Ensure that APIv4 Properly filters out permissable fields when no permission to view...

diff --git a/Civi/Api4/Query/Api4SelectQuery.php b/Civi/Api4/Query/Api4SelectQuery.php
index f7026ba3494315cac0dd5ab8f56fa87650cc0840..35f6fd808060dcf39e5efa64615dbac966c91e96 100644 (file)
--- a/Civi/Api4/Query/Api4SelectQuery.php
+++ b/Civi/Api4/Query/Api4SelectQuery.php
@@ -375,7 +375,10 @@ class Api4SelectQuery extends SelectQuery {
     if ($lastLink instanceof CustomGroupJoinable) {
       $field = $lastLink->getSqlColumn($field);
     }
-
+    // Check Permission on field.
+    if ($this->checkPermissions && !empty($this->apiFieldSpec[$prefix . $field]['permission']) && !\CRM_Core_Permission::check($this->apiFieldSpec[$prefix . $field]['permission'])) {
+      return;
+    }
     $this->fkSelectAliases[$key] = sprintf('%s.%s', $lastLink->getAlias(), $field);
   }
 

diff --git a/Civi/Api4/Service/Spec/FieldSpec.php b/Civi/Api4/Service/Spec/FieldSpec.php
index 7a44a1d925c6731b897f322a0644eac0212d0b2f..c44d58678d78216c55368535f52cc5e82751d0f5 100644 (file)
--- a/Civi/Api4/Service/Spec/FieldSpec.php
+++ b/Civi/Api4/Service/Spec/FieldSpec.php
@@ -76,7 +76,7 @@ class FieldSpec {
   protected $requiredIf;
 
   /**
-   * @var array|boolean
+   * @var array|bool
    */
   protected $options;
 
@@ -105,6 +105,11 @@ class FieldSpec {
    */
   protected $serialize;
 
+  /**
+   * @var array
+   */
+  protected $permission;
+
   /**
    * Aliases for the valid data types
    *
@@ -286,6 +291,22 @@ class FieldSpec {
     return $this;
   }
 
+  /**
+   * @param array $permission
+   * @return $this
+   */
+  public function setPermission($permission) {
+    $this->permission = $permission;
+    return $this;
+  }
+
+  /**
+   * @return array
+   */
+  public function getPermission() {
+    return $this->permission;
+  }
+
   /**
    * @return string
    */

diff --git a/Civi/Api4/Service/Spec/SpecFormatter.php b/Civi/Api4/Service/Spec/SpecFormatter.php
index b1c1c804e3d22ab97ee2d3e0930b5d37d3f18d6b..f44e267c7ac95463cf4619c605248e6ea6b77f03 100644 (file)
--- a/Civi/Api4/Service/Spec/SpecFormatter.php
+++ b/Civi/Api4/Service/Spec/SpecFormatter.php
@@ -100,6 +100,7 @@ class SpecFormatter {
     $field->setDescription(ArrayHelper::value('description', $data));
     self::setInputTypeAndAttrs($field, $data, $dataTypeName);
 
+    $field->setPermission(ArrayHelper::value('permission', $data));
     $fkAPIName = ArrayHelper::value('FKApiName', $data);
     $fkClassName = ArrayHelper::value('FKClassName', $data);
     if ($fkAPIName || $fkClassName) {