Merge pull request #6202 from jitendrapurohit/CRM-16823

[civicrm-core.git] / Civi / API / Subscriber / PermissionCheck.php

diff --git a/Civi/API/Subscriber/PermissionCheck.php b/Civi/API/Subscriber/PermissionCheck.php
index 184a8305b98ba2c44c038b765cbde0f4a213af99..0b39d1d1fcd5db5b7a0c7999f1d19133219b7236 100644 (file)
--- a/Civi/API/Subscriber/PermissionCheck.php
+++ b/Civi/API/Subscriber/PermissionCheck.php
@@ -88,8 +88,10 @@ class PermissionCheck implements EventSubscriberInterface {
   }
 
   /**
-   * check API for ACL permission.
-   * @param $apiRequest
+   * Check API for ACL permission.
+   *
+   * @param array $apiRequest
+   *
    * @return bool
    */
   public function checkACLPermission($apiRequest) {
@@ -104,6 +106,17 @@ class PermissionCheck implements EventSubscriberInterface {
           return TRUE;
         }
         break;
+
+      //CRM-16777: Disable schedule reminder with ACLs.
+      case 'ActionSchedule':
+        $events = \CRM_Event_BAO_Event::getEvents();
+        $aclEdit = \CRM_ACL_API::group(\CRM_Core_Permission::EDIT, NULL, 'civicrm_event', $events);
+        $param = array('id' => $apiRequest['params']['id']);
+        $eventId = \CRM_Core_BAO_ActionSchedule::retrieve($param, $value = array());
+        if (in_array($eventId->entity_value, $aclEdit)) {
+          return TRUE;
+        }
+        break;
     }
 
     return FALSE;