CRM-19363 - Add price_set api permission checks

diff --git a/CRM/Core/DAO/permissions.php b/CRM/Core/DAO/permissions.php
index 04ad1cfbbb1fb9de2e7b4ec022d065f9901c33f5..ca0790cbe73c073c378e34d27b5a5071a2aa0729 100644 (file)
--- a/CRM/Core/DAO/permissions.php
+++ b/CRM/Core/DAO/permissions.php
@@ -305,6 +305,16 @@ function _civicrm_api3_permissions($entity, $action, &$params) {
   // Loc block is only used for events
   $permissions['loc_block'] = $permissions['event'];
 
+  // Price sets are shared by several components, user needs access to at least one of them
+  $permissions['price_set'] = array(
+    'default' => array(
+      array('access CiviEvent', 'access CiviContribute', 'access CiviMember'),
+    ),
+    'get' => array(
+      array('access CiviCRM', 'view event info', 'make online contributions'),
+    ),
+  );
+
   // File permissions
   $permissions['file'] = array(
     'default' => array(