CRM/Core/Permission.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 5                                                  |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2019                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2019
  32  */
  33
  34 /**
  35  * This is the basic permission class wrapper
  36  */
  37 class CRM_Core_Permission {
  38
  39   /**
  40    * Static strings used to compose permissions.
  41    *
  42    * @const
  43    * @var string
  44    */
  45   const EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in ';
  46
  47   /**
  48    * The various type of permissions.
  49    *
  50    * @var int
  51    */
  52   const EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7;
  53
  54   /**
  55    * A placeholder permission which always fails.
  56    */
  57   const ALWAYS_DENY_PERMISSION = "*always deny*";
  58
  59   /**
  60    * A placeholder permission which always fails.
  61    */
  62   const ALWAYS_ALLOW_PERMISSION = "*always allow*";
  63
  64   /**
  65    * Various authentication sources.
  66    *
  67    * @var int
  68    */
  69   const AUTH_SRC_UNKNOWN = 0, AUTH_SRC_CHECKSUM = 1, AUTH_SRC_SITEKEY = 2, AUTH_SRC_LOGIN = 4;
  70
  71   /**
  72    * Get the current permission of this user.
  73    *
  74    * @return string
  75    *   the permission of the user (edit or view or null)
  76    */
  77   public static function getPermission() {
  78     $config = CRM_Core_Config::singleton();
  79     return $config->userPermissionClass->getPermission();
  80   }
  81
  82   /**
  83    * Given a permission string or array, check for access requirements
  84    *
  85    * Ex 1: Must have 'access CiviCRM'
  86    * (string) 'access CiviCRM'
  87    *
  88    *  Ex 2: Must have 'access CiviCRM' and 'access Ajax API'
  89    *    ['access CiviCRM', 'access Ajax API']
  90    *
  91    * Ex 3: Must have 'access CiviCRM' or 'access Ajax API'
  92    *   [
  93    *     ['access CiviCRM', 'access Ajax API'],
  94    *   ],
  95    *
  96    * Ex 4: Must have 'access CiviCRM' or 'access Ajax API' AND 'access CiviEvent'
  97    *   [
  98    *     ['access CiviCRM', 'access Ajax API'],
  99    *     'access CiviEvent',
 100    *   ],
 101    *
 102    * Note that in permissions.php this is keyed by the action eg.
 103    *   (access Civi || access AJAX) && (access CiviEvent || access CiviContribute)
 104    *   'myaction' => [
 105    *     ['access CiviCRM', 'access Ajax API'],
 106    *     ['access CiviEvent', 'access CiviContribute']
 107    *   ],
 108    *
 109    * @param string|array $permissions
 110    *   The permission to check as an array or string -see examples.
 111    *
 112    * @param int $contactId
 113    *   Contact id to check permissions for. Defaults to current logged-in user.
 114    *
 115    * @return bool
 116    *   true if contact has permission(s), else false
 117    */
 118   public static function check($permissions, $contactId = NULL) {
 119     $permissions = (array) $permissions;
 120     $userId = CRM_Core_BAO_UFMatch::getUFId($contactId);
 121
 122     /** @var CRM_Core_Permission_Temp $tempPerm */
 123     $tempPerm = CRM_Core_Config::singleton()->userPermissionTemp;
 124
 125     foreach ($permissions as $permission) {
 126       if (is_array($permission)) {
 127         foreach ($permission as $orPerm) {
 128           if (self::check($orPerm, $contactId)) {
 129             //one of our 'or' permissions has succeeded - stop checking this permission
 130             return TRUE;
 131           }
 132         }
 133         //none of our our conditions was met
 134         return FALSE;
 135       }
 136       else {
 137         // This is an individual permission
 138         $granted = CRM_Core_Config::singleton()->userPermissionClass->check($permission, $userId);
 139         // Call the permission_check hook to permit dynamic escalation (CRM-19256)
 140         CRM_Utils_Hook::permission_check($permission, $granted, $contactId);
 141         if (
 142           !$granted
 143           && !($tempPerm && $tempPerm->check($permission))
 144         ) {
 145           //one of our 'and' conditions has not been met
 146           return FALSE;
 147         }
 148       }
 149     }
 150     return TRUE;
 151   }
 152
 153   /**
 154    * Determine if any one of the permissions strings applies to current user.
 155    *
 156    * @param array $perms
 157    * @return bool
 158    */
 159   public static function checkAnyPerm($perms) {
 160     foreach ($perms as $perm) {
 161       if (CRM_Core_Permission::check($perm)) {
 162         return TRUE;
 163       }
 164     }
 165     return FALSE;
 166   }
 167
 168   /**
 169    * Given a group/role array, check for access requirements
 170    *
 171    * @param array $array
 172    *   The group/role to check.
 173    *
 174    * @return bool
 175    *   true if yes, else false
 176    */
 177   public static function checkGroupRole($array) {
 178     $config = CRM_Core_Config::singleton();
 179     return $config->userPermissionClass->checkGroupRole($array);
 180   }
 181
 182   /**
 183    * Get the permissioned where clause for the user.
 184    *
 185    * @param int $type
 186    *   The type of permission needed.
 187    * @param array $tables
 188    *   (reference ) add the tables that are needed for the select clause.
 189    * @param array $whereTables
 190    *   (reference ) add the tables that are needed for the where clause.
 191    *
 192    * @return string
 193    *   the group where clause for this user
 194    */
 195   public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) {
 196     $config = CRM_Core_Config::singleton();
 197     return $config->userPermissionClass->getPermissionedStaticGroupClause($type, $tables, $whereTables);
 198   }
 199
 200   /**
 201    * Get all groups from database, filtered by permissions
 202    * for this user
 203    *
 204    * @param string $groupType
 205    *   Type of group(Access/Mailing).
 206    * @param bool $excludeHidden
 207    *   exclude hidden groups.
 208    *
 209    *
 210    * @return array
 211    *   array reference of all groups.
 212    */
 213   public static function group($groupType, $excludeHidden = TRUE) {
 214     $config = CRM_Core_Config::singleton();
 215     return $config->userPermissionClass->group($groupType, $excludeHidden);
 216   }
 217
 218   /**
 219    * @return bool
 220    */
 221   public static function customGroupAdmin() {
 222     $admin = FALSE;
 223
 224     // check if user has all powerful permission
 225     // or administer civicrm permission (CRM-1905)
 226     if (self::check('access all custom data')) {
 227       return TRUE;
 228     }
 229
 230     if (
 231       self::check('administer Multiple Organizations') &&
 232       self::isMultisiteEnabled()
 233     ) {
 234       return TRUE;
 235     }
 236
 237     if (self::check('administer CiviCRM')) {
 238       return TRUE;
 239     }
 240
 241     return FALSE;
 242   }
 243
 244   /**
 245    * @param int $type
 246    * @param bool $reset
 247    *
 248    * @return array
 249    */
 250   public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) {
 251     $customGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_CustomField', 'custom_group_id',
 252       ['fresh' => $reset]);
 253     $defaultGroups = [];
 254
 255     // check if user has all powerful permission
 256     // or administer civicrm permission (CRM-1905)
 257     if (self::customGroupAdmin()) {
 258       $defaultGroups = array_keys($customGroups);
 259     }
 260
 261     return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups);
 262   }
 263
 264   /**
 265    * @param int $type
 266    * @param null $prefix
 267    * @param bool $reset
 268    *
 269    * @return string
 270    */
 271   public static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) {
 272     if (self::customGroupAdmin()) {
 273       return ' ( 1 ) ';
 274     }
 275
 276     $groups = self::customGroup($type, $reset);
 277     if (empty($groups)) {
 278       return ' ( 0 ) ';
 279     }
 280     else {
 281       return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
 282     }
 283   }
 284
 285   /**
 286    * @param int $gid
 287    * @param int $type
 288    *
 289    * @return bool
 290    */
 291   public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) {
 292     if (empty($gid)) {
 293       return TRUE;
 294     }
 295
 296     $groups = self::ufGroup($type);
 297     return !empty($groups) && in_array($gid, $groups) ? TRUE : FALSE;
 298   }
 299
 300   /**
 301    * @param int $type
 302    *
 303    * @return array
 304    */
 305   public static function ufGroup($type = CRM_Core_Permission::VIEW) {
 306     $ufGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_UFField', 'uf_group_id');
 307
 308     $allGroups = array_keys($ufGroups);
 309
 310     // check if user has all powerful permission
 311     if (self::check('profile listings and forms')) {
 312       return $allGroups;
 313     }
 314
 315     switch ($type) {
 316       case CRM_Core_Permission::VIEW:
 317         if (self::check('profile view')) {
 318           return $allGroups;
 319         }
 320         break;
 321
 322       case CRM_Core_Permission::CREATE:
 323         if (self::check('profile create')) {
 324           return $allGroups;
 325         }
 326         break;
 327
 328       case CRM_Core_Permission::EDIT:
 329         if (self::check('profile edit')) {
 330           return $allGroups;
 331         }
 332         break;
 333
 334       case CRM_Core_Permission::SEARCH:
 335         if (self::check('profile listings')) {
 336           return $allGroups;
 337         }
 338         break;
 339     }
 340
 341     return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups);
 342   }
 343
 344   /**
 345    * @param int $type
 346    * @param null $prefix
 347    * @param bool $returnUFGroupIds
 348    *
 349    * @return array|string
 350    */
 351   public static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) {
 352     $groups = self::ufGroup($type);
 353     if ($returnUFGroupIds) {
 354       return $groups;
 355     }
 356     elseif (empty($groups)) {
 357       return ' ( 0 ) ';
 358     }
 359     else {
 360       return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
 361     }
 362   }
 363
 364   /**
 365    * @param int $type
 366    * @param int $eventID
 367    * @param string $context
 368    *
 369    * @return array|null
 370    */
 371   public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL, $context = '') {
 372     if (!empty($context)) {
 373       if (CRM_Core_Permission::check($context)) {
 374         return TRUE;
 375       }
 376     }
 377     $events = CRM_Event_PseudoConstant::event(NULL, TRUE);
 378     $includeEvents = [];
 379
 380     // check if user has all powerful permission
 381     if (self::check('register for events')) {
 382       $includeEvents = array_keys($events);
 383     }
 384
 385     if ($type == CRM_Core_Permission::VIEW &&
 386       self::check('view event info')
 387     ) {
 388       $includeEvents = array_keys($events);
 389     }
 390
 391     $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents);
 392     if (!$eventID) {
 393       return $permissionedEvents;
 394     }
 395     if (!empty($permissionedEvents)) {
 396       return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID;
 397     }
 398     return NULL;
 399   }
 400
 401   /**
 402    * @param int $type
 403    * @param null $prefix
 404    *
 405    * @return string
 406    */
 407   public static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) {
 408     $events = self::event($type);
 409     if (empty($events)) {
 410       return ' ( 0 ) ';
 411     }
 412     else {
 413       return "{$prefix}id IN ( " . implode(',', $events) . ' ) ';
 414     }
 415   }
 416
 417   /**
 418    * Checks that component is enabled and optionally that user has basic perm.
 419    *
 420    * @param string $module
 421    *   Specifies the name of the CiviCRM component.
 422    * @param bool $checkPermission
 423    *   Check not only that module is enabled, but that user has necessary
 424    *   permission.
 425    * @param bool $requireAllCasesPermOnCiviCase
 426    *   Significant only if $module == CiviCase
 427    *   Require "access all cases and activities", not just
 428    *   "access my cases and activities".
 429    *
 430    * @return bool
 431    *   Access to specified $module is granted.
 432    */
 433   public static function access($module, $checkPermission = TRUE, $requireAllCasesPermOnCiviCase = FALSE) {
 434     $config = CRM_Core_Config::singleton();
 435
 436     if (!in_array($module, $config->enableComponents)) {
 437       return FALSE;
 438     }
 439
 440     if ($checkPermission) {
 441       switch ($module) {
 442         case 'CiviCase':
 443           $access_all_cases = CRM_Core_Permission::check("access all cases and activities");
 444           $access_my_cases  = CRM_Core_Permission::check("access my cases and activities");
 445           return $access_all_cases || (!$requireAllCasesPermOnCiviCase && $access_my_cases);
 446
 447         case 'CiviCampaign':
 448           return CRM_Core_Permission::check("administer $module");
 449
 450         default:
 451           return CRM_Core_Permission::check("access $module");
 452       }
 453     }
 454
 455     return TRUE;
 456   }
 457
 458   /**
 459    * Check permissions for delete and edit actions.
 460    *
 461    * @param string $module
 462    *   Component name.
 463    * @param int $action
 464    *   Action to be check across component.
 465    *
 466    *
 467    * @return bool
 468    */
 469   public static function checkActionPermission($module, $action) {
 470     //check delete related permissions.
 471     if ($action & CRM_Core_Action::DELETE) {
 472       $permissionName = "delete in $module";
 473     }
 474     else {
 475       $editPermissions = [
 476         'CiviEvent' => 'edit event participants',
 477         'CiviMember' => 'edit memberships',
 478         'CiviPledge' => 'edit pledges',
 479         'CiviContribute' => 'edit contributions',
 480         'CiviGrant' => 'edit grants',
 481         'CiviMail' => 'access CiviMail',
 482         'CiviAuction' => 'add auction items',
 483       ];
 484       $permissionName = CRM_Utils_Array::value($module, $editPermissions);
 485     }
 486
 487     if ($module == 'CiviCase' && !$permissionName) {
 488       return CRM_Case_BAO_Case::accessCiviCase();
 489     }
 490     else {
 491       //check for permission.
 492       return CRM_Core_Permission::check($permissionName);
 493     }
 494   }
 495
 496   /**
 497    * @param $args
 498    * @param string $op
 499    *
 500    * @return bool
 501    */
 502   public static function checkMenu(&$args, $op = 'and') {
 503     if (!is_array($args)) {
 504       return $args;
 505     }
 506     foreach ($args as $str) {
 507       $res = CRM_Core_Permission::check($str);
 508       if ($op == 'or' && $res) {
 509         return TRUE;
 510       }
 511       elseif ($op == 'and' && !$res) {
 512         return FALSE;
 513       }
 514     }
 515     return ($op == 'or') ? FALSE : TRUE;
 516   }
 517
 518   /**
 519    * @param $item
 520    *
 521    * @return bool|mixed
 522    * @throws Exception
 523    */
 524   public static function checkMenuItem(&$item) {
 525     if (!array_key_exists('access_callback', $item)) {
 526       CRM_Core_Error::backtrace();
 527       CRM_Core_Error::fatal();
 528     }
 529
 530     // if component_id is present, ensure it is enabled
 531     if (isset($item['component_id']) && $item['component_id']) {
 532       if (!isset(Civi::$statics[__CLASS__]['componentNameId'])) {
 533         Civi::$statics[__CLASS__]['componentNameId'] = array_flip(CRM_Core_Component::getComponentIDs());
 534       }
 535       $componentName = Civi::$statics[__CLASS__]['componentNameId'][$item['component_id']];
 536
 537       $config = CRM_Core_Config::singleton();
 538       if (is_array($config->enableComponents) && in_array($componentName, $config->enableComponents)) {
 539         // continue with process
 540       }
 541       else {
 542         return FALSE;
 543       }
 544     }
 545
 546     // the following is imitating drupal 6 code in includes/menu.inc
 547     if (empty($item['access_callback']) ||
 548       is_numeric($item['access_callback'])
 549     ) {
 550       return (boolean ) $item['access_callback'];
 551     }
 552
 553     // check whether the following Ajax requests submitted the right key
 554     // FIXME: this should be integrated into ACLs proper
 555     if (CRM_Utils_Array::value('page_type', $item) == 3) {
 556       if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) {
 557         return FALSE;
 558       }
 559     }
 560
 561     // check if callback is for checkMenu, if so optimize it
 562     if (is_array($item['access_callback']) &&
 563       $item['access_callback'][0] == 'CRM_Core_Permission' &&
 564       $item['access_callback'][1] == 'checkMenu'
 565     ) {
 566       $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and');
 567       return self::checkMenu($item['access_arguments'][0], $op);
 568     }
 569     else {
 570       return call_user_func_array($item['access_callback'], $item['access_arguments']);
 571     }
 572   }
 573
 574   /**
 575    * @param bool $all
 576    *   Include disabled components
 577    * @param bool $descriptions
 578    *   Whether to return descriptions
 579    *
 580    * @return array
 581    */
 582   public static function basicPermissions($all = FALSE, $descriptions = FALSE) {
 583     $cacheKey = implode('-', [$all, $descriptions]);
 584     if (empty(Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey])) {
 585       Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey] = self::assembleBasicPermissions($all, $descriptions);
 586     }
 587     return Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey];
 588   }
 589
 590   /**
 591    * @param bool $all
 592    * @param bool $descriptions
 593    *   whether to return descriptions
 594    *
 595    * @return array
 596    */
 597   public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE) {
 598     $config = CRM_Core_Config::singleton();
 599     $prefix = ts('CiviCRM') . ': ';
 600     $permissions = self::getCorePermissions($descriptions);
 601
 602     if (self::isMultisiteEnabled()) {
 603       $permissions['administer Multiple Organizations'] = [$prefix . ts('administer Multiple Organizations')];
 604     }
 605
 606     if (!$descriptions) {
 607       foreach ($permissions as $name => $attr) {
 608         $permissions[$name] = array_shift($attr);
 609       }
 610     }
 611     if (!$all) {
 612       $components = CRM_Core_Component::getEnabledComponents();
 613     }
 614     else {
 615       $components = CRM_Core_Component::getComponents();
 616     }
 617
 618     foreach ($components as $comp) {
 619       $perm = $comp->getPermissions($all, $descriptions);
 620       if ($perm) {
 621         $info = $comp->getInfo();
 622         foreach ($perm as $p => $attr) {
 623
 624           if (!is_array($attr)) {
 625             $attr = [$attr];
 626           }
 627
 628           $attr[0] = $info['translatedName'] . ': ' . $attr[0];
 629
 630           if ($descriptions) {
 631             $permissions[$p] = $attr;
 632           }
 633           else {
 634             $permissions[$p] = $attr[0];
 635           }
 636         }
 637       }
 638     }
 639
 640     // Add any permissions defined in hook_civicrm_permission implementations.
 641     $module_permissions = $config->userPermissionClass->getAllModulePermissions($descriptions);
 642     $permissions = array_merge($permissions, $module_permissions);
 643     CRM_Financial_BAO_FinancialType::permissionedFinancialTypes($permissions, $descriptions);
 644     return $permissions;
 645   }
 646
 647   /**
 648    * @return array
 649    */
 650   public static function getAnonymousPermissionsWarnings() {
 651     static $permissions = [];
 652     if (empty($permissions)) {
 653       $permissions = [
 654         'administer CiviCRM',
 655       ];
 656       $components = CRM_Core_Component::getComponents();
 657       foreach ($components as $comp) {
 658         if (!method_exists($comp, 'getAnonymousPermissionWarnings')) {
 659           continue;
 660         }
 661         $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings());
 662       }
 663     }
 664     return $permissions;
 665   }
 666
 667   /**
 668    * @param $anonymous_perms
 669    *
 670    * @return array
 671    */
 672   public static function validateForPermissionWarnings($anonymous_perms) {
 673     return array_intersect($anonymous_perms, self::getAnonymousPermissionsWarnings());
 674   }
 675
 676   /**
 677    * Get core permissions.
 678    *
 679    * @return array
 680    */
 681   public static function getCorePermissions() {
 682     $prefix = ts('CiviCRM') . ': ';
 683     $permissions = [
 684       'add contacts' => [
 685         $prefix . ts('add contacts'),
 686         ts('Create a new contact record in CiviCRM'),
 687       ],
 688       'view all contacts' => [
 689         $prefix . ts('view all contacts'),
 690         ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'),
 691       ],
 692       'edit all contacts' => [
 693         $prefix . ts('edit all contacts'),
 694         ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'),
 695       ],
 696       'view my contact' => [
 697         $prefix . ts('view my contact'),
 698       ],
 699       'edit my contact' => [
 700         $prefix . ts('edit my contact'),
 701       ],
 702       'delete contacts' => [
 703         $prefix . ts('delete contacts'),
 704       ],
 705       'access deleted contacts' => [
 706         $prefix . ts('access deleted contacts'),
 707         ts('Access contacts in the trash'),
 708       ],
 709       'import contacts' => [
 710         $prefix . ts('import contacts'),
 711         ts('Import contacts and activities'),
 712       ],
 713       'import SQL datasource' => [
 714         $prefix . ts('import SQL datasource'),
 715         ts('When importing, consume data directly from a SQL datasource'),
 716       ],
 717       'edit groups' => [
 718         $prefix . ts('edit groups'),
 719         ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'),
 720       ],
 721       'administer CiviCRM' => [
 722         $prefix . ts('administer CiviCRM'),
 723         ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'),
 724       ],
 725       'skip IDS check' => [
 726         $prefix . ts('skip IDS check'),
 727         ts('Warning: Give to trusted roles only; this permission has security implications. IDS system is bypassed for users with this permission. Prevents false errors for admin users.'),
 728       ],
 729       'access uploaded files' => [
 730         $prefix . ts('access uploaded files'),
 731         ts('View / download files including images and photos'),
 732       ],
 733       'profile listings and forms' => [
 734         $prefix . ts('profile listings and forms'),
 735         ts('Warning: Give to trusted roles only; this permission has privacy implications. Add/edit data in online forms and access public searchable directories.'),
 736       ],
 737       'profile listings' => [
 738         $prefix . ts('profile listings'),
 739         ts('Warning: Give to trusted roles only; this permission has privacy implications. Access public searchable directories.'),
 740       ],
 741       'profile create' => [
 742         $prefix . ts('profile create'),
 743         ts('Add data in a profile form.'),
 744       ],
 745       'profile edit' => [
 746         $prefix . ts('profile edit'),
 747         ts('Edit data in a profile form.'),
 748       ],
 749       'profile view' => [
 750         $prefix . ts('profile view'),
 751         ts('View data in a profile.'),
 752       ],
 753       'access all custom data' => [
 754         $prefix . ts('access all custom data'),
 755         ts('View all custom fields regardless of ACL rules'),
 756       ],
 757       'view all activities' => [
 758         $prefix . ts('view all activities'),
 759         ts('View all activities (for visible contacts)'),
 760       ],
 761       'delete activities' => [
 762         $prefix . ts('Delete activities'),
 763       ],
 764       'edit inbound email basic information' => [
 765         $prefix . ts('edit inbound email basic information'),
 766         ts('Edit all inbound email activities (for visible contacts) basic information. Content editing not allowed.'),
 767       ],
 768       'edit inbound email basic information and content' => [
 769         $prefix . ts('edit inbound email basic information and content'),
 770         ts('Edit all inbound email activities (for visible contacts) basic information and content.'),
 771       ],
 772       'access CiviCRM' => [
 773         $prefix . ts('access CiviCRM backend and API'),
 774         ts('Master control for access to the main CiviCRM backend and API. Give to trusted roles only.'),
 775       ],
 776       'access Contact Dashboard' => [
 777         $prefix . ts('access Contact Dashboard'),
 778         ts('View Contact Dashboard (for themselves and visible contacts)'),
 779       ],
 780       'translate CiviCRM' => [
 781         $prefix . ts('translate CiviCRM'),
 782         ts('Allow User to enable multilingual'),
 783       ],
 784       'manage tags' => [
 785         $prefix . ts('manage tags'),
 786         ts('Create and rename tags'),
 787       ],
 788       'administer reserved groups' => [
 789         $prefix . ts('administer reserved groups'),
 790         ts('Edit and disable Reserved Groups (Needs Edit Groups)'),
 791       ],
 792       'administer Tagsets' => [
 793         $prefix . ts('administer Tagsets'),
 794       ],
 795       'administer reserved tags' => [
 796         $prefix . ts('administer reserved tags'),
 797       ],
 798       'administer dedupe rules' => [
 799         $prefix . ts('administer dedupe rules'),
 800         ts('Create and edit rules, change the supervised and unsupervised rules'),
 801       ],
 802       'merge duplicate contacts' => [
 803         $prefix . ts('merge duplicate contacts'),
 804         ts('Delete Contacts must also be granted in order for this to work.'),
 805       ],
 806       'force merge duplicate contacts' => [
 807         $prefix . ts('force merge duplicate contacts'),
 808         ts('Delete Contacts must also be granted in order for this to work.'),
 809       ],
 810       'view debug output' => [
 811         $prefix . ts('view debug output'),
 812         ts('View results of debug and backtrace'),
 813       ],
 814
 815       'view all notes' => [
 816         $prefix . ts('view all notes'),
 817         ts("View notes (for visible contacts) even if they're marked admin only"),
 818       ],
 819       'add contact notes' => [
 820         $prefix . ts('add contact notes'),
 821         ts("Create notes for contacts"),
 822       ],
 823       'access AJAX API' => [
 824         $prefix . ts('access AJAX API'),
 825         ts('Allow API access even if Access CiviCRM is not granted'),
 826       ],
 827       'access contact reference fields' => [
 828         $prefix . ts('access contact reference fields'),
 829         ts('Allow entering data into contact reference fields'),
 830       ],
 831       'create manual batch' => [
 832         $prefix . ts('create manual batch'),
 833         ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'),
 834       ],
 835       'edit own manual batches' => [
 836         $prefix . ts('edit own manual batches'),
 837         ts('Edit accounting batches created by user'),
 838       ],
 839       'edit all manual batches' => [
 840         $prefix . ts('edit all manual batches'),
 841         ts('Edit all accounting batches'),
 842       ],
 843       'close own manual batches' => [
 844         $prefix . ts('close own manual batches'),
 845         ts('Close accounting batches created by user (with Access to CiviContribute)'),
 846       ],
 847       'close all manual batches' => [
 848         $prefix . ts('close all manual batches'),
 849         ts('Close all accounting batches (with Access to CiviContribute)'),
 850       ],
 851       'reopen own manual batches' => [
 852         $prefix . ts('reopen own manual batches'),
 853         ts('Reopen accounting batches created by user (with Access to CiviContribute)'),
 854       ],
 855       'reopen all manual batches' => [
 856         $prefix . ts('reopen all manual batches'),
 857         ts('Reopen all accounting batches (with Access to CiviContribute)'),
 858       ],
 859       'view own manual batches' => [
 860         $prefix . ts('view own manual batches'),
 861         ts('View accounting batches created by user (with Access to CiviContribute)'),
 862       ],
 863       'view all manual batches' => [
 864         $prefix . ts('view all manual batches'),
 865         ts('View all accounting batches (with Access to CiviContribute)'),
 866       ],
 867       'delete own manual batches' => [
 868         $prefix . ts('delete own manual batches'),
 869         ts('Delete accounting batches created by user'),
 870       ],
 871       'delete all manual batches' => [
 872         $prefix . ts('delete all manual batches'),
 873         ts('Delete all accounting batches'),
 874       ],
 875       'export own manual batches' => [
 876         $prefix . ts('export own manual batches'),
 877         ts('Export accounting batches created by user'),
 878       ],
 879       'export all manual batches' => [
 880         $prefix . ts('export all manual batches'),
 881         ts('Export all accounting batches'),
 882       ],
 883       'administer payment processors' => [
 884         $prefix . ts('administer payment processors'),
 885         ts('Add, Update, or Disable Payment Processors'),
 886       ],
 887       'edit message templates' => [
 888         $prefix . ts('edit message templates'),
 889       ],
 890       'edit system workflow message templates' => [
 891         $prefix . ts('edit system workflow message templates'),
 892       ],
 893       'edit user-driven message templates' => [
 894         $prefix . ts('edit user-driven message templates'),
 895       ],
 896       'view my invoices' => [
 897         $prefix . ts('view my invoices'),
 898         ts('Allow users to view/ download their own invoices'),
 899       ],
 900       'edit api keys' => [
 901         $prefix . ts('edit api keys'),
 902         ts('Edit API keys'),
 903       ],
 904       'edit own api keys' => [
 905         $prefix . ts('edit own api keys'),
 906         ts('Edit user\'s own API keys'),
 907       ],
 908       'send SMS' => [
 909         $prefix . ts('send SMS'),
 910         ts('Send an SMS'),
 911       ],
 912     ];
 913
 914     return $permissions;
 915   }
 916
 917   /**
 918    * For each entity provides an array of permissions required for each action
 919    *
 920    * The action is the array key, possible values:
 921    *  * create: applies to create (with no id in params)
 922    *  * update: applies to update, setvalue, create (with id in params)
 923    *  * get: applies to getcount, getsingle, getvalue and other gets
 924    *  * delete: applies to delete, replace
 925    *  * meta: applies to getfields, getoptions, getspec
 926    *  * default: catch-all for anything not declared
 927    *
 928    *  Note: some APIs declare other actions as well
 929    *
 930    * Permissions should use arrays for AND and arrays of arrays for OR
 931    * @see CRM_Core_Permission::check
 932    *
 933    * @return array of permissions
 934    */
 935   public static function getEntityActionPermissions() {
 936     $permissions = [];
 937     // These are the default permissions - if any entity does not declare permissions for a given action,
 938     // (or the entity does not declare permissions at all) - then the action will be used from here
 939     $permissions['default'] = [
 940       // applies to getfields, getoptions, etc.
 941       'meta' => ['access CiviCRM'],
 942       // catch-all, applies to create, get, delete, etc.
 943       // If an entity declares it's own 'default' action it will override this one
 944       'default' => ['administer CiviCRM'],
 945     ];
 946
 947     // Note: Additional permissions in DynamicFKAuthorization
 948     $permissions['attachment'] = [
 949       'default' => [
 950         ['access CiviCRM', 'access AJAX API'],
 951       ],
 952     ];
 953
 954     // Contact permissions
 955     $permissions['contact'] = [
 956       'create' => [
 957         'access CiviCRM',
 958         'add contacts',
 959       ],
 960       'delete' => [
 961         'access CiviCRM',
 962         'delete contacts',
 963       ],
 964       // managed by query object
 965       'get' => [],
 966       // managed by _civicrm_api3_check_edit_permissions
 967       'update' => [],
 968       'getquick' => [
 969         ['access CiviCRM', 'access AJAX API'],
 970       ],
 971       'duplicatecheck' => [
 972         'access CiviCRM',
 973       ],
 974       'merge' => ['merge duplicate contacts'],
 975     ];
 976
 977     $permissions['dedupe'] = [
 978       'getduplicates' => ['access CiviCRM'],
 979       'getstatistics' => ['access CiviCRM'],
 980     ];
 981
 982     // CRM-16963 - Permissions for country.
 983     $permissions['country'] = [
 984       'get' => [
 985         'access CiviCRM',
 986       ],
 987       'default' => [
 988         'administer CiviCRM',
 989       ],
 990     ];
 991
 992     // Contact-related data permissions.
 993     $permissions['address'] = [
 994       // get is managed by BAO::addSelectWhereClause
 995       // create/delete are managed by _civicrm_api3_check_edit_permissions
 996       'default' => [],
 997     ];
 998     $permissions['email'] = $permissions['address'];
 999     $permissions['phone'] = $permissions['address'];
1000     $permissions['website'] = $permissions['address'];
1001     $permissions['im'] = $permissions['address'];
1002     $permissions['open_i_d'] = $permissions['address'];
1003
1004     // Also managed by ACLs - CRM-19448
1005     $permissions['entity_tag'] = ['default' => []];
1006     $permissions['note'] = $permissions['entity_tag'];
1007
1008     // Allow non-admins to get and create tags to support tagset widget
1009     // Delete is still reserved for admins
1010     $permissions['tag'] = [
1011       'get' => ['access CiviCRM'],
1012       'create' => ['access CiviCRM'],
1013       'update' => ['access CiviCRM'],
1014     ];
1015
1016     //relationship permissions
1017     $permissions['relationship'] = [
1018       // get is managed by BAO::addSelectWhereClause
1019       'get' => [],
1020       'delete' => [
1021         'access CiviCRM',
1022         'edit all contacts',
1023       ],
1024       'default' => [
1025         'access CiviCRM',
1026         'edit all contacts',
1027       ],
1028     ];
1029
1030     // CRM-17741 - Permissions for RelationshipType.
1031     $permissions['relationship_type'] = [
1032       'get' => [
1033         'access CiviCRM',
1034       ],
1035       'default' => [
1036         'administer CiviCRM',
1037       ],
1038     ];
1039
1040     // Activity permissions
1041     $permissions['activity'] = [
1042       'delete' => [
1043         'access CiviCRM',
1044         'delete activities',
1045       ],
1046       'get' => [
1047         'access CiviCRM',
1048         // Note that view all activities is also required within the api
1049         // if the id is not passed in. Where the id is passed in the activity
1050         // specific check functions are used and tested.
1051       ],
1052       'default' => [
1053         'access CiviCRM',
1054         'view all activities',
1055       ],
1056     ];
1057     $permissions['activity_contact'] = $permissions['activity'];
1058
1059     // Case permissions
1060     $permissions['case'] = [
1061       'create' => [
1062         'access CiviCRM',
1063         'add cases',
1064       ],
1065       'delete' => [
1066         'access CiviCRM',
1067         'delete in CiviCase',
1068       ],
1069       'restore' => [
1070         'administer CiviCase',
1071       ],
1072       'merge' => [
1073         'administer CiviCase',
1074       ],
1075       'default' => [
1076         // At minimum the user needs one of the following. Finer-grained access is controlled by CRM_Case_BAO_Case::addSelectWhereClause
1077         ['access my cases and activities', 'access all cases and activities'],
1078       ],
1079     ];
1080     $permissions['case_contact'] = $permissions['case'];
1081
1082     $permissions['case_type'] = [
1083       'default' => ['administer CiviCase'],
1084       'get' => [
1085         // nested array = OR
1086         ['access my cases and activities', 'access all cases and activities'],
1087       ],
1088     ];
1089
1090     // Campaign permissions
1091     $permissions['campaign'] = [
1092       'get' => ['access CiviCRM'],
1093       'default' => [
1094         // nested array = OR
1095         ['administer CiviCampaign', 'manage campaign'],
1096       ],
1097     ];
1098     $permissions['survey'] = $permissions['campaign'];
1099
1100     // Financial permissions
1101     $permissions['contribution'] = [
1102       'get' => [
1103         'access CiviCRM',
1104         'access CiviContribute',
1105       ],
1106       'delete' => [
1107         'access CiviCRM',
1108         'access CiviContribute',
1109         'delete in CiviContribute',
1110       ],
1111       'completetransaction' => [
1112         'edit contributions',
1113       ],
1114       'default' => [
1115         'access CiviCRM',
1116         'access CiviContribute',
1117         'edit contributions',
1118       ],
1119     ];
1120     $permissions['line_item'] = $permissions['contribution'];
1121
1122     // Payment permissions
1123     $permissions['payment'] = [
1124       'get' => [
1125         'access CiviCRM',
1126         'access CiviContribute',
1127       ],
1128       'delete' => [
1129         'access CiviCRM',
1130         'access CiviContribute',
1131         'delete in CiviContribute',
1132       ],
1133       'cancel' => [
1134         'access CiviCRM',
1135         'access CiviContribute',
1136         'edit contributions',
1137       ],
1138       'create' => [
1139         'access CiviCRM',
1140         'access CiviContribute',
1141         'edit contributions',
1142       ],
1143       'default' => [
1144         'access CiviCRM',
1145         'access CiviContribute',
1146         'edit contributions',
1147       ],
1148     ];
1149     $permissions['contribution_recur'] = $permissions['payment'];
1150
1151     // Custom field permissions
1152     $permissions['custom_field'] = [
1153       'default' => [
1154         'administer CiviCRM',
1155         'access all custom data',
1156       ],
1157     ];
1158     $permissions['custom_group'] = $permissions['custom_field'];
1159
1160     // Event permissions
1161     $permissions['event'] = [
1162       'create' => [
1163         'access CiviCRM',
1164         'access CiviEvent',
1165         'edit all events',
1166       ],
1167       'delete' => [
1168         'access CiviCRM',
1169         'access CiviEvent',
1170         'delete in CiviEvent',
1171       ],
1172       'get' => [
1173         'access CiviCRM',
1174         'access CiviEvent',
1175         'view event info',
1176       ],
1177       'update' => [
1178         'access CiviCRM',
1179         'access CiviEvent',
1180         'edit all events',
1181       ],
1182     ];
1183     // Exception refers to dedupe_exception.
1184     $permissions['exception'] = [
1185       'default' => ['merge duplicate contacts'],
1186     ];
1187
1188     $permissions['job'] = [
1189       'process_batch_merge' => ['merge duplicate contacts'],
1190     ];
1191     $permissions['rule_group']['get'] = [['merge duplicate contacts', 'administer CiviCRM']];
1192     // Loc block is only used for events
1193     $permissions['loc_block'] = $permissions['event'];
1194
1195     $permissions['state_province'] = [
1196       'get' => [
1197         'access CiviCRM',
1198       ],
1199     ];
1200
1201     // Price sets are shared by several components, user needs access to at least one of them
1202     $permissions['price_set'] = [
1203       'default' => [
1204         ['access CiviEvent', 'access CiviContribute', 'access CiviMember'],
1205       ],
1206       'get' => [
1207         ['access CiviCRM', 'view event info', 'make online contributions'],
1208       ],
1209     ];
1210
1211     // File permissions
1212     $permissions['file'] = [
1213       'default' => [
1214         'access CiviCRM',
1215         'access uploaded files',
1216       ],
1217     ];
1218     $permissions['files_by_entity'] = $permissions['file'];
1219
1220     // Group permissions
1221     $permissions['group'] = [
1222       'get' => [
1223         'access CiviCRM',
1224       ],
1225       'default' => [
1226         'access CiviCRM',
1227         'edit groups',
1228       ],
1229     ];
1230
1231     $permissions['group_nesting'] = $permissions['group'];
1232     $permissions['group_organization'] = $permissions['group'];
1233
1234     //Group Contact permission
1235     $permissions['group_contact'] = [
1236       'get' => [
1237         'access CiviCRM',
1238       ],
1239       'default' => [
1240         'access CiviCRM',
1241         'edit all contacts',
1242       ],
1243     ];
1244
1245     // CiviMail Permissions
1246     $civiMailBasePerms = [
1247       // To get/preview/update, one must have least one of these perms:
1248       // Mailing API implementations enforce nuances of create/approve/schedule permissions.
1249       'access CiviMail',
1250       'create mailings',
1251       'schedule mailings',
1252       'approve mailings',
1253     ];
1254     $permissions['mailing'] = [
1255       'get' => [
1256         'access CiviCRM',
1257         $civiMailBasePerms,
1258       ],
1259       'delete' => [
1260         'access CiviCRM',
1261         $civiMailBasePerms,
1262         'delete in CiviMail',
1263       ],
1264       'submit' => [
1265         'access CiviCRM',
1266         ['access CiviMail', 'schedule mailings'],
1267       ],
1268       'default' => [
1269         'access CiviCRM',
1270         $civiMailBasePerms,
1271       ],
1272     ];
1273     $permissions['mailing_group'] = $permissions['mailing'];
1274     $permissions['mailing_job'] = $permissions['mailing'];
1275     $permissions['mailing_recipients'] = $permissions['mailing'];
1276
1277     $permissions['mailing_a_b'] = [
1278       'get' => [
1279         'access CiviCRM',
1280         'access CiviMail',
1281       ],
1282       'delete' => [
1283         'access CiviCRM',
1284         'access CiviMail',
1285         'delete in CiviMail',
1286       ],
1287       'submit' => [
1288         'access CiviCRM',
1289         ['access CiviMail', 'schedule mailings'],
1290       ],
1291       'default' => [
1292         'access CiviCRM',
1293         'access CiviMail',
1294       ],
1295     ];
1296
1297     // Membership permissions
1298     $permissions['membership'] = [
1299       'get' => [
1300         'access CiviCRM',
1301         'access CiviMember',
1302       ],
1303       'delete' => [
1304         'access CiviCRM',
1305         'access CiviMember',
1306         'delete in CiviMember',
1307       ],
1308       'default' => [
1309         'access CiviCRM',
1310         'access CiviMember',
1311         'edit memberships',
1312       ],
1313     ];
1314     $permissions['membership_status'] = $permissions['membership'];
1315     $permissions['membership_type'] = $permissions['membership'];
1316     $permissions['membership_payment'] = [
1317       'create' => [
1318         'access CiviCRM',
1319         'access CiviMember',
1320         'edit memberships',
1321         'access CiviContribute',
1322         'edit contributions',
1323       ],
1324       'delete' => [
1325         'access CiviCRM',
1326         'access CiviMember',
1327         'delete in CiviMember',
1328         'access CiviContribute',
1329         'delete in CiviContribute',
1330       ],
1331       'get' => [
1332         'access CiviCRM',
1333         'access CiviMember',
1334         'access CiviContribute',
1335       ],
1336       'update' => [
1337         'access CiviCRM',
1338         'access CiviMember',
1339         'edit memberships',
1340         'access CiviContribute',
1341         'edit contributions',
1342       ],
1343     ];
1344
1345     // Participant permissions
1346     $permissions['participant'] = [
1347       'create' => [
1348         'access CiviCRM',
1349         'access CiviEvent',
1350         'register for events',
1351       ],
1352       'delete' => [
1353         'access CiviCRM',
1354         'access CiviEvent',
1355         'edit event participants',
1356       ],
1357       'get' => [
1358         'access CiviCRM',
1359         'access CiviEvent',
1360         'view event participants',
1361       ],
1362       'update' => [
1363         'access CiviCRM',
1364         'access CiviEvent',
1365         'edit event participants',
1366       ],
1367     ];
1368     $permissions['participant_payment'] = [
1369       'create' => [
1370         'access CiviCRM',
1371         'access CiviEvent',
1372         'register for events',
1373         'access CiviContribute',
1374         'edit contributions',
1375       ],
1376       'delete' => [
1377         'access CiviCRM',
1378         'access CiviEvent',
1379         'edit event participants',
1380         'access CiviContribute',
1381         'delete in CiviContribute',
1382       ],
1383       'get' => [
1384         'access CiviCRM',
1385         'access CiviEvent',
1386         'view event participants',
1387         'access CiviContribute',
1388       ],
1389       'update' => [
1390         'access CiviCRM',
1391         'access CiviEvent',
1392         'edit event participants',
1393         'access CiviContribute',
1394         'edit contributions',
1395       ],
1396     ];
1397
1398     // Pledge permissions
1399     $permissions['pledge'] = [
1400       'create' => [
1401         'access CiviCRM',
1402         'access CiviPledge',
1403         'edit pledges',
1404       ],
1405       'delete' => [
1406         'access CiviCRM',
1407         'access CiviPledge',
1408         'delete in CiviPledge',
1409       ],
1410       'get' => [
1411         'access CiviCRM',
1412         'access CiviPledge',
1413       ],
1414       'update' => [
1415         'access CiviCRM',
1416         'access CiviPledge',
1417         'edit pledges',
1418       ],
1419     ];
1420
1421     //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission.
1422     $permissions['action_schedule'] = [
1423       'update' => [
1424         [
1425           'access CiviCRM',
1426           'edit all events',
1427         ],
1428       ],
1429     ];
1430
1431     $permissions['pledge_payment'] = [
1432       'create' => [
1433         'access CiviCRM',
1434         'access CiviPledge',
1435         'edit pledges',
1436         'access CiviContribute',
1437         'edit contributions',
1438       ],
1439       'delete' => [
1440         'access CiviCRM',
1441         'access CiviPledge',
1442         'delete in CiviPledge',
1443         'access CiviContribute',
1444         'delete in CiviContribute',
1445       ],
1446       'get' => [
1447         'access CiviCRM',
1448         'access CiviPledge',
1449         'access CiviContribute',
1450       ],
1451       'update' => [
1452         'access CiviCRM',
1453         'access CiviPledge',
1454         'edit pledges',
1455         'access CiviContribute',
1456         'edit contributions',
1457       ],
1458     ];
1459
1460     // Profile permissions
1461     $permissions['profile'] = [
1462       // the profile will take care of this
1463       'get' => [],
1464     ];
1465
1466     $permissions['uf_group'] = [
1467       'create' => [
1468         'access CiviCRM',
1469         [
1470           'administer CiviCRM',
1471           'manage event profiles',
1472         ],
1473       ],
1474       'get' => [
1475         'access CiviCRM',
1476       ],
1477       'update' => [
1478         'access CiviCRM',
1479         [
1480           'administer CiviCRM',
1481           'manage event profiles',
1482         ],
1483       ],
1484     ];
1485     $permissions['uf_field'] = $permissions['uf_join'] = $permissions['uf_group'];
1486     $permissions['uf_field']['delete'] = [
1487       'access CiviCRM',
1488       [
1489         'administer CiviCRM',
1490         'manage event profiles',
1491       ],
1492     ];
1493     $permissions['option_value'] = $permissions['uf_group'];
1494     $permissions['option_group'] = $permissions['option_value'];
1495
1496     $permissions['custom_value'] = [
1497       'gettree' => ['access CiviCRM'],
1498     ];
1499
1500     $permissions['message_template'] = [
1501       'get' => ['access CiviCRM'],
1502       'create' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']],
1503       'update' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']],
1504     ];
1505
1506     $permissions['report_template']['update'] = 'save Report Criteria';
1507     $permissions['report_template']['create'] = 'save Report Criteria';
1508     return $permissions;
1509   }
1510
1511   /**
1512    * Translate an unknown action to a canonical form.
1513    *
1514    * @param string $action
1515    *
1516    * @return string
1517    *   the standardised action name
1518    */
1519   public static function getGenericAction($action) {
1520     $snippet = substr($action, 0, 3);
1521     if ($action == 'replace' || $snippet == 'del') {
1522       // 'Replace' is a combination of get+create+update+delete; however, the permissions
1523       // on each of those will be tested separately at runtime. This is just a sniff-test
1524       // based on the heuristic that 'delete' tends to be the most closely guarded
1525       // of the necessary permissions.
1526       $action = 'delete';
1527     }
1528     elseif ($action == 'setvalue' || $snippet == 'upd') {
1529       $action = 'update';
1530     }
1531     elseif ($action == 'getfields' || $action == 'getfield' || $action == 'getspec' || $action == 'getoptions') {
1532       $action = 'meta';
1533     }
1534     elseif ($snippet == 'get') {
1535       $action = 'get';
1536     }
1537     return $action;
1538   }
1539
1540   /**
1541    * Validate user permission across.
1542    * edit or view or with supportable acls.
1543    *
1544    * @return bool
1545    */
1546   public static function giveMeAllACLs() {
1547     if (CRM_Core_Permission::check('view all contacts') ||
1548       CRM_Core_Permission::check('edit all contacts')
1549     ) {
1550       return TRUE;
1551     }
1552
1553     $session = CRM_Core_Session::singleton();
1554     $contactID = $session->get('userID');
1555
1556     //check for acl.
1557     $aclPermission = self::getPermission();
1558     if (in_array($aclPermission, [
1559       CRM_Core_Permission::EDIT,
1560       CRM_Core_Permission::VIEW,
1561     ])
1562     ) {
1563       return TRUE;
1564     }
1565
1566     // run acl where hook and see if the user is supplying an ACL clause
1567     // that is not false
1568     $tables = $whereTables = [];
1569     $where = NULL;
1570
1571     CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW,
1572       $tables, $whereTables,
1573       $contactID, $where
1574     );
1575     return empty($whereTables) ? FALSE : TRUE;
1576   }
1577
1578   /**
1579    * Get component name from given permission.
1580    *
1581    * @param string $permission
1582    *
1583    * @return null|string
1584    *   the name of component.
1585    */
1586   public static function getComponentName($permission) {
1587     $componentName = NULL;
1588     $permission = trim($permission);
1589     if (empty($permission)) {
1590       return $componentName;
1591     }
1592
1593     static $allCompPermissions = [];
1594     if (empty($allCompPermissions)) {
1595       $components = CRM_Core_Component::getComponents();
1596       foreach ($components as $name => $comp) {
1597         //get all permissions of each components unconditionally
1598         $allCompPermissions[$name] = $comp->getPermissions(TRUE);
1599       }
1600     }
1601
1602     if (is_array($allCompPermissions)) {
1603       foreach ($allCompPermissions as $name => $permissions) {
1604         if (array_key_exists($permission, $permissions)) {
1605           $componentName = $name;
1606           break;
1607         }
1608       }
1609     }
1610
1611     return $componentName;
1612   }
1613
1614   /**
1615    * Get all the contact emails for users that have a specific permission.
1616    *
1617    * @param string $permissionName
1618    *   Name of the permission we are interested in.
1619    *
1620    * @return string
1621    *   a comma separated list of email addresses
1622    */
1623   public static function permissionEmails($permissionName) {
1624     $config = CRM_Core_Config::singleton();
1625     return $config->userPermissionClass->permissionEmails($permissionName);
1626   }
1627
1628   /**
1629    * Get all the contact emails for users that have a specific role.
1630    *
1631    * @param string $roleName
1632    *   Name of the role we are interested in.
1633    *
1634    * @return string
1635    *   a comma separated list of email addresses
1636    */
1637   public static function roleEmails($roleName) {
1638     $config = CRM_Core_Config::singleton();
1639     return $config->userRoleClass->roleEmails($roleName);
1640   }
1641
1642   /**
1643    * @return bool
1644    */
1645   public static function isMultisiteEnabled() {
1646     return Civi::settings()->get('is_enabled') ? TRUE : FALSE;
1647   }
1648
1649   /**
1650    * Verify if the user has permission to get the invoice.
1651    *
1652    * @return bool
1653    *   TRUE if the user has download all invoices permission or download my
1654    *   invoices permission and the invoice author is the current user.
1655    */
1656   public static function checkDownloadInvoice() {
1657     $cid = CRM_Core_Session::getLoggedInContactID();
1658     if (CRM_Core_Permission::check('access CiviContribute') ||
1659       (CRM_Core_Permission::check('view my invoices') && $_GET['cid'] == $cid)
1660     ) {
1661       return TRUE;
1662     }
1663     return FALSE;
1664   }
1665
1666 }