *
 949    * @return string
 950    *   a comma separated list of email addresses
 951    */
 952   public static function permissionEmails($permissionName) {
 953     $config = CRM_Core_Config::singleton();
 954     return $config->userPermissionClass->permissionEmails($permissionName);
 955   }
 956
 957   /**
 958    * Get all the contact emails for users that have a specific role.
 959    *
 960    * @param string $roleName
 961    *   Name of the role we are interested in.
 962    *
 963    * @return string
 964    *   a comma separated list of email addresses
 965    */
 966   public static function roleEmails($roleName) {
 967     $config = CRM_Core_Config::singleton();
 968     return $config->userRoleClass->roleEmails($roleName);
 969   }
 970
 971   /**
 972    * @return bool
 973    */
 974   public static function isMultisiteEnabled() {
 975     return Civi::settings()->get('is_enabled') ? TRUE : FALSE;
 976   }
 977
 978   /**
 979    * Verify if the user has permission to get the invoice.
 980    *
 981    * @return bool
 982    *   TRUE if the user has download all invoices permission or download my
 983    *   invoices permission and the invoice author is the current user.
 984    */
 985   public static function checkDownloadInvoice() {
 986     global $user;
 987     $cid = CRM_Core_BAO_UFMatch::getContactId($user->uid);
 988     if (CRM_Core_Permission::check('access CiviContribute') ||
 989       (CRM_Core_Permission::check('view my invoices') && $_GET['cid'] == $cid)
 990     ) {
 991       return TRUE;
 992     }
 993     return FALSE;
 994   }
 995
 996 }