Merge pull request #6635 from eileenmcnaughton/comments

[civicrm-core.git] / CRM / ACL / API.php

diff --git a/CRM/ACL/API.php b/CRM/ACL/API.php
index c8434450aa5ba330f4f507bb85cdcbe621cf4410..5a615c170a1692b869568f2edcd2ac840bdc160d 100644 (file)
--- a/CRM/ACL/API.php
+++ b/CRM/ACL/API.php
@@ -116,21 +116,12 @@ class CRM_ACL_API {
       return $deleteClause;
     }
 
-    $user = CRM_Core_Session::getLoggedInContactID();
-    if ($contactID == NULL) {
-      $contactID = $user ? $user : 0;
-    }
-
-    // Check if contact has permissions on self
-    if ($user && $contactID == $user) {
-      if (CRM_Core_Permission::check('edit my contact') ||
-        ($type == self::VIEW && CRM_Core_Permission::check('view my contact'))
-      ) {
-        return ' ( 1 ) ';
-      }
+    if (!$contactID) {
+      $contactID = CRM_Core_Session::getLoggedInContactID();
     }
+    $contactID = (int) $contactID;
 
-    return implode(' AND ',
+    $where = implode(' AND ',
       array(
         CRM_ACL_BAO_ACL::whereClause($type,
           $tables,
@@ -140,6 +131,14 @@ class CRM_ACL_API {
         $deleteClause,
       )
     );
+
+    // Add permission on self
+    if ($contactID && (CRM_Core_Permission::check('edit my contact') ||
+      $type == self::VIEW && CRM_Core_Permission::check('view my contact'))
+    ) {
+      $where = "contact_a.id = $contactID OR ($where)";
+    }
+    return $where;
   }
 
   /**