Civi/API/Subscriber/PermissionCheck.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.6                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2014                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26 */
  27
  28 namespace Civi\API\Subscriber;
  29 use Civi\API\Events;
  30 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  31
  32 /**
  33  * For any API requests that correspond to a Doctrine entity
  34  * ($apiRequest['doctrineClass']), check permissions specified in
  35  * Civi\API\Annotation\Permission.
  36  */
  37 class PermissionCheck implements EventSubscriberInterface {
  38   /**
  39    * @return array
  40    */
  41   public static function getSubscribedEvents() {
  42     return array(
  43       Events::AUTHORIZE => array(
  44         array('onApiAuthorize', Events::W_LATE),
  45       ),
  46     );
  47   }
  48
  49   /**
  50    * @param \Civi\API\Event\AuthorizeEvent $event
  51    *   API authorization event.
  52    *
  53    * @throws \Civi\API\Exception\UnauthorizedException
  54    */
  55   public function onApiAuthorize(\Civi\API\Event\AuthorizeEvent $event) {
  56     $apiRequest = $event->getApiRequest();
  57     if ($apiRequest['version'] < 4) {
  58       // return early unless we’re told explicitly to do the permission check
  59       if (empty($apiRequest['params']['check_permissions']) or $apiRequest['params']['check_permissions'] == FALSE) {
  60         $event->authorize();
  61         $event->stopPropagation();
  62         return;
  63       }
  64
  65       require_once 'CRM/Core/DAO/permissions.php';
  66       $permissions = _civicrm_api3_permissions($apiRequest['entity'], $apiRequest['action'], $apiRequest['params']);
  67
  68       // $params might’ve been reset by the alterAPIPermissions() hook
  69       if (isset($apiRequest['params']['check_permissions']) and $apiRequest['params']['check_permissions'] == FALSE) {
  70         $event->authorize();
  71         $event->stopPropagation();
  72         return;
  73       }
  74
  75       if (!\CRM_Core_Permission::check($permissions)) {
  76         if (is_array($permissions)) {
  77           $permissions = implode(' and ', $permissions);
  78         }
  79         // FIXME: Generating the exception ourselves allows for detailed error
  80         // but doesn't play well with multiple authz subscribers.
  81         throw new \Civi\API\Exception\UnauthorizedException("API permission check failed for {$apiRequest['entity']}/{$apiRequest['action']} call; insufficient permission: require $permissions");
  82       }
  83
  84       $event->authorize();
  85       $event->stopPropagation();
  86     }
  87   }
  88 }