CRM_Core_Permission - Allow checking of anon-perms by authenticated-users

Each CRM_Core_Permission_* adapter allows you to check the permissions on
behalf of some other user. However, if that "other user" is "anonymous",
then they are prone to mishandling.

diff --git a/CRM/Core/Permission/Backdrop.php b/CRM/Core/Permission/Backdrop.php
index de90766d724d7437fea41ab395b1ea3f70c887f8..6fc230a4a324aceeb495bd57b433d1c842b48f5c 100644 (file)
--- a/CRM/Core/Permission/Backdrop.php
+++ b/CRM/Core/Permission/Backdrop.php
@@ -68,7 +68,7 @@ class CRM_Core_Permission_Backdrop extends CRM_Core_Permission_DrupalBase {
     }
     if (function_exists('user_access')) {
       $account = NULL;
-      if ($userId) {
+      if ($userId || $userId === 0) {
         $account = user_load($userId);
       }
       return user_access($str, $account);

diff --git a/CRM/Core/Permission/Drupal.php b/CRM/Core/Permission/Drupal.php
index a6dbdd7a41e8e7cf6248305a6e34e7ff6def1ed7..0b0abe0b0a28706befd718cc2dcbd9615e13f7a7 100644 (file)
--- a/CRM/Core/Permission/Drupal.php
+++ b/CRM/Core/Permission/Drupal.php
@@ -67,7 +67,7 @@ class CRM_Core_Permission_Drupal extends CRM_Core_Permission_DrupalBase {
     }
     if (function_exists('user_access')) {
       $account = NULL;
-      if ($userId) {
+      if ($userId || $userId === 0) {
         $account = user_load($userId);
       }
       return user_access($str, $account);

diff --git a/CRM/Core/Permission/Drupal6.php b/CRM/Core/Permission/Drupal6.php
index d478f09b5dbc9754534fb3c5757652a720986aa2..5bae3568bdfa6260305df908a45808f78defaa60 100644 (file)
--- a/CRM/Core/Permission/Drupal6.php
+++ b/CRM/Core/Permission/Drupal6.php
@@ -67,7 +67,7 @@ class CRM_Core_Permission_Drupal6 extends CRM_Core_Permission_DrupalBase {
     }
     if (function_exists('user_access')) {
       $account = NULL;
-      if ($userId) {
+      if ($userId || $userId === 0) {
         $account = user_load($userId);
       }
       return user_access($str, $account);

diff --git a/CRM/Core/Permission/Drupal8.php b/CRM/Core/Permission/Drupal8.php
index add83a00f3378e093099787d68dbb90e3279af55..eb1d570c37305dd1a2af2922ffe1d966909ddd18 100644 (file)
--- a/CRM/Core/Permission/Drupal8.php
+++ b/CRM/Core/Permission/Drupal8.php
@@ -41,7 +41,7 @@ class CRM_Core_Permission_Drupal8 extends CRM_Core_Permission_DrupalBase {
     if ($str == CRM_Core_Permission::ALWAYS_ALLOW_PERMISSION) {
       return TRUE;
     }
-    $acct = $userId ? \Drupal\user\Entity\User::load($userId) : \Drupal::currentUser();
+    $acct = ($userId === 0 ? \Drupal\user\Entity\User::getAnonymousUser() : ($userId ? \Drupal\user\Entity\User::load($userId) : \Drupal::currentUser()));
     return $acct->hasPermission($str);
   }
 

diff --git a/CRM/Core/Permission/Joomla.php b/CRM/Core/Permission/Joomla.php
index 42d551dd194afbb993f92f8d54d269c94c232424..1a3e333e4047ad5d01317bf345e5351f28ceb64e 100644 (file)
--- a/CRM/Core/Permission/Joomla.php
+++ b/CRM/Core/Permission/Joomla.php
@@ -33,7 +33,10 @@ class CRM_Core_Permission_Joomla extends CRM_Core_Permission_Base {
   public function check($str, $userId = NULL) {
     $config = CRM_Core_Config::singleton();
     // JFactory::getUser does strict type checking, so convert falesy values to NULL
-    if (!$userId) {
+    if ($userId === 0 || $userId === '0') {
+      $userId = 0;
+    }
+    elseif (!$userId) {
       $userId = NULL;
     }
 

diff --git a/CRM/Core/Permission/WordPress.php b/CRM/Core/Permission/WordPress.php
index 03eeb9be3b0fa7c7be72ed61bdb036082ef2ac82..dfcc6c34a3f2bba7704feabf2365c6c1b3184b45 100644 (file)
--- a/CRM/Core/Permission/WordPress.php
+++ b/CRM/Core/Permission/WordPress.php
@@ -60,14 +60,14 @@ class CRM_Core_Permission_WordPress extends CRM_Core_Permission_Base {
 
     $user = $userId ? get_userdata($userId) : wp_get_current_user();
 
-    if ($user->has_cap('super admin') || $user->has_cap('administrator')) {
+    if ($userId !== 0 && ($user->has_cap('super admin') || $user->has_cap('administrator'))) {
       return TRUE;
     }
 
     // Make string lowercase and convert spaces into underscore
     $str = CRM_Utils_String::munge(strtolower($str));
 
-    if ($user->exists()) {
+    if ($userId !== 0 && $user->exists()) {
       // Check whether the logged in user has the capabilitity
       if ($user->has_cap($str)) {
         return TRUE;