APIv4 - Fix getLinks permission checks

The getLinks action checks all permissions internally, so should not have any
external gatekeeper checks applied.

diff --git a/Civi/Api4/Event/Subscriber/PermissionCheckSubscriber.php b/Civi/Api4/Event/Subscriber/PermissionCheckSubscriber.php
index 454dbc0735b6dda1de54c9bf0c32c6a8c039ca41..2561a40946d8c5b21c521aabf6ed4f853cc938d1 100644 (file)
--- a/Civi/Api4/Event/Subscriber/PermissionCheckSubscriber.php
+++ b/Civi/Api4/Event/Subscriber/PermissionCheckSubscriber.php
@@ -42,7 +42,12 @@ class PermissionCheckSubscriber extends \Civi\Core\Service\AutoService implement
     /** @var \Civi\Api4\Generic\AbstractAction $apiRequest */
     $apiRequest = $event->getApiRequest();
     if ($apiRequest['version'] == 4) {
-      if (!$apiRequest->getCheckPermissions() || $apiRequest->isAuthorized(\CRM_Core_Session::singleton()->getLoggedInContactID())) {
+      if (
+        !$apiRequest->getCheckPermissions() ||
+        // This action checks permissions internally
+        $apiRequest->getActionName() === 'getLinks' ||
+        $apiRequest->isAuthorized(\CRM_Core_Session::singleton()->getLoggedInContactID())
+      ) {
         $event->authorize();
         $event->stopPropagation();
       }

diff --git a/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php b/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php
index ade06c08549aab057559e222e027e99a4520081c..b388174f9b312dda8f24cff386e92f78a27bda58 100644 (file)
--- a/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php
+++ b/ext/search_kit/tests/phpunit/api/v4/SearchDisplay/SearchRunTest.php
@@ -6,6 +6,7 @@ require_once __DIR__ . '/../../../../../../../tests/phpunit/api/v4/Api4TestBase.
 
 use api\v4\Api4TestBase;
 use Civi\API\Exception\UnauthorizedException;
+use Civi\Api4\Action\GetLinks;
 use Civi\Api4\Activity;
 use Civi\Api4\Address;
 use Civi\Api4\Contact;
@@ -2049,6 +2050,9 @@ class SearchRunTest extends Api4TestBase implements TransactionalInterface {
     $this->assertCount(0, $result->toolbar);
     // With 'add contacts' permission the button will be shown
     \CRM_Core_Config::singleton()->userPermissionClass->permissions[] = 'add contacts';
+    // Clear getLinks cache after changing permissions
+    \Civi::$statics[GetLinks::class] = [];
+
     $result = civicrm_api4('SearchDisplay', 'run', $params);
     $this->assertCount(1, $result->toolbar);
     $button = $result->toolbar[0];