CRM-21473: Add new permission to add contact notes and prevent users without edit...

diff --git a/CRM/Contact/Page/View/Note.php b/CRM/Contact/Page/View/Note.php
index 7eb47d4c2f55bad5e982dad8e4d4bb0898832360..9345343a73bc8862cea2276e452f5d2be8cd19d2 100644 (file)
--- a/CRM/Contact/Page/View/Note.php
+++ b/CRM/Contact/Page/View/Note.php
@@ -94,6 +94,8 @@ class CRM_Contact_Page_View_Note extends CRM_Core_Page {
     }
     $mask = CRM_Core_Action::mask($permissions);
 
+    $this->assign('canAddNotes', CRM_Core_Permission::check('add contact notes'));
+
     $values = array();
     $links = self::links();
     $action = array_sum(array_keys($links)) & $mask;
@@ -212,10 +214,27 @@ class CRM_Contact_Page_View_Note extends CRM_Core_Page {
     if ($this->_action & CRM_Core_Action::VIEW) {
       $this->view();
     }
-    elseif ($this->_action & (CRM_Core_Action::UPDATE | CRM_Core_Action::ADD)) {
+    elseif ($this->_action & CRM_Core_Action::ADD) {
+      if (
+        $this->_permission != CRM_Core_Permission::EDIT &&
+        !CRM_Core_Permission::check('add contact notes')
+        ) {
+        CRM_Core_Error::statusBounce(ts('You do not have access to add notes.'));
+      }
+
+      $this->edit();
+    }
+    elseif ($this->_action & CRM_Core_Action::UPDATE) {
+      if ($this->_permission != CRM_Core_Permission::EDIT) {
+        CRM_Core_Error::statusBounce(ts('You do not have access to edit this note.'));
+      }
+
       $this->edit();
     }
     elseif ($this->_action & CRM_Core_Action::DELETE) {
+      if ($this->_permission != CRM_Core_Permission::EDIT) {
+        CRM_Core_Error::statusBounce(ts('You do not have access to delete this note.'));
+      }
       // we use the edit screen the confirm the delete
       $this->edit();
     }

diff --git a/CRM/Core/Permission.php b/CRM/Core/Permission.php
index d6a1915cb3cda0edcc6f4a649587f054bcb4cb33..e7be11b4a6d5415a24abc5de8d1e02ebde5b7fc8 100644 (file)
--- a/CRM/Core/Permission.php
+++ b/CRM/Core/Permission.php
@@ -806,6 +806,10 @@ class CRM_Core_Permission {
         $prefix . ts('view all notes'),
         ts("View notes (for visible contacts) even if they're marked admin only"),
       ),
+      'add contact notes' => array(
+        $prefix . ts('add contact notes'),
+        ts("Create notes for contacts"),
+      ),
       'access AJAX API' => array(
         $prefix . ts('access AJAX API'),
         ts('Allow API access even if Access CiviCRM is not granted'),

diff --git a/templates/CRM/Contact/Page/View/Note.tpl b/templates/CRM/Contact/Page/View/Note.tpl
index 6d541df88323ad2ec1193c2b4380ea8b972549dc..14b779b575b0ce99081e763673e0db0239491eeb 100644 (file)
--- a/templates/CRM/Contact/Page/View/Note.tpl
+++ b/templates/CRM/Contact/Page/View/Note.tpl
@@ -98,7 +98,7 @@
 
 {/if}
 
-{if $permission EQ 'edit' AND ($action eq 16)}
+{if ($permission EQ 'edit' OR $canAddNotes) AND ($action eq 16)}
    <div class="action-link">
    <a accesskey="N" href="{crmURL p='civicrm/contact/view/note' q="cid=`$contactId`&action=add"}" class="button medium-popup"><span><i class="crm-i fa-comment"></i> {ts}Add Note{/ts}</span></a>
    </div>