Merge pull request #19800 from eileenmcnaughton/gettypes

[civicrm-core.git] / CRM / Contact / BAO / DashboardContact.php

diff --git a/CRM/Contact/BAO/DashboardContact.php b/CRM/Contact/BAO/DashboardContact.php
index b9b728fa942341193eaf9f49ffeace1f4a405564..145494860b58e8a8f0fcba5666da31a149cdc117 100644 (file)
--- a/CRM/Contact/BAO/DashboardContact.php
+++ b/CRM/Contact/BAO/DashboardContact.php
@@ -14,4 +14,42 @@
  * @copyright CiviCRM LLC https://civicrm.org/licensing
  */
 class CRM_Contact_BAO_DashboardContact extends CRM_Contact_DAO_DashboardContact {
+
+  /**
+   * @param array $record
+   *
+   * @return CRM_Contact_DAO_DashboardContact
+   * @throws \CRM_Core_Exception
+   */
+  public static function writeRecord(array $record): CRM_Core_DAO {
+    self::checkEditPermission($record);
+    return parent::writeRecord($record);
+  }
+
+  /**
+   * @param array $record
+   * @return CRM_Contact_DAO_DashboardContact
+   * @throws CRM_Core_Exception
+   */
+  public static function deleteRecord(array $record) {
+    self::checkEditPermission($record);
+    return parent::deleteRecord($record);
+  }
+
+  /**
+   * Ensure that the current user has permission to create/edit/delete a DashboardContact record
+   *
+   * @param array $record
+   * @throws CRM_Core_Exception
+   * @throws \Civi\API\Exception\UnauthorizedException
+   */
+  public static function checkEditPermission(array $record) {
+    if (!empty($record['check_permissions']) && !CRM_Core_Permission::check('administer CiviCRM')) {
+      $cid = !empty($record['id']) ? self::getFieldValue(parent::class, $record['id'], 'contact_id') : $record['contact_id'];
+      if ($cid != CRM_Core_Session::getLoggedInContactID()) {
+        throw new \Civi\API\Exception\UnauthorizedException('You do not have permission to edit the dashboard for this contact.');
+      }
+    }
+  }
+
 }