check for manage event profile permission on preview

diff --git a/CRM/Core/BAO/UFGroup.php b/CRM/Core/BAO/UFGroup.php
index d2ae65bcd723e911b0075219b876c251ee1157d9..137c57dfedb810dcc86b8faf886df170468ff0c2 100644 (file)
--- a/CRM/Core/BAO/UFGroup.php
+++ b/CRM/Core/BAO/UFGroup.php
@@ -290,7 +290,8 @@ class CRM_Core_BAO_UFGroup extends CRM_Core_DAO_UFGroup {
     $ctype = NULL,
     $permissionType = CRM_Core_Permission::CREATE,
     $orderBy = 'field_name',
-    $orderProfiles = NULL
+    $orderProfiles = NULL,
+    $eventProfile = FALSE
   ) {
     if (!is_array($id)) {
       $id = CRM_Utils_Type::escape($id, 'Positive');
@@ -318,6 +319,16 @@ class CRM_Core_BAO_UFGroup extends CRM_Core_DAO_UFGroup {
       $query .= " AND g.is_active = 1";
     }
 
+    $checkPermission = array(
+      array(
+        'administer CiviCRM',
+        'manage event profiles',
+      ),
+    );
+    if ($eventProfile && CRM_Core_Permission::check($checkPermission)) {
+      $skipPermission = TRUE;
+    }
+
     // add permissioning for profiles only if not registration
     if (!$skipPermission) {
       $permissionClause = CRM_Core_Permission::ufGroupClause($permissionType, 'g.');

diff --git a/CRM/UF/Form/Inline/Preview.php b/CRM/UF/Form/Inline/Preview.php
index e90211f69a67fc826a82613ae7e415c291a1f055..41bff7b389ef97225fb398cc44216b52ac5d3bf3 100644 (file)
--- a/CRM/UF/Form/Inline/Preview.php
+++ b/CRM/UF/Form/Inline/Preview.php
@@ -56,7 +56,13 @@ class CRM_UF_Form_Inline_Preview extends CRM_UF_Form_AbstractPreview {
       CRM_Core_Error::fatal(ts('Preview only supports HTTP POST'));
     }
     // Inline forms don't get menu-level permission checks
-    if (!CRM_Core_Permission::check('administer CiviCRM')) {
+    $checkPermission = array(
+      array(
+        'administer CiviCRM',
+        'manage event profiles',
+      ),
+    );
+    if (!CRM_Core_Permission::check($checkPermission)) {
       CRM_Core_Error::fatal(ts('Permission Denied'));
     }
     $content = json_decode($_REQUEST['ufData'], TRUE);

diff --git a/CRM/UF/Form/Inline/PreviewById.php b/CRM/UF/Form/Inline/PreviewById.php
index 4d62192eaf11c46551f8dd72eedece37e3598e1b..40af28d698d3c20aa5f3bbc79c7099e34eeeff6d 100644 (file)
--- a/CRM/UF/Form/Inline/PreviewById.php
+++ b/CRM/UF/Form/Inline/PreviewById.php
@@ -55,7 +55,7 @@ class CRM_UF_Form_Inline_PreviewById extends CRM_UF_Form_AbstractPreview {
       CRM_Core_Error::fatal(ts('Permission Denied'));
     }
     $gid = CRM_Utils_Request::retrieve('id', 'Positive');
-    $fields = CRM_Core_BAO_UFGroup::getFields($gid);
+    $fields = CRM_Core_BAO_UFGroup::getFields($gid, FALSE, NULL, NULL, NULL, FALSE, NULL, FALSE, NULL, CRM_Core_Permission::CREATE, 'field_name', NULL, TRUE);
     $this->setProfile($fields);
   }