--CRM-17569, changed code to check permission in preprocess when ACL-FT is enabled...

diff --git a/CRM/Contribute/xml/Menu/Contribute.xml b/CRM/Contribute/xml/Menu/Contribute.xml
index ddbc7ec6f97204d094a6c66194e2569663cc36fb..ef8694e9d3aa1c5a35a30cb6df262863da880f72 100644 (file)
--- a/CRM/Contribute/xml/Menu/Contribute.xml
+++ b/CRM/Contribute/xml/Menu/Contribute.xml
@@ -119,7 +119,6 @@
     <page_callback>CRM_Financial_Page_FinancialType</page_callback>
     <desc>Formerly civicrm_contribution_type merged into this table in 4.1</desc>
     <adminGroup>CiviContribute</adminGroup>
-    <access_arguments>administer CiviCRM Financial Types</access_arguments>
     <weight>580</weight>
   </item>
   <item>

diff --git a/CRM/Financial/Form/FinancialType.php b/CRM/Financial/Form/FinancialType.php
index 424e7ff19aa52a3c1874691e0672936424934a9d..c8069885ad6e2d8edeafda7fa01fedeb448852b9 100644 (file)
--- a/CRM/Financial/Form/FinancialType.php
+++ b/CRM/Financial/Form/FinancialType.php
@@ -36,6 +36,19 @@
  */
 class CRM_Financial_Form_FinancialType extends CRM_Contribute_Form {
 
+  /**
+   * Set variables up before form is built.
+   */
+  public function preProcess() {
+    // Check permission for Financial Type when ACL-FT is enabled
+    if (CRM_Financial_BAO_FinancialType::isACLFinancialTypeStatus()
+      && !CRM_Core_Permission::check('administer CiviCRM Financial Types')
+    ) {
+      CRM_Core_Error::fatal(ts('You do not have permission to access this page.'));
+    }
+    parent::preProcess();
+  }
+
   /**
    * Build the form object.
    */

diff --git a/CRM/Financial/Page/FinancialType.php b/CRM/Financial/Page/FinancialType.php
index de0804506b3b4882e099e3a31678ffc4985d24ad..8dfb71aa8d59085a4c5754635000f2290ccb9b5d 100644 (file)
--- a/CRM/Financial/Page/FinancialType.php
+++ b/CRM/Financial/Page/FinancialType.php
@@ -124,6 +124,12 @@ class CRM_Financial_Page_FinancialType extends CRM_Core_Page_Basic {
    * Browse all financial types.
    */
   public function browse() {
+    // Check permission for Financial Type when ACL-FT is enabled
+    if (CRM_Financial_BAO_FinancialType::isACLFinancialTypeStatus()
+      && !CRM_Core_Permission::check('administer CiviCRM Financial Types')
+    ) {
+      CRM_Core_Error::fatal(ts('You do not have permission to access this page.'));
+    }
     // get all financial types sorted by weight
     $financialType = array();
     $dao = new CRM_Financial_DAO_FinancialType();