APIv4 - Fix access to case activities for administrators

Fixes dev/core#4769

Before: Case administrators with 'access deleted contacts' permission blocked from viewing Case activities in APIv4
After: Permissions work correctly.

The problem was the hook logic was incorrectly interpreting empty permissions to mean "no access"
when it actually means "unrestricted access".

diff --git a/ext/civi_case/civi_case.php b/ext/civi_case/civi_case.php
index 43d5b6770615abc03d098fcaf468ffcbfb15d7c7..5ba1da28c4b16dbf1787236447aa661554fdcde9 100644 (file)
--- a/ext/civi_case/civi_case.php
+++ b/ext/civi_case/civi_case.php
@@ -25,14 +25,16 @@ function civi_case_civicrm_managed(&$entities, $modules) {
  */
 function civi_case_civicrm_selectWhereClause($entityName, &$clauses, $userId, $conditions) {
   if ($entityName === 'Activity') {
+    $casePerms = CRM_Utils_SQL::mergeSubquery('Case');
+    if (!$casePerms) {
+      // Unrestricted access to CiviCase
+      return;
+    }
     // OR group: either it's a non-case activity OR case permissions apply
     $orGroup = [
       'NOT IN (SELECT activity_id FROM civicrm_case_activity)',
+      'IN (SELECT activity_id FROM civicrm_case_activity WHERE case_id ' . implode(' AND case_id ', $casePerms) . ')',
     ];
-    $casePerms = CRM_Utils_SQL::mergeSubquery('Case');
-    if ($casePerms) {
-      $orGroup[] = 'IN (SELECT activity_id FROM civicrm_case_activity WHERE case_id ' . implode(' AND case_id ', $casePerms) . ')';
-    }
     $clauses['id'][] = $orGroup;
   }
 }

diff --git a/tests/phpunit/api/v4/Entity/CaseTest.php b/tests/phpunit/api/v4/Entity/CaseTest.php
index 39cd8d3028342e81706cacfdaffd399d7345547e..1e2f8773647a6001b5df01b4dbf149776709b296 100644 (file)
--- a/tests/phpunit/api/v4/Entity/CaseTest.php
+++ b/tests/phpunit/api/v4/Entity/CaseTest.php
@@ -257,10 +257,11 @@ class CaseTest extends Api4TestBase {
     $this->assertCount(1, $result);
     $this->assertEquals($case1, $result[0]);
 
-    // CiviCase permission for all  cases
+    // CiviCase permission for all contacts and cases
     \CRM_Core_Config::singleton()->userPermissionClass->permissions = [
       'access CiviCRM',
       'view all contacts',
+      'access deleted contacts',
       'access all cases and activities',
       'administer CiviCase',
     ];