Add new Super-duper-no-permissions-apply permission
[civicrm-core.git] / CRM / Core / Permission.php
1 <?php
2 /*
3 +--------------------------------------------------------------------+
4 | Copyright CiviCRM LLC. All rights reserved. |
5 | |
6 | This work is published under the GNU AGPLv3 license with some |
7 | permitted exceptions and without any warranty. For full license |
8 | and copyright information, see https://civicrm.org/licensing |
9 +--------------------------------------------------------------------+
10 */
11
12 /**
13 *
14 * @package CRM
15 * @copyright CiviCRM LLC https://civicrm.org/licensing
16 */
17
18 /**
19 * This is the basic permission class wrapper
20 */
21 class CRM_Core_Permission {
22
23 /**
24 * Static strings used to compose permissions.
25 *
26 * @const
27 * @var string
28 */
29 const EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in ';
30
31 /**
32 * The various type of permissions.
33 *
34 * @var int
35 */
36 const EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7;
37
38 /**
39 * A placeholder permission which always fails.
40 */
41 const ALWAYS_DENY_PERMISSION = "*always deny*";
42
43 /**
44 * A placeholder permission which always fails.
45 */
46 const ALWAYS_ALLOW_PERMISSION = "*always allow*";
47
48 /**
49 * Various authentication sources.
50 *
51 * @var int
52 */
53 const AUTH_SRC_UNKNOWN = 0, AUTH_SRC_CHECKSUM = 1, AUTH_SRC_SITEKEY = 2, AUTH_SRC_LOGIN = 4;
54
55 /**
56 * Get the current permission of this user.
57 *
58 * @return string
59 * the permission of the user (edit or view or null)
60 */
61 public static function getPermission() {
62 $config = CRM_Core_Config::singleton();
63 return $config->userPermissionClass->getPermission();
64 }
65
66 /**
67 * Given a permission string or array, check for access requirements
68 *
69 * Ex 1: Must have 'access CiviCRM'
70 * (string) 'access CiviCRM'
71 *
72 * Ex 2: Must have 'access CiviCRM' and 'access Ajax API'
73 * ['access CiviCRM', 'access Ajax API']
74 *
75 * Ex 3: Must have 'access CiviCRM' or 'access Ajax API'
76 * [
77 * ['access CiviCRM', 'access Ajax API'],
78 * ],
79 *
80 * Ex 4: Must have 'access CiviCRM' or 'access Ajax API' AND 'access CiviEvent'
81 * [
82 * ['access CiviCRM', 'access Ajax API'],
83 * 'access CiviEvent',
84 * ],
85 *
86 * Note that in permissions.php this is keyed by the action eg.
87 * (access Civi || access AJAX) && (access CiviEvent || access CiviContribute)
88 * 'myaction' => [
89 * ['access CiviCRM', 'access Ajax API'],
90 * ['access CiviEvent', 'access CiviContribute']
91 * ],
92 *
93 * @param string|array $permissions
94 * The permission to check as an array or string -see examples.
95 *
96 * @param int $contactId
97 * Contact id to check permissions for. Defaults to current logged-in user.
98 *
99 * @return bool
100 * true if contact has permission(s), else false
101 */
102 public static function check($permissions, $contactId = NULL) {
103 $permissions = (array) $permissions;
104 $userId = CRM_Core_BAO_UFMatch::getUFId($contactId);
105
106 /** @var CRM_Core_Permission_Temp $tempPerm */
107 $tempPerm = CRM_Core_Config::singleton()->userPermissionTemp;
108
109 foreach ($permissions as $permission) {
110 if (is_array($permission)) {
111 foreach ($permission as $orPerm) {
112 if (self::check($orPerm, $contactId)) {
113 //one of our 'or' permissions has succeeded - stop checking this permission
114 return TRUE;
115 }
116 }
117 //none of our our conditions was met
118 return FALSE;
119 }
120 else {
121 // This is an individual permission
122 $impliedPermissions = self::getImpliedPermissionsFor($permission);
123 $impliedPermissions[] = $permission;
124 foreach ($impliedPermissions as $permissionOption) {
125 $granted = CRM_Core_Config::singleton()->userPermissionClass->check($permissionOption, $userId);
126 // Call the permission_check hook to permit dynamic escalation (CRM-19256)
127 CRM_Utils_Hook::permission_check($permissionOption, $granted, $contactId);
128 if ($granted) {
129 break;
130 }
131 }
132
133 if (
134 !$granted
135 && !($tempPerm && $tempPerm->check($permission))
136 ) {
137 //one of our 'and' conditions has not been met
138 return FALSE;
139 }
140 }
141 }
142 return TRUE;
143 }
144
145 /**
146 * Determine if any one of the permissions strings applies to current user.
147 *
148 * @param array $perms
149 * @return bool
150 */
151 public static function checkAnyPerm($perms) {
152 foreach ($perms as $perm) {
153 if (CRM_Core_Permission::check($perm)) {
154 return TRUE;
155 }
156 }
157 return FALSE;
158 }
159
160 /**
161 * Given a group/role array, check for access requirements
162 *
163 * @param array $array
164 * The group/role to check.
165 *
166 * @return bool
167 * true if yes, else false
168 */
169 public static function checkGroupRole($array) {
170 $config = CRM_Core_Config::singleton();
171 return $config->userPermissionClass->checkGroupRole($array);
172 }
173
174 /**
175 * Get the permissioned where clause for the user.
176 *
177 * @param int $type
178 * The type of permission needed.
179 * @param array $tables
180 * (reference ) add the tables that are needed for the select clause.
181 * @param array $whereTables
182 * (reference ) add the tables that are needed for the where clause.
183 *
184 * @return string
185 * the group where clause for this user
186 */
187 public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) {
188 $config = CRM_Core_Config::singleton();
189 return $config->userPermissionClass->getPermissionedStaticGroupClause($type, $tables, $whereTables);
190 }
191
192 /**
193 * Get all groups from database, filtered by permissions
194 * for this user
195 *
196 * @param string $groupType
197 * Type of group(Access/Mailing).
198 * @param bool $excludeHidden
199 * exclude hidden groups.
200 *
201 *
202 * @return array
203 * array reference of all groups.
204 */
205 public static function group($groupType, $excludeHidden = TRUE) {
206 $config = CRM_Core_Config::singleton();
207 return $config->userPermissionClass->group($groupType, $excludeHidden);
208 }
209
210 /**
211 * @return bool
212 */
213 public static function customGroupAdmin() {
214 $admin = FALSE;
215
216 // check if user has all powerful permission
217 // or administer civicrm permission (CRM-1905)
218 if (self::check('access all custom data')) {
219 return TRUE;
220 }
221
222 if (
223 self::check('administer Multiple Organizations') &&
224 self::isMultisiteEnabled()
225 ) {
226 return TRUE;
227 }
228
229 if (self::check('administer CiviCRM')) {
230 return TRUE;
231 }
232
233 return FALSE;
234 }
235
236 /**
237 * @param int $type
238 * @param bool $reset
239 *
240 * @return array
241 */
242 public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) {
243 $customGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_CustomField', 'custom_group_id',
244 ['fresh' => $reset]);
245 $defaultGroups = [];
246
247 // check if user has all powerful permission
248 // or administer civicrm permission (CRM-1905)
249 if (self::customGroupAdmin()) {
250 $defaultGroups = array_keys($customGroups);
251 }
252
253 return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups);
254 }
255
256 /**
257 * @param int $type
258 * @param null $prefix
259 * @param bool $reset
260 *
261 * @return string
262 */
263 public static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) {
264 if (self::customGroupAdmin()) {
265 return ' ( 1 ) ';
266 }
267
268 $groups = self::customGroup($type, $reset);
269 if (empty($groups)) {
270 return ' ( 0 ) ';
271 }
272 else {
273 return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
274 }
275 }
276
277 /**
278 * @param int $gid
279 * @param int $type
280 *
281 * @return bool
282 */
283 public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) {
284 if (empty($gid)) {
285 return TRUE;
286 }
287
288 $groups = self::ufGroup($type);
289 return !empty($groups) && in_array($gid, $groups);
290 }
291
292 /**
293 * @param int $type
294 *
295 * @return array
296 */
297 public static function ufGroup($type = CRM_Core_Permission::VIEW) {
298 $ufGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_UFField', 'uf_group_id');
299
300 $allGroups = array_keys($ufGroups);
301
302 // check if user has all powerful permission
303 if (self::check('profile listings and forms')) {
304 return $allGroups;
305 }
306
307 switch ($type) {
308 case CRM_Core_Permission::VIEW:
309 if (self::check('profile view')) {
310 return $allGroups;
311 }
312 break;
313
314 case CRM_Core_Permission::CREATE:
315 if (self::check('profile create')) {
316 return $allGroups;
317 }
318 break;
319
320 case CRM_Core_Permission::EDIT:
321 if (self::check('profile edit')) {
322 return $allGroups;
323 }
324 break;
325
326 case CRM_Core_Permission::SEARCH:
327 if (self::check('profile listings')) {
328 return $allGroups;
329 }
330 break;
331 }
332
333 return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups);
334 }
335
336 /**
337 * @param int $type
338 * @param null $prefix
339 * @param bool $returnUFGroupIds
340 *
341 * @return array|string
342 */
343 public static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) {
344 $groups = self::ufGroup($type);
345 if ($returnUFGroupIds) {
346 return $groups;
347 }
348 elseif (empty($groups)) {
349 return ' ( 0 ) ';
350 }
351 else {
352 return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
353 }
354 }
355
356 /**
357 * @param int $type
358 * @param int $eventID
359 * @param string $context
360 *
361 * @return array|null
362 */
363 public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL, $context = '') {
364 if (!empty($context)) {
365 if (CRM_Core_Permission::check($context)) {
366 return TRUE;
367 }
368 }
369 $events = CRM_Event_PseudoConstant::event(NULL, TRUE);
370 $includeEvents = [];
371
372 // check if user has all powerful permission
373 if (self::check('register for events')) {
374 $includeEvents = array_keys($events);
375 }
376
377 if ($type == CRM_Core_Permission::VIEW &&
378 self::check('view event info')
379 ) {
380 $includeEvents = array_keys($events);
381 }
382
383 $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents);
384 if (!$eventID) {
385 return $permissionedEvents;
386 }
387 if (!empty($permissionedEvents)) {
388 return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID;
389 }
390 return NULL;
391 }
392
393 /**
394 * @param int $type
395 * @param null $prefix
396 *
397 * @return string
398 */
399 public static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) {
400 $events = self::event($type);
401 if (empty($events)) {
402 return ' ( 0 ) ';
403 }
404 else {
405 return "{$prefix}id IN ( " . implode(',', $events) . ' ) ';
406 }
407 }
408
409 /**
410 * Checks that component is enabled and optionally that user has basic perm.
411 *
412 * @param string $module
413 * Specifies the name of the CiviCRM component.
414 * @param bool $checkPermission
415 * Check not only that module is enabled, but that user has necessary
416 * permission.
417 * @param bool $requireAllCasesPermOnCiviCase
418 * Significant only if $module == CiviCase
419 * Require "access all cases and activities", not just
420 * "access my cases and activities".
421 *
422 * @return bool
423 * Access to specified $module is granted.
424 */
425 public static function access($module, $checkPermission = TRUE, $requireAllCasesPermOnCiviCase = FALSE) {
426 $config = CRM_Core_Config::singleton();
427
428 if (!in_array($module, $config->enableComponents)) {
429 return FALSE;
430 }
431
432 if ($checkPermission) {
433 switch ($module) {
434 case 'CiviCase':
435 $access_all_cases = CRM_Core_Permission::check("access all cases and activities");
436 $access_my_cases = CRM_Core_Permission::check("access my cases and activities");
437 return $access_all_cases || (!$requireAllCasesPermOnCiviCase && $access_my_cases);
438
439 case 'CiviCampaign':
440 return CRM_Core_Permission::check("administer $module");
441
442 default:
443 return CRM_Core_Permission::check("access $module");
444 }
445 }
446
447 return TRUE;
448 }
449
450 /**
451 * Check permissions for delete and edit actions.
452 *
453 * @param string $module
454 * Component name.
455 * @param int $action
456 * Action to be check across component.
457 *
458 *
459 * @return bool
460 */
461 public static function checkActionPermission($module, $action) {
462 //check delete related permissions.
463 if ($action & CRM_Core_Action::DELETE) {
464 $permissionName = "delete in $module";
465 }
466 else {
467 $editPermissions = [
468 'CiviEvent' => 'edit event participants',
469 'CiviMember' => 'edit memberships',
470 'CiviPledge' => 'edit pledges',
471 'CiviContribute' => 'edit contributions',
472 'CiviGrant' => 'edit grants',
473 'CiviMail' => 'access CiviMail',
474 'CiviAuction' => 'add auction items',
475 ];
476 $permissionName = $editPermissions[$module] ?? NULL;
477 }
478
479 if ($module == 'CiviCase' && !$permissionName) {
480 return CRM_Case_BAO_Case::accessCiviCase();
481 }
482 else {
483 //check for permission.
484 return CRM_Core_Permission::check($permissionName);
485 }
486 }
487
488 /**
489 * @param $args
490 * @param string $op
491 *
492 * @return bool
493 */
494 public static function checkMenu(&$args, $op = 'and') {
495 if (!is_array($args)) {
496 return $args;
497 }
498 foreach ($args as $str) {
499 $res = CRM_Core_Permission::check($str);
500 if ($op == 'or' && $res) {
501 return TRUE;
502 }
503 elseif ($op == 'and' && !$res) {
504 return FALSE;
505 }
506 }
507 return ($op == 'or') ? FALSE : TRUE;
508 }
509
510 /**
511 * @param $item
512 *
513 * @return bool|mixed
514 * @throws Exception
515 */
516 public static function checkMenuItem(&$item) {
517 if (!array_key_exists('access_callback', $item)) {
518 CRM_Core_Error::backtrace();
519 throw new CRM_Core_Exception('Missing Access Callback key in menu item');
520 }
521
522 // if component_id is present, ensure it is enabled
523 if (isset($item['component_id']) && $item['component_id']) {
524 if (!isset(Civi::$statics[__CLASS__]['componentNameId'])) {
525 Civi::$statics[__CLASS__]['componentNameId'] = array_flip(CRM_Core_Component::getComponentIDs());
526 }
527 $componentName = Civi::$statics[__CLASS__]['componentNameId'][$item['component_id']];
528
529 $config = CRM_Core_Config::singleton();
530 if (is_array($config->enableComponents) && in_array($componentName, $config->enableComponents)) {
531 // continue with process
532 }
533 else {
534 return FALSE;
535 }
536 }
537
538 // the following is imitating drupal 6 code in includes/menu.inc
539 if (empty($item['access_callback']) ||
540 is_numeric($item['access_callback'])
541 ) {
542 return (bool) $item['access_callback'];
543 }
544
545 // check whether the following Ajax requests submitted the right key
546 // FIXME: this should be integrated into ACLs proper
547 if (CRM_Utils_Array::value('page_type', $item) == 3) {
548 if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) {
549 return FALSE;
550 }
551 }
552
553 // check if callback is for checkMenu, if so optimize it
554 if (is_array($item['access_callback']) &&
555 $item['access_callback'][0] == 'CRM_Core_Permission' &&
556 $item['access_callback'][1] == 'checkMenu'
557 ) {
558 $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and');
559 return self::checkMenu($item['access_arguments'][0], $op);
560 }
561 else {
562 return call_user_func_array($item['access_callback'], $item['access_arguments']);
563 }
564 }
565
566 /**
567 * @param bool $all
568 * Include disabled components
569 * @param bool $descriptions
570 * Whether to return descriptions
571 *
572 * @return array
573 */
574 public static function basicPermissions($all = FALSE, $descriptions = FALSE) {
575 $cacheKey = implode('-', [$all, $descriptions]);
576 if (empty(Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey])) {
577 Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey] = self::assembleBasicPermissions($all, $descriptions);
578 }
579 return Civi::$statics[__CLASS__][__FUNCTION__][$cacheKey];
580 }
581
582 /**
583 * @param bool $all
584 * @param bool $descriptions
585 * whether to return descriptions
586 *
587 * @return array
588 * @throws \CRM_Core_Exception
589 */
590 public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE): array {
591 $permissions = self::getCoreAndComponentPermissions($all);
592
593 // Add any permissions defined in hook_civicrm_permission implementations.
594 $module_permissions = CRM_Core_Config::singleton()->userPermissionClass->getAllModulePermissions(TRUE, $permissions);
595 $permissions = array_merge($permissions, $module_permissions);
596 if (!$descriptions) {
597 foreach ($permissions as $name => $attr) {
598 $permissions[$name] = array_shift($attr);
599 }
600 }
601 return $permissions;
602 }
603
604 /**
605 * @return array
606 */
607 public static function getAnonymousPermissionsWarnings() {
608 static $permissions = [];
609 if (empty($permissions)) {
610 $permissions = [
611 'administer CiviCRM',
612 ];
613 $components = CRM_Core_Component::getComponents();
614 foreach ($components as $comp) {
615 if (!method_exists($comp, 'getAnonymousPermissionWarnings')) {
616 continue;
617 }
618 $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings());
619 }
620 }
621 return $permissions;
622 }
623
624 /**
625 * @param $anonymous_perms
626 *
627 * @return array
628 */
629 public static function validateForPermissionWarnings($anonymous_perms) {
630 return array_intersect($anonymous_perms, self::getAnonymousPermissionsWarnings());
631 }
632
633 /**
634 * Get core permissions.
635 *
636 * @return array
637 */
638 public static function getCorePermissions() {
639 $prefix = ts('CiviCRM') . ': ';
640 $permissions = [
641 'add contacts' => [
642 $prefix . ts('add contacts'),
643 ts('Create a new contact record in CiviCRM'),
644 ],
645 'view all contacts' => [
646 $prefix . ts('view all contacts'),
647 ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'),
648 ],
649 'edit all contacts' => [
650 $prefix . ts('edit all contacts'),
651 ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'),
652 ],
653 'view my contact' => [
654 $prefix . ts('view my contact'),
655 ],
656 'edit my contact' => [
657 $prefix . ts('edit my contact'),
658 ],
659 'delete contacts' => [
660 $prefix . ts('delete contacts'),
661 ],
662 'access deleted contacts' => [
663 $prefix . ts('access deleted contacts'),
664 ts('Access contacts in the trash'),
665 ],
666 'import contacts' => [
667 $prefix . ts('import contacts'),
668 ts('Import contacts and activities'),
669 ],
670 'import SQL datasource' => [
671 $prefix . ts('import SQL datasource'),
672 ts('When importing, consume data directly from a SQL datasource'),
673 ],
674 'edit groups' => [
675 $prefix . ts('edit groups'),
676 ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'),
677 ],
678 'administer CiviCRM' => [
679 $prefix . ts('administer CiviCRM'),
680 ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'),
681 ],
682 'skip IDS check' => [
683 $prefix . ts('skip IDS check'),
684 ts('Warning: Give to trusted roles only; this permission has security implications. IDS system is bypassed for users with this permission. Prevents false errors for admin users.'),
685 ],
686 'access uploaded files' => [
687 $prefix . ts('access uploaded files'),
688 ts('View / download files including images and photos'),
689 ],
690 'profile listings and forms' => [
691 $prefix . ts('profile listings and forms'),
692 ts('Warning: Give to trusted roles only; this permission has privacy implications. Add/edit data in online forms and access public searchable directories.'),
693 ],
694 'profile listings' => [
695 $prefix . ts('profile listings'),
696 ts('Warning: Give to trusted roles only; this permission has privacy implications. Access public searchable directories.'),
697 ],
698 'profile create' => [
699 $prefix . ts('profile create'),
700 ts('Add data in a profile form.'),
701 ],
702 'profile edit' => [
703 $prefix . ts('profile edit'),
704 ts('Edit data in a profile form.'),
705 ],
706 'profile view' => [
707 $prefix . ts('profile view'),
708 ts('View data in a profile.'),
709 ],
710 'access all custom data' => [
711 $prefix . ts('access all custom data'),
712 ts('View all custom fields regardless of ACL rules'),
713 ],
714 'view all activities' => [
715 $prefix . ts('view all activities'),
716 ts('View all activities (for visible contacts)'),
717 ],
718 'delete activities' => [
719 $prefix . ts('Delete activities'),
720 ],
721 'edit inbound email basic information' => [
722 $prefix . ts('edit inbound email basic information'),
723 ts('Edit all inbound email activities (for visible contacts) basic information. Content editing not allowed.'),
724 ],
725 'edit inbound email basic information and content' => [
726 $prefix . ts('edit inbound email basic information and content'),
727 ts('Edit all inbound email activities (for visible contacts) basic information and content.'),
728 ],
729 'access CiviCRM' => [
730 $prefix . ts('access CiviCRM backend and API'),
731 ts('Master control for access to the main CiviCRM backend and API. Give to trusted roles only.'),
732 ],
733 'access Contact Dashboard' => [
734 $prefix . ts('access Contact Dashboard'),
735 ts('View Contact Dashboard (for themselves and visible contacts)'),
736 ],
737 'translate CiviCRM' => [
738 $prefix . ts('translate CiviCRM'),
739 ts('Allow User to enable multilingual'),
740 ],
741 'manage tags' => [
742 $prefix . ts('manage tags'),
743 ts('Create and rename tags'),
744 ],
745 'administer reserved groups' => [
746 $prefix . ts('administer reserved groups'),
747 ts('Edit and disable Reserved Groups (Needs Edit Groups)'),
748 ],
749 'administer Tagsets' => [
750 $prefix . ts('administer Tagsets'),
751 ],
752 'administer reserved tags' => [
753 $prefix . ts('administer reserved tags'),
754 ],
755 'administer dedupe rules' => [
756 $prefix . ts('administer dedupe rules'),
757 ts('Create and edit rules, change the supervised and unsupervised rules'),
758 ],
759 'merge duplicate contacts' => [
760 $prefix . ts('merge duplicate contacts'),
761 ts('Delete Contacts must also be granted in order for this to work.'),
762 ],
763 'force merge duplicate contacts' => [
764 $prefix . ts('force merge duplicate contacts'),
765 ts('Delete Contacts must also be granted in order for this to work.'),
766 ],
767 'view debug output' => [
768 $prefix . ts('view debug output'),
769 ts('View results of debug and backtrace'),
770 ],
771
772 'view all notes' => [
773 $prefix . ts('view all notes'),
774 ts("View notes (for visible contacts) even if they're marked admin only"),
775 ],
776 'add contact notes' => [
777 $prefix . ts('add contact notes'),
778 ts("Create notes for contacts"),
779 ],
780 'access AJAX API' => [
781 $prefix . ts('access AJAX API'),
782 ts('Allow API access even if Access CiviCRM is not granted'),
783 ],
784 'access contact reference fields' => [
785 $prefix . ts('access contact reference fields'),
786 ts('Allow entering data into contact reference fields'),
787 ],
788 'create manual batch' => [
789 $prefix . ts('create manual batch'),
790 ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'),
791 ],
792 'edit own manual batches' => [
793 $prefix . ts('edit own manual batches'),
794 ts('Edit accounting batches created by user'),
795 ],
796 'edit all manual batches' => [
797 $prefix . ts('edit all manual batches'),
798 ts('Edit all accounting batches'),
799 ],
800 'close own manual batches' => [
801 $prefix . ts('close own manual batches'),
802 ts('Close accounting batches created by user (with Access to CiviContribute)'),
803 ],
804 'close all manual batches' => [
805 $prefix . ts('close all manual batches'),
806 ts('Close all accounting batches (with Access to CiviContribute)'),
807 ],
808 'reopen own manual batches' => [
809 $prefix . ts('reopen own manual batches'),
810 ts('Reopen accounting batches created by user (with Access to CiviContribute)'),
811 ],
812 'reopen all manual batches' => [
813 $prefix . ts('reopen all manual batches'),
814 ts('Reopen all accounting batches (with Access to CiviContribute)'),
815 ],
816 'view own manual batches' => [
817 $prefix . ts('view own manual batches'),
818 ts('View accounting batches created by user (with Access to CiviContribute)'),
819 ],
820 'view all manual batches' => [
821 $prefix . ts('view all manual batches'),
822 ts('View all accounting batches (with Access to CiviContribute)'),
823 ],
824 'delete own manual batches' => [
825 $prefix . ts('delete own manual batches'),
826 ts('Delete accounting batches created by user'),
827 ],
828 'delete all manual batches' => [
829 $prefix . ts('delete all manual batches'),
830 ts('Delete all accounting batches'),
831 ],
832 'export own manual batches' => [
833 $prefix . ts('export own manual batches'),
834 ts('Export accounting batches created by user'),
835 ],
836 'export all manual batches' => [
837 $prefix . ts('export all manual batches'),
838 ts('Export all accounting batches'),
839 ],
840 'administer payment processors' => [
841 $prefix . ts('administer payment processors'),
842 ts('Add, Update, or Disable Payment Processors'),
843 ],
844 'edit message templates' => [
845 $prefix . ts('edit message templates'),
846 ],
847 'edit system workflow message templates' => [
848 $prefix . ts('edit system workflow message templates'),
849 ],
850 'edit user-driven message templates' => [
851 $prefix . ts('edit user-driven message templates'),
852 ],
853 'view my invoices' => [
854 $prefix . ts('view my invoices'),
855 ts('Allow users to view/ download their own invoices'),
856 ],
857 'edit api keys' => [
858 $prefix . ts('edit api keys'),
859 ts('Edit API keys'),
860 ],
861 'edit own api keys' => [
862 $prefix . ts('edit own api keys'),
863 ts('Edit user\'s own API keys'),
864 ],
865 'send SMS' => [
866 $prefix . ts('send SMS'),
867 ts('Send an SMS'),
868 ],
869 'administer CiviCRM system' => [
870 'label' => $prefix . ts('administer CiviCRM System'),
871 'description' => ts('Perform all system administration tasks in CiviCRM'),
872 ],
873 'administer CiviCRM data' => [
874 'label' => $prefix . ts('administer CiviCRM Data'),
875 'description' => ts('Permit altering all restricted data options'),
876 ],
877 'all CiviCRM permissions and ACLs' => [
878 'label' => $prefix . ts('all CiviCRM permissions and ACLs'),
879 'description' => ts('Administer and use CiviCRM bypassing any other permission or ACL checks and enabling the creation of displays and forms that allow others to bypass checks. This permission should be given out with care'),
880 ],
881 ];
882 if (self::isMultisiteEnabled()) {
883 // This could arguably be moved to the multisite extension but
884 // within core it does permit editing group-organization records.
885 $permissions['administer Multiple Organizations'] = [
886 'label' => $prefix . ts('administer Multiple Organizations'),
887 'description' => ts('Administer multiple organizations. In practice this allows editing the group organization link'),
888 ];
889 }
890 return $permissions;
891 }
892
893 /**
894 * Get permissions implied by 'superset' permissions.
895 *
896 * @return array
897 */
898 public static function getImpliedAdminPermissions(): array {
899 return [
900 'administer CiviCRM' => ['implied_permissions' => ['administer CiviCRM system', 'administer CiviCRM data']],
901 'administer CiviCRM data' => ['implied_permissions' => ['edit message templates', 'administer dedupe rules']],
902 'administer CiviCRM system' => ['implied_permissions' => ['edit system workflow message templates']],
903 ];
904 }
905
906 /**
907 * Get any super-permissions that imply the given permission.
908 *
909 * @param string $permission
910 *
911 * @return array
912 */
913 public static function getImpliedPermissionsFor(string $permission): array {
914 $implied = Civi::cache('metadata')->get('implied_permissions', []);
915 if (isset($implied[$permission])) {
916 return $implied[$permission];
917 }
918 $implied[$permission] = [];
919 foreach (self::basicPermissions(FALSE, TRUE) as $key => $details) {
920 if (in_array($permission, $details['implied_permissions'] ?? [], TRUE)) {
921 $implied[$permission][] = $key;
922 }
923 }
924 Civi::cache('metadata')->set('implied_permissions', $implied);
925 return $implied[$permission];
926 }
927
928 /**
929 * For each entity provides an array of permissions required for each action
930 *
931 * The action is the array key, possible values:
932 * * create: applies to create (with no id in params)
933 * * update: applies to update, setvalue, create (with id in params)
934 * * get: applies to getcount, getsingle, getvalue and other gets
935 * * delete: applies to delete, replace
936 * * meta: applies to getfields, getoptions, getspec
937 * * default: catch-all for anything not declared
938 *
939 * Note: some APIs declare other actions as well
940 *
941 * Permissions should use arrays for AND and arrays of arrays for OR
942 * @see CRM_Core_Permission::check
943 *
944 * @return array of permissions
945 */
946 public static function getEntityActionPermissions() {
947 $permissions = [];
948 // These are the default permissions - if any entity does not declare permissions for a given action,
949 // (or the entity does not declare permissions at all) - then the action will be used from here
950 $permissions['default'] = [
951 // applies to getfields, getoptions, etc.
952 'meta' => ['access CiviCRM'],
953 // catch-all, applies to create, get, delete, etc.
954 // If an entity declares it's own 'default' action it will override this one
955 'default' => ['administer CiviCRM'],
956 ];
957
958 // Note: Additional permissions in DynamicFKAuthorization
959 $permissions['attachment'] = [
960 'default' => [
961 ['access CiviCRM', 'access AJAX API'],
962 ],
963 ];
964
965 // Contact permissions
966 $permissions['contact'] = [
967 'create' => [
968 'access CiviCRM',
969 'add contacts',
970 ],
971 'delete' => [
972 'access CiviCRM',
973 'delete contacts',
974 ],
975 // managed by query object
976 'get' => [],
977 // managed by _civicrm_api3_check_edit_permissions
978 'update' => [],
979 'getquick' => [
980 ['access CiviCRM', 'access AJAX API'],
981 ],
982 'duplicatecheck' => [
983 'access CiviCRM',
984 ],
985 'merge' => ['merge duplicate contacts'],
986 ];
987
988 $permissions['dedupe'] = [
989 'getduplicates' => ['access CiviCRM'],
990 'getstatistics' => ['access CiviCRM'],
991 ];
992
993 // CRM-16963 - Permissions for country.
994 $permissions['country'] = [
995 'get' => [
996 'access CiviCRM',
997 ],
998 'default' => [
999 'administer CiviCRM',
1000 ],
1001 ];
1002
1003 // Contact-related data permissions.
1004 $permissions['address'] = [
1005 // get is managed by BAO::addSelectWhereClause
1006 // create/delete are managed by _civicrm_api3_check_edit_permissions
1007 'default' => [],
1008 ];
1009 $permissions['email'] = $permissions['address'];
1010 $permissions['phone'] = $permissions['address'];
1011 $permissions['website'] = $permissions['address'];
1012 $permissions['im'] = $permissions['address'];
1013 $permissions['open_i_d'] = $permissions['address'];
1014
1015 // Also managed by ACLs - CRM-19448
1016 $permissions['entity_tag'] = ['default' => []];
1017 $permissions['note'] = $permissions['entity_tag'];
1018
1019 // Allow non-admins to get and create tags to support tagset widget
1020 // Delete is still reserved for admins
1021 $permissions['tag'] = [
1022 'get' => ['access CiviCRM'],
1023 'create' => ['access CiviCRM'],
1024 'update' => ['access CiviCRM'],
1025 ];
1026
1027 //relationship permissions
1028 $permissions['relationship'] = [
1029 // get is managed by BAO::addSelectWhereClause
1030 'get' => [],
1031 'delete' => [
1032 'access CiviCRM',
1033 'edit all contacts',
1034 ],
1035 'default' => [
1036 'access CiviCRM',
1037 'edit all contacts',
1038 ],
1039 ];
1040
1041 // CRM-17741 - Permissions for RelationshipType.
1042 $permissions['relationship_type'] = [
1043 'get' => [
1044 'access CiviCRM',
1045 ],
1046 'default' => [
1047 'administer CiviCRM',
1048 ],
1049 ];
1050
1051 // Activity permissions
1052 $permissions['activity'] = [
1053 'delete' => [
1054 'access CiviCRM',
1055 'delete activities',
1056 ],
1057 'get' => [
1058 'access CiviCRM',
1059 // Note that view all activities is also required within the api
1060 // if the id is not passed in. Where the id is passed in the activity
1061 // specific check functions are used and tested.
1062 ],
1063 'default' => [
1064 'access CiviCRM',
1065 'view all activities',
1066 ],
1067 ];
1068 $permissions['activity_contact'] = $permissions['activity'];
1069
1070 // Case permissions
1071 $permissions['case'] = [
1072 'create' => [
1073 'access CiviCRM',
1074 'add cases',
1075 ],
1076 'delete' => [
1077 'access CiviCRM',
1078 'delete in CiviCase',
1079 ],
1080 'restore' => [
1081 'administer CiviCase',
1082 ],
1083 'merge' => [
1084 'administer CiviCase',
1085 ],
1086 'default' => [
1087 // At minimum the user needs one of the following. Finer-grained access is controlled by CRM_Case_BAO_Case::addSelectWhereClause
1088 ['access my cases and activities', 'access all cases and activities'],
1089 ],
1090 ];
1091 $permissions['case_contact'] = $permissions['case'];
1092
1093 $permissions['case_type'] = [
1094 'default' => ['administer CiviCase'],
1095 'get' => [
1096 // nested array = OR
1097 ['access my cases and activities', 'access all cases and activities'],
1098 ],
1099 ];
1100
1101 // Campaign permissions
1102 $permissions['campaign'] = [
1103 'get' => ['access CiviCRM'],
1104 'default' => [
1105 // nested array = OR
1106 ['administer CiviCampaign', 'manage campaign'],
1107 ],
1108 ];
1109 $permissions['survey'] = $permissions['campaign'];
1110
1111 // Financial permissions
1112 $permissions['contribution'] = [
1113 'get' => [
1114 'access CiviCRM',
1115 'access CiviContribute',
1116 ],
1117 'delete' => [
1118 'access CiviCRM',
1119 'access CiviContribute',
1120 'delete in CiviContribute',
1121 ],
1122 'completetransaction' => [
1123 'edit contributions',
1124 ],
1125 'default' => [
1126 'access CiviCRM',
1127 'access CiviContribute',
1128 'edit contributions',
1129 ],
1130 ];
1131 $permissions['line_item'] = $permissions['contribution'];
1132
1133 // Payment permissions
1134 $permissions['payment'] = [
1135 'get' => [
1136 'access CiviCRM',
1137 'access CiviContribute',
1138 ],
1139 'delete' => [
1140 'access CiviCRM',
1141 'access CiviContribute',
1142 'delete in CiviContribute',
1143 ],
1144 'cancel' => [
1145 'access CiviCRM',
1146 'access CiviContribute',
1147 'edit contributions',
1148 ],
1149 'create' => [
1150 'access CiviCRM',
1151 'access CiviContribute',
1152 'edit contributions',
1153 ],
1154 'default' => [
1155 'access CiviCRM',
1156 'access CiviContribute',
1157 'edit contributions',
1158 ],
1159 ];
1160 $permissions['contribution_recur'] = $permissions['payment'];
1161
1162 // Custom field permissions
1163 $permissions['custom_field'] = [
1164 'default' => [
1165 'administer CiviCRM',
1166 'access all custom data',
1167 ],
1168 ];
1169 $permissions['custom_group'] = $permissions['custom_field'];
1170
1171 // Event permissions
1172 $permissions['event'] = [
1173 'create' => [
1174 'access CiviCRM',
1175 'access CiviEvent',
1176 'edit all events',
1177 ],
1178 'delete' => [
1179 'access CiviCRM',
1180 'access CiviEvent',
1181 'delete in CiviEvent',
1182 ],
1183 'get' => [
1184 'access CiviCRM',
1185 'access CiviEvent',
1186 'view event info',
1187 ],
1188 'update' => [
1189 'access CiviCRM',
1190 'access CiviEvent',
1191 'edit all events',
1192 ],
1193 ];
1194 // Exception refers to dedupe_exception.
1195 $permissions['exception'] = [
1196 'default' => ['merge duplicate contacts'],
1197 ];
1198
1199 $permissions['job'] = [
1200 'process_batch_merge' => ['merge duplicate contacts'],
1201 ];
1202 $permissions['rule_group']['get'] = [['merge duplicate contacts', 'administer CiviCRM']];
1203 // Loc block is only used for events
1204 $permissions['loc_block'] = $permissions['event'];
1205
1206 $permissions['state_province'] = [
1207 'get' => [
1208 'access CiviCRM',
1209 ],
1210 ];
1211
1212 // Price sets are shared by several components, user needs access to at least one of them
1213 $permissions['price_set'] = [
1214 'default' => [
1215 ['access CiviEvent', 'access CiviContribute', 'access CiviMember'],
1216 ],
1217 'get' => [
1218 ['access CiviCRM', 'view event info', 'make online contributions'],
1219 ],
1220 ];
1221
1222 // File permissions
1223 $permissions['file'] = [
1224 'default' => [
1225 'access CiviCRM',
1226 'access uploaded files',
1227 ],
1228 ];
1229 $permissions['files_by_entity'] = $permissions['file'];
1230
1231 // Group permissions
1232 $permissions['group'] = [
1233 'get' => [
1234 'access CiviCRM',
1235 ],
1236 'default' => [
1237 'access CiviCRM',
1238 'edit groups',
1239 ],
1240 ];
1241
1242 $permissions['group_nesting'] = $permissions['group'];
1243 $permissions['group_organization'] = $permissions['group'];
1244
1245 //Group Contact permission
1246 $permissions['group_contact'] = [
1247 'get' => [
1248 'access CiviCRM',
1249 ],
1250 'default' => [
1251 'access CiviCRM',
1252 'edit all contacts',
1253 ],
1254 ];
1255
1256 // CiviMail Permissions
1257 $civiMailBasePerms = [
1258 // To get/preview/update, one must have least one of these perms:
1259 // Mailing API implementations enforce nuances of create/approve/schedule permissions.
1260 'access CiviMail',
1261 'create mailings',
1262 'schedule mailings',
1263 'approve mailings',
1264 ];
1265 $permissions['mailing'] = [
1266 'get' => [
1267 'access CiviCRM',
1268 $civiMailBasePerms,
1269 ],
1270 'delete' => [
1271 'access CiviCRM',
1272 $civiMailBasePerms,
1273 'delete in CiviMail',
1274 ],
1275 'submit' => [
1276 'access CiviCRM',
1277 ['access CiviMail', 'schedule mailings'],
1278 ],
1279 'default' => [
1280 'access CiviCRM',
1281 $civiMailBasePerms,
1282 ],
1283 ];
1284 $permissions['mailing_group'] = $permissions['mailing'];
1285 $permissions['mailing_job'] = $permissions['mailing'];
1286 $permissions['mailing_recipients'] = $permissions['mailing'];
1287
1288 $permissions['mailing_a_b'] = [
1289 'get' => [
1290 'access CiviCRM',
1291 'access CiviMail',
1292 ],
1293 'delete' => [
1294 'access CiviCRM',
1295 'access CiviMail',
1296 'delete in CiviMail',
1297 ],
1298 'submit' => [
1299 'access CiviCRM',
1300 ['access CiviMail', 'schedule mailings'],
1301 ],
1302 'default' => [
1303 'access CiviCRM',
1304 'access CiviMail',
1305 ],
1306 ];
1307
1308 // Membership permissions
1309 $permissions['membership'] = [
1310 'get' => [
1311 'access CiviCRM',
1312 'access CiviMember',
1313 ],
1314 'delete' => [
1315 'access CiviCRM',
1316 'access CiviMember',
1317 'delete in CiviMember',
1318 ],
1319 'default' => [
1320 'access CiviCRM',
1321 'access CiviMember',
1322 'edit memberships',
1323 ],
1324 ];
1325 $permissions['membership_status'] = $permissions['membership'];
1326 $permissions['membership_type'] = $permissions['membership'];
1327 $permissions['membership_payment'] = [
1328 'create' => [
1329 'access CiviCRM',
1330 'access CiviMember',
1331 'edit memberships',
1332 'access CiviContribute',
1333 'edit contributions',
1334 ],
1335 'delete' => [
1336 'access CiviCRM',
1337 'access CiviMember',
1338 'delete in CiviMember',
1339 'access CiviContribute',
1340 'delete in CiviContribute',
1341 ],
1342 'get' => [
1343 'access CiviCRM',
1344 'access CiviMember',
1345 'access CiviContribute',
1346 ],
1347 'update' => [
1348 'access CiviCRM',
1349 'access CiviMember',
1350 'edit memberships',
1351 'access CiviContribute',
1352 'edit contributions',
1353 ],
1354 ];
1355
1356 // Participant permissions
1357 $permissions['participant'] = [
1358 'create' => [
1359 'access CiviCRM',
1360 'access CiviEvent',
1361 'register for events',
1362 ],
1363 'delete' => [
1364 'access CiviCRM',
1365 'access CiviEvent',
1366 'edit event participants',
1367 ],
1368 'get' => [
1369 'access CiviCRM',
1370 'access CiviEvent',
1371 'view event participants',
1372 ],
1373 'update' => [
1374 'access CiviCRM',
1375 'access CiviEvent',
1376 'edit event participants',
1377 ],
1378 ];
1379 $permissions['participant_payment'] = [
1380 'create' => [
1381 'access CiviCRM',
1382 'access CiviEvent',
1383 'register for events',
1384 'access CiviContribute',
1385 'edit contributions',
1386 ],
1387 'delete' => [
1388 'access CiviCRM',
1389 'access CiviEvent',
1390 'edit event participants',
1391 'access CiviContribute',
1392 'delete in CiviContribute',
1393 ],
1394 'get' => [
1395 'access CiviCRM',
1396 'access CiviEvent',
1397 'view event participants',
1398 'access CiviContribute',
1399 ],
1400 'update' => [
1401 'access CiviCRM',
1402 'access CiviEvent',
1403 'edit event participants',
1404 'access CiviContribute',
1405 'edit contributions',
1406 ],
1407 ];
1408
1409 // Pledge permissions
1410 $permissions['pledge'] = [
1411 'create' => [
1412 'access CiviCRM',
1413 'access CiviPledge',
1414 'edit pledges',
1415 ],
1416 'delete' => [
1417 'access CiviCRM',
1418 'access CiviPledge',
1419 'delete in CiviPledge',
1420 ],
1421 'get' => [
1422 'access CiviCRM',
1423 'access CiviPledge',
1424 ],
1425 'update' => [
1426 'access CiviCRM',
1427 'access CiviPledge',
1428 'edit pledges',
1429 ],
1430 ];
1431
1432 //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission.
1433 $permissions['action_schedule'] = [
1434 'update' => [
1435 [
1436 'access CiviCRM',
1437 'edit all events',
1438 ],
1439 ],
1440 ];
1441
1442 $permissions['pledge_payment'] = [
1443 'create' => [
1444 'access CiviCRM',
1445 'access CiviPledge',
1446 'edit pledges',
1447 'access CiviContribute',
1448 'edit contributions',
1449 ],
1450 'delete' => [
1451 'access CiviCRM',
1452 'access CiviPledge',
1453 'delete in CiviPledge',
1454 'access CiviContribute',
1455 'delete in CiviContribute',
1456 ],
1457 'get' => [
1458 'access CiviCRM',
1459 'access CiviPledge',
1460 'access CiviContribute',
1461 ],
1462 'update' => [
1463 'access CiviCRM',
1464 'access CiviPledge',
1465 'edit pledges',
1466 'access CiviContribute',
1467 'edit contributions',
1468 ],
1469 ];
1470
1471 // Dashboard permissions
1472 $permissions['dashboard'] = [
1473 'get' => [
1474 'access CiviCRM',
1475 ],
1476 ];
1477 $permissions['dashboard_contact'] = [
1478 'default' => [
1479 'access CiviCRM',
1480 ],
1481 ];
1482
1483 // Profile permissions
1484 $permissions['profile'] = [
1485 // the profile will take care of this
1486 'get' => [],
1487 ];
1488
1489 $permissions['uf_group'] = [
1490 'create' => [
1491 'access CiviCRM',
1492 [
1493 'administer CiviCRM',
1494 'manage event profiles',
1495 ],
1496 ],
1497 'get' => [
1498 'access CiviCRM',
1499 ],
1500 'update' => [
1501 'access CiviCRM',
1502 [
1503 'administer CiviCRM',
1504 'manage event profiles',
1505 ],
1506 ],
1507 ];
1508 $permissions['uf_field'] = $permissions['uf_join'] = $permissions['uf_group'];
1509 $permissions['uf_field']['delete'] = [
1510 'access CiviCRM',
1511 [
1512 'administer CiviCRM',
1513 'manage event profiles',
1514 ],
1515 ];
1516 $permissions['option_value'] = $permissions['uf_group'];
1517 $permissions['option_group'] = $permissions['option_value'];
1518
1519 $permissions['custom_value'] = [
1520 'gettree' => ['access CiviCRM'],
1521 ];
1522
1523 $permissions['message_template'] = [
1524 'get' => ['access CiviCRM'],
1525 'create' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']],
1526 'update' => [['edit message templates', 'edit user-driven message templates', 'edit system workflow message templates']],
1527 ];
1528
1529 $permissions['report_template']['update'] = 'save Report Criteria';
1530 $permissions['report_template']['create'] = 'save Report Criteria';
1531 return $permissions;
1532 }
1533
1534 /**
1535 * Translate an unknown action to a canonical form.
1536 *
1537 * @param string $action
1538 *
1539 * @return string
1540 * the standardised action name
1541 */
1542 public static function getGenericAction($action) {
1543 $snippet = substr($action, 0, 3);
1544 if ($action == 'replace' || $snippet == 'del') {
1545 // 'Replace' is a combination of get+create+update+delete; however, the permissions
1546 // on each of those will be tested separately at runtime. This is just a sniff-test
1547 // based on the heuristic that 'delete' tends to be the most closely guarded
1548 // of the necessary permissions.
1549 $action = 'delete';
1550 }
1551 elseif ($action == 'setvalue' || $snippet == 'upd') {
1552 $action = 'update';
1553 }
1554 elseif ($action == 'getfields' || $action == 'getfield' || $action == 'getspec' || $action == 'getoptions') {
1555 $action = 'meta';
1556 }
1557 elseif ($snippet == 'get') {
1558 $action = 'get';
1559 }
1560 return $action;
1561 }
1562
1563 /**
1564 * Validate user permission across.
1565 * edit or view or with supportable acls.
1566 *
1567 * @return bool
1568 */
1569 public static function giveMeAllACLs() {
1570 if (CRM_Core_Permission::check('view all contacts') ||
1571 CRM_Core_Permission::check('edit all contacts')
1572 ) {
1573 return TRUE;
1574 }
1575
1576 $session = CRM_Core_Session::singleton();
1577 $contactID = $session->get('userID');
1578
1579 //check for acl.
1580 $aclPermission = self::getPermission();
1581 if (in_array($aclPermission, [
1582 CRM_Core_Permission::EDIT,
1583 CRM_Core_Permission::VIEW,
1584 ])
1585 ) {
1586 return TRUE;
1587 }
1588
1589 // run acl where hook and see if the user is supplying an ACL clause
1590 // that is not false
1591 $tables = $whereTables = [];
1592 $where = NULL;
1593
1594 CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW,
1595 $tables, $whereTables,
1596 $contactID, $where
1597 );
1598 return empty($whereTables) ? FALSE : TRUE;
1599 }
1600
1601 /**
1602 * Get component name from given permission.
1603 *
1604 * @param string $permission
1605 *
1606 * @return null|string
1607 * the name of component.
1608 */
1609 public static function getComponentName($permission) {
1610 $componentName = NULL;
1611 $permission = trim($permission);
1612 if (empty($permission)) {
1613 return $componentName;
1614 }
1615
1616 static $allCompPermissions = [];
1617 if (empty($allCompPermissions)) {
1618 $components = CRM_Core_Component::getComponents();
1619 foreach ($components as $name => $comp) {
1620 //get all permissions of each components unconditionally
1621 $allCompPermissions[$name] = $comp->getPermissions(TRUE);
1622 }
1623 }
1624
1625 if (is_array($allCompPermissions)) {
1626 foreach ($allCompPermissions as $name => $permissions) {
1627 if (array_key_exists($permission, $permissions)) {
1628 $componentName = $name;
1629 break;
1630 }
1631 }
1632 }
1633
1634 return $componentName;
1635 }
1636
1637 /**
1638 * Get all the contact emails for users that have a specific permission.
1639 *
1640 * @param string $permissionName
1641 * Name of the permission we are interested in.
1642 *
1643 * @return string
1644 * a comma separated list of email addresses
1645 */
1646 public static function permissionEmails($permissionName) {
1647 $config = CRM_Core_Config::singleton();
1648 return $config->userPermissionClass->permissionEmails($permissionName);
1649 }
1650
1651 /**
1652 * Get all the contact emails for users that have a specific role.
1653 *
1654 * @param string $roleName
1655 * Name of the role we are interested in.
1656 *
1657 * @return string
1658 * a comma separated list of email addresses
1659 */
1660 public static function roleEmails($roleName) {
1661 $config = CRM_Core_Config::singleton();
1662 return $config->userRoleClass->roleEmails($roleName);
1663 }
1664
1665 /**
1666 * @return bool
1667 */
1668 public static function isMultisiteEnabled() {
1669 return (bool) Civi::settings()->get('is_enabled');
1670 }
1671
1672 /**
1673 * Verify if the user has permission to get the invoice.
1674 *
1675 * @return bool
1676 * TRUE if the user has download all invoices permission or download my
1677 * invoices permission and the invoice author is the current user.
1678 */
1679 public static function checkDownloadInvoice() {
1680 $cid = CRM_Core_Session::getLoggedInContactID();
1681 if (CRM_Core_Permission::check('access CiviContribute') ||
1682 (CRM_Core_Permission::check('view my invoices') && $_GET['cid'] == $cid)
1683 ) {
1684 return TRUE;
1685 }
1686 return FALSE;
1687 }
1688
1689 /**
1690 * Get permissions for components.
1691 *
1692 * @param bool $includeDisabled
1693 *
1694 * @return array
1695 * @throws \CRM_Core_Exception
1696 */
1697 protected static function getComponentPermissions(bool $includeDisabled): array {
1698 if (!$includeDisabled) {
1699 $components = CRM_Core_Component::getEnabledComponents();
1700 }
1701 else {
1702 $components = CRM_Core_Component::getComponents();
1703 }
1704
1705 $permissions = [];
1706 foreach ($components as $comp) {
1707 $perm = $comp->getPermissions($includeDisabled, TRUE);
1708 if ($perm) {
1709 $info = $comp->getInfo();
1710 foreach ($perm as $p => $attr) {
1711
1712 if (!is_array($attr)) {
1713 $attr = [$attr];
1714 }
1715
1716 $attr[0] = $info['translatedName'] . ': ' . $attr[0];
1717 $permissions[$p] = $attr;
1718 }
1719 }
1720 }
1721 return $permissions;
1722 }
1723
1724 /**
1725 * Get permissions for core functionality and for that of core components.
1726 *
1727 * @param bool $all
1728 *
1729 * @return array
1730 * @throws \CRM_Core_Exception
1731 */
1732 protected static function getCoreAndComponentPermissions(bool $all): array {
1733 $permissions = self::getCorePermissions();
1734 $permissions = array_merge($permissions, self::getComponentPermissions($all));
1735 $permissions['all CiviCRM permissions and ACLs']['implied_permissions'] = array_keys($permissions);
1736 return $permissions;
1737 }
1738
1739 }