Do not check financial permissions on contribution.create if check_permissions is...

Our standard is to only check permissions at the api layer if check_permissions is TRUE
(which is is by default for javascript calls but not in php calls)

diff --git a/api/v3/Contribution.php b/api/v3/Contribution.php
index a52600f6d820f9a03057d15cc935355c354b3012..d24adbf1b52fd91806c511b84fccf464dc6343d8 100644 (file)
--- a/api/v3/Contribution.php
+++ b/api/v3/Contribution.php
@@ -56,7 +56,7 @@ function civicrm_api3_contribution_create(&$params) {
   }
   $params['skipCleanMoney'] = TRUE;
 
-  if (CRM_Financial_BAO_FinancialType::isACLFinancialTypeStatus()) {
+  if (!empty($params['check_permissions']) && CRM_Financial_BAO_FinancialType::isACLFinancialTypeStatus()) {
     if (empty($params['id'])) {
       $op = CRM_Core_Action::ADD;
     }
@@ -68,7 +68,7 @@ function civicrm_api3_contribution_create(&$params) {
     }
     CRM_Financial_BAO_FinancialType::getAvailableFinancialTypes($types, $op);
     if (!in_array($params['financial_type_id'], array_keys($types))) {
-      return civicrm_api3_create_error('You do not have permission to create this contribution');
+      throw new API_Exception('You do not have permission to create this contribution');
     }
   }
   if (!empty($params['id']) && !empty($params['contribution_status_id'])) {
@@ -214,6 +214,7 @@ function _civicrm_api3_contribution_create_legacy_support_45(&$params) {
  *   Input parameters.
  *
  * @return array
+ * @throws \API_Exception
  */
 function civicrm_api3_contribution_delete($params) {
 
@@ -221,11 +222,13 @@ function civicrm_api3_contribution_delete($params) {
   // First check contribution financial type
   $financialType = CRM_Core_DAO::getFieldValue('CRM_Contribute_DAO_Contribution', $contributionID, 'financial_type_id');
   // Now check permissioned lineitems & permissioned contribution
-  if (CRM_Financial_BAO_FinancialType::isACLFinancialTypeStatus()
-    && !CRM_Core_Permission::check('delete contributions of type ' . CRM_Contribute_PseudoConstant::financialType($financialType)) ||
-      !CRM_Financial_BAO_FinancialType::checkPermissionedLineItems($contributionID, 'delete', FALSE)
+  if (!empty($params['check_permissions']) && CRM_Financial_BAO_FinancialType::isACLFinancialTypeStatus() &&
+    (
+      !CRM_Core_Permission::check('delete contributions of type ' . CRM_Contribute_PseudoConstant::financialType($financialType))
+      || !CRM_Financial_BAO_FinancialType::checkPermissionedLineItems($contributionID, 'delete', FALSE)
+    )
   ) {
-    return civicrm_api3_create_error('You do not have permission to delete this contribution');
+    throw new API_Exception('You do not have permission to delete this contribution');
   }
   if (CRM_Contribute_BAO_Contribution::deleteContribution($contributionID)) {
     return civicrm_api3_create_success(array($contributionID => 1));