3 +--------------------------------------------------------------------+
5 +--------------------------------------------------------------------+
6 | Copyright CiviCRM LLC (c) 2004-2020 |
7 +--------------------------------------------------------------------+
8 | This file is a part of CiviCRM. |
10 | CiviCRM is free software; you can copy, modify, and distribute it |
11 | under the terms of the GNU Affero General Public License |
12 | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. |
14 | CiviCRM is distributed in the hope that it will be useful, but |
15 | WITHOUT ANY WARRANTY; without even the implied warranty of |
16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
17 | See the GNU Affero General Public License for more details. |
19 | You should have received a copy of the GNU Affero General Public |
20 | License and the CiviCRM Licensing Exception along |
21 | with this program; if not, contact CiviCRM LLC |
22 | at info[AT]civicrm[DOT]org. If you have questions about the |
23 | GNU Affero General Public License or the licensing of CiviCRM, |
24 | see the CiviCRM license FAQ at http://civicrm.org/licensing |
25 +--------------------------------------------------------------------+
29 * Test APIv3 civicrm_entity_tag_* functions
31 * @package CiviCRM_APIv3
32 * @subpackage API_Core
36 * Class api_v3_EntityTagTest.
38 * This test class was introduced to ensure that the fix for CRM-17350 (reducing the required permission
39 * from edit all contacts to has right to edit this contact) would not result in inappropriate permission opening on
40 * other entities. Other entities are still too restricted but that is a larger job.
43 class api_v3_EntityTagACLTest
extends CiviUnitTestCase
{
45 use CRMTraits_ACL_PermissionTrait
;
52 protected $_apiversion = 3;
55 * Entity being tested.
59 protected $_entity = 'entity_tag';
62 * Set up permissions for test.
64 public function setUp() {
65 $this->useTransaction(TRUE);
67 $individualID = $this->individualCreate();
68 $daoObj = new CRM_Core_DAO();
69 $this->callAPISuccess('Attachment', 'create', [
70 'entity_table' => 'civicrm_contact',
71 'entity_id' => $individualID,
76 $daoObj->createTestObject('CRM_Activity_BAO_Activity', [], 1, 0);
77 $daoObj->createTestObject('CRM_Case_BAO_Case', [], 1, 0);
78 $entities = $this->getTagOptions();
79 foreach ($entities as $key => $entity) {
80 $this->callAPISuccess('Tag', 'create', [
83 'description' => $entity,
86 CRM_Core_Config
::singleton()->userPermissionClass
->permissions
= ['access CiviCRM'];
90 * Get the options for the used_for fields.
94 public function getTagOptions() {
95 $options = $this->callAPISuccess('Tag', 'getoptions', ['field' => 'used_for']);
96 return $options['values'];
100 * Get the entity table for a tag label.
102 * @param string $entity
106 protected function getTableForTag($entity) {
107 $options = $this->getTagOptions();
108 return array_search($entity, $options);
112 * Get entities which can be tagged in data provider format.
114 public function taggableEntities() {
116 foreach ($this->getTagOptions() as $entity) {
117 $return[] = [$entity];
123 * This test checks that users with edit all contacts can edit all tags.
125 * @dataProvider taggableEntities
127 * We are looking to see that a contact with edit all contacts can still add all tags (for all
128 * tag entities since that was how it was historically and we are not fixing non-contact entities).
130 * @param string $entity
133 public function testThatForEntitiesEditAllContactsCanAddTags($entity) {
135 CRM_Core_Config
::singleton()->userPermissionClass
->permissions
= ['edit all contacts', 'access CiviCRM'];
136 $this->callAPISuccess('EntityTag', 'create', [
139 'check_permissions' => TRUE,
140 'entity_table' => $this->getTableForTag($entity),
142 $this->callAPISuccessGetCount('EntityTag', [
144 'entity_table' => $this->getTableForTag($entity),
149 * This test checks that an ACL or edit all contacts is required to be able to create a contact.
151 * @dataProvider taggableEntities
153 public function testThatForEntityWithoutACLOrEditAllThereIsNoAccess($entity) {
155 CRM_Core_Config
::singleton()->userPermissionClass
->permissions
= ['access CiviCRM', 'view all contacts'];
156 $this->callAPIFailure('EntityTag', 'create', [
159 'check_permissions' => TRUE,
160 'entity_table' => $this->getTableForTag($entity),
165 * This test checks that permissions are not applied when check_permissions is off.
167 * @dataProvider taggableEntities
169 * @param string $entity
172 public function testCheckPermissionsOffWorks($entity) {
174 CRM_Core_Config
::singleton()->userPermissionClass
->permissions
= ['access CiviCRM', 'view all contacts'];
175 $result = $this->callAPISuccess('EntityTag', 'create', [
178 'check_permissions' => 0,
179 'entity_table' => $this->getTableForTag($entity),
181 $this->assertEquals(1, $result['added']);
182 $this->callAPISuccessGetCount('EntityTag', [
184 'entity_table' => $this->getTableForTag($entity),
185 'check_permissions' => 0,
190 * This test checks ACLs can be used to control who can edit a contact.
192 * Note that for other entities this hook will not allow them to edit the entity_tag and they still need
193 * edit all contacts (pending a more extensive fix).
195 * @dataProvider taggableEntities
197 * @param string $entity
200 public function testThatForEntitiesACLApplies($entity) {
202 CRM_Core_Config
::singleton()->userPermissionClass
->permissions
= ['access CiviCRM', 'view all contacts'];
203 $this->hookClass
->setHook('civicrm_aclWhereClause', [$this, 'aclWhereHookAllResults']);
204 civicrm_api('EntityTag', 'create', [
208 'entity_table' => $this->getTableForTag($entity),
209 'check_permissions' => TRUE,
211 $this->callAPISuccessGetCount('EntityTag', [
213 'entity_table' => $this->getTableForTag($entity),
214 ], ($entity == 'Contacts' ?
1 : 0));