Civi/API/Subscriber/PermissionCheck.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.4                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2013                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26 */
  27
  28 namespace Civi\API\Subscriber;
  29 use Civi\API\Events;
  30 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  31
  32 /**
  33  * For any API requests that correspond to a Doctrine entity ($apiRequest['doctrineClass']), check
  34  * permissions specified in Civi\API\Annotation\Permission.
  35  */
  36 class PermissionCheck implements EventSubscriberInterface {
  37   /**
  38    * @return array
  39    */
  40   public static function getSubscribedEvents() {
  41     return array(
  42       Events::AUTHORIZE => array(
  43         array('onApiAuthorize', Events::W_LATE),
  44       ),
  45     );
  46   }
  47
  48   /**
  49    * @param \Civi\API\Event\AuthorizeEvent $event
  50    *
  51    * @throws \Civi\API\Exception\UnauthorizedException
  52    */
  53   public function onApiAuthorize(\Civi\API\Event\AuthorizeEvent $event) {
  54     $apiRequest = $event->getApiRequest();
  55     if ($apiRequest['version'] < 4) {
  56       // return early unless we’re told explicitly to do the permission check
  57       if (empty($apiRequest['params']['check_permissions']) or $apiRequest['params']['check_permissions'] == FALSE) {
  58         $event->authorize();
  59         $event->stopPropagation();
  60         return;
  61       }
  62
  63       require_once 'CRM/Core/DAO/permissions.php';
  64       $permissions = _civicrm_api3_permissions($apiRequest['entity'], $apiRequest['action'], $apiRequest['params']);
  65
  66       // $params might’ve been reset by the alterAPIPermissions() hook
  67       if (isset($apiRequest['params']['check_permissions']) and $apiRequest['params']['check_permissions'] == FALSE) {
  68         $event->authorize();
  69         $event->stopPropagation();
  70         return;
  71       }
  72
  73       if (!\CRM_Core_Permission::check($permissions)) {
  74         if (is_array($permissions)) {
  75           $permissions = implode(' and ', $permissions);
  76         }
  77         // FIXME: Generating the exception ourselves allows for detailed error but doesn't play well with multiple authz subscribers.
  78         throw new \Civi\API\Exception\UnauthorizedException("API permission check failed for {$apiRequest['entity']}/{$apiRequest['action']} call; insufficient permission: require $permissions");
  79       }
  80
  81       $event->authorize();
  82       $event->stopPropagation();
  83     }
  84   }
  85 }