crash for lesser-permissioned users

diff --git a/CRM/ACL/BAO/ACL.php b/CRM/ACL/BAO/ACL.php
index 154b178357246cdea53be1a0734ab09d7a9d09e1..977f3d3997b86db198ee32d9e1fb8ae32701fbe2 100644 (file)
--- a/CRM/ACL/BAO/ACL.php
+++ b/CRM/ACL/BAO/ACL.php
@@ -265,10 +265,12 @@ ORDER BY a.object_id
    AND   a.object_id IN (%1)
 ORDER BY a.object_id
 ";
-      $denyDao = CRM_Core_DAO::executeQuery($denyQuery, [1 => [implode(',', $ids), 'CommaSeparatedIntegers']]);
-      while ($denyDao->fetch()) {
-        $key = array_search($denyDao->object_id, $ids);
-        unset($ids[$key]);
+      if (!empty($ids)) {
+        $denyDao = CRM_Core_DAO::executeQuery($denyQuery, [1 => [implode(',', $ids), 'CommaSeparatedIntegers']]);
+        while ($denyDao->fetch()) {
+          $key = array_search($denyDao->object_id, $ids);
+          unset($ids[$key]);
+        }
       }
 
       if (!empty($ids)) {

diff --git a/tests/phpunit/api/v3/RelationshipTest.php b/tests/phpunit/api/v3/RelationshipTest.php
index cce47316b1a979d5c3d1aa90f127449aa2962c95..91ace3a2e3720fd0983579111f0eb373fc8b690d 100644 (file)
--- a/tests/phpunit/api/v3/RelationshipTest.php
+++ b/tests/phpunit/api/v3/RelationshipTest.php
@@ -1457,4 +1457,28 @@ class api_v3_RelationshipTest extends CiviUnitTestCase {
       ]));
   }
 
+  public function testCreateWithLesserPermissions() {
+    $this->setUpACLByCheating();
+    CRM_Core_Config::singleton()->userPermissionClass->permissions = [];
+    $params = [
+      'contact_id_a' => $this->_cId_a,
+      'contact_id_b' => $this->_cId_b,
+      'relationship_type_id' => $this->relationshipTypeID,
+    ];
+    $id = $this->callAPISuccess('Relationship', 'create', $params)['id'];
+    $relationship = $this->callAPISuccess('Relationship', 'getsingle', ['id' => $id]);
+    $this->assertEquals($params, array_intersect_key($relationship, $params));
+    CRM_Core_DAO::executeQuery("DELETE FROM civicrm_acl");
+  }
+
+  /**
+   * Normally a stock install has some acls in the table even if they aren't in
+   * use. I can't figure out how to set them up another way so I just lifted
+   * this from civicrm_generated.mysql
+   */
+  private function setUpACLByCheating() {
+    CRM_Core_DAO::executeQuery("INSERT INTO civicrm_acl (name, deny, entity_table, entity_id, operation, object_table, object_id, acl_table, acl_id, is_active) VALUES ('Edit All Contacts', 0, 'civicrm_acl_role', 1, 'Edit', 'civicrm_saved_search', 0, NULL, NULL, 1)");
+    CRM_Core_DAO::executeQuery("INSERT INTO civicrm_acl (name, deny, entity_table, entity_id, operation, object_table, object_id, acl_table, acl_id, is_active) VALUES ('Core ACL',0,'civicrm_acl_role',0,'All','access CiviMail subscribe/unsubscribe pages',NULL,NULL,NULL,1)");
+  }
+
 }