API - Finer-grained permisions for the dashboard & dashlet entities

This allows contacts without "administer CiviCRM" permission to access these api entities.
Permissions are restricted to contacts they have access to, and write permissions are
limited to a contact only editing their own dashboard.

diff --git a/CRM/Contact/BAO/DashboardContact.php b/CRM/Contact/BAO/DashboardContact.php
index b9b728fa942341193eaf9f49ffeace1f4a405564..c6ff99f6891a9cfd33421c01eab9a20843b64da6 100644 (file)
--- a/CRM/Contact/BAO/DashboardContact.php
+++ b/CRM/Contact/BAO/DashboardContact.php
@@ -14,4 +14,41 @@
  * @copyright CiviCRM LLC https://civicrm.org/licensing
  */
 class CRM_Contact_BAO_DashboardContact extends CRM_Contact_DAO_DashboardContact {
+
+  /**
+   * @param array $record
+   * @return CRM_Contact_DAO_DashboardContact
+   * @throws CRM_Core_Exception
+   */
+  public static function writeRecord(array $record) {
+    self::checkEditPermission($record);
+    return parent::writeRecord($record);
+  }
+
+  /**
+   * @param array $record
+   * @return CRM_Contact_DAO_DashboardContact
+   * @throws CRM_Core_Exception
+   */
+  public static function deleteRecord(array $record) {
+    self::checkEditPermission($record);
+    return parent::deleteRecord($record);
+  }
+
+  /**
+   * Ensure that the current user has permission to create/edit/delete a DashboardContact record
+   *
+   * @param array $record
+   * @throws CRM_Core_Exception
+   * @throws \Civi\API\Exception\UnauthorizedException
+   */
+  public static function checkEditPermission(array $record) {
+    if (!empty($record['check_permissions']) && !CRM_Core_Permission::check('administer CiviCRM')) {
+      $cid = !empty($record['id']) ? self::getFieldValue(parent::class, $record['id'], 'contact_id') : $record['contact_id'];
+      if ($cid != CRM_Core_Session::getLoggedInContactID()) {
+        throw new \Civi\API\Exception\UnauthorizedException('You do not have permission to edit the dashboard for this contact.');
+      }
+    }
+  }
+
 }

diff --git a/CRM/Core/Permission.php b/CRM/Core/Permission.php
index 899440812e6bfa95417859e81d131578beceeb06..1de3147c8ab342386dc553a8e50a4ab1afa9da1b 100644 (file)
--- a/CRM/Core/Permission.php
+++ b/CRM/Core/Permission.php
@@ -1491,6 +1491,18 @@ class CRM_Core_Permission {
       ],
     ];
 
+    // Dashboard permissions
+    $permissions['dashboard'] = [
+      'get' => [
+        'access CiviCRM',
+      ],
+    ];
+    $permissions['dashboard_contact'] = [
+      'default' => [
+        'access CiviCRM',
+      ],
+    ];
+
     // Profile permissions
     $permissions['profile'] = [
       // the profile will take care of this