Merge pull request #16572 from civicrm/5.23

[civicrm-core.git] / Civi / API / SelectQuery.php

diff --git a/Civi/API/SelectQuery.php b/Civi/API/SelectQuery.php
index 9e98602a0471553fe0dd7142562171f0f24b2e08..d7c6d3f12733f18d2c0ec4b8823137896a8e2bfc 100644 (file)
--- a/Civi/API/SelectQuery.php
+++ b/Civi/API/SelectQuery.php
@@ -217,6 +217,12 @@ abstract class SelectQuery {
         // Join doesn't exist - might be another param with a dot in it for some reason, we'll just ignore it.
         return NULL;
       }
+
+      // Skip if we don't have permission to access this field
+      if ($this->checkPermissions && !empty($fieldInfo['permission']) && !\CRM_Core_Permission::check($fieldInfo['permission'])) {
+        return NULL;
+      }
+
       $fkTable = \CRM_Core_DAO_AllCoreTables::getTableForClass($fkField['FKClassName']);
       $tableAlias = implode('_to_', $subStack) . "_to_$fkTable";