Fix search display access for non-admin users

Non-admin users should be allowed to view any search display that doesn't have permission checks disabled;
for those displays that disable permission checks, non-admins will only be able to view it if embedded in an afform.

Fixes dev/core#2737

diff --git a/Civi/Api4/SavedSearch.php b/Civi/Api4/SavedSearch.php
index 281de180200c0eff65cca28ec14b9cf0afc90087..ddf6704add3d725c016631d9c46e2d6194d286cc 100644 (file)
--- a/Civi/Api4/SavedSearch.php
+++ b/Civi/Api4/SavedSearch.php
@@ -22,4 +22,10 @@ namespace Civi\Api4;
  */
 class SavedSearch extends Generic\DAOEntity {
 
+  public static function permissions() {
+    $permissions = parent::permissions();
+    $permissions['get'] = ['access CiviCRM'];
+    return $permissions;
+  }
+
 }

diff --git a/ext/search_kit/Civi/Api4/SearchDisplay.php b/ext/search_kit/Civi/Api4/SearchDisplay.php
index 3327eaa36184d13b96baa7f4a2551b0d52aad017..d07d52d6eaaa5dfffa59f86b3e9a2e99c984bb52 100644 (file)
--- a/ext/search_kit/Civi/Api4/SearchDisplay.php
+++ b/ext/search_kit/Civi/Api4/SearchDisplay.php
@@ -32,6 +32,7 @@ class SearchDisplay extends Generic\DAOEntity {
   public static function permissions() {
     $permissions = parent::permissions();
     $permissions['default'] = ['administer CiviCRM data'];
+    $permissions['get'] = ['access CiviCRM'];
     $permissions['getSearchTasks'] = ['access CiviCRM'];
     // Permission for run action is checked internally
     $permissions['run'] = [];

diff --git a/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php b/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php
index bf0364a3ccd89329e64a4cc7309a15ee119f2bbe..d833c17ff3eaf11835e6197d77f21399f24db497 100644 (file)
--- a/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php
+++ b/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php
@@ -464,7 +464,7 @@ class SearchRunTest extends \PHPUnit\Framework\TestCase implements HeadlessInter
     }
     $this->assertStringContainsString('failed', $error);
 
-    $config->userPermissionClass->permissions = ['administer CiviCRM data'];
+    $config->userPermissionClass->permissions = ['access CiviCRM', 'administer CiviCRM data'];
 
     // Admins can edit the search and the display
     SavedSearch::update()->addWhere('name', '=', $searchName)