Additional changes

diff --git a/CRM/Admin/Page/ScheduleReminders.php b/CRM/Admin/Page/ScheduleReminders.php
index 3f965e0486f1d714ed047713a0cf3a361a5214b1..6a4ea9ba8bfdfa5dc55183ec6bd65b07b56538e1 100644 (file)
--- a/CRM/Admin/Page/ScheduleReminders.php
+++ b/CRM/Admin/Page/ScheduleReminders.php
@@ -136,6 +136,12 @@ class CRM_Admin_Page_ScheduleReminders extends CRM_Core_Page_Basic {
    * @return void
    */
   public function browse($action = NULL) {
+    //CRM-16777: Do not permit access to user, for page 'Administer->Communication->Schedule Reminder',
+    //when do not have 'administer CiviCRM' permission.
+    if (!CRM_Core_Permission::check('administer CiviCRM')) {
+      CRM_Core_Error::fatal(ts('You do not have permission to access this page.'));
+    }
+
     // Get list of configured reminders
     $reminderList = CRM_Core_BAO_ActionSchedule::getList();
 

diff --git a/CRM/Core/DAO/permissions.php b/CRM/Core/DAO/permissions.php
index d71a45f6bf6efef349d783e91f0f95f8aa2ddbbc..661570ab62c015fe4b8394aa42c8097f042f43f2 100644 (file)
--- a/CRM/Core/DAO/permissions.php
+++ b/CRM/Core/DAO/permissions.php
@@ -431,6 +431,17 @@ function _civicrm_api3_permissions($entity, $action, &$params) {
       'edit pledges',
     ),
   );
+
+  //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission.
+  $permissions['action_schedule'] = array(
+    'update' => array(
+      array(
+        'access CiviCRM',
+        'edit all events',
+      ),
+    ),
+  );
+
   $permissions['pledge_payment'] = array(
     'create' => array(
       'access CiviCRM',

diff --git a/Civi/API/Subscriber/PermissionCheck.php b/Civi/API/Subscriber/PermissionCheck.php
index 5801f88226ae1ac473ab98513c05a39c63c38327..aac7bcb106e4063142bade7ab9926384b20552ff 100644 (file)
--- a/Civi/API/Subscriber/PermissionCheck.php
+++ b/Civi/API/Subscriber/PermissionCheck.php
@@ -106,6 +106,17 @@ class PermissionCheck implements EventSubscriberInterface {
           return TRUE;
         }
         break;
+
+      //CRM-16777: Disable schedule reminder with ACLs.
+      case 'ActionSchedule':
+        $events = \CRM_Event_BAO_Event::getEvents();
+        $aclEdit = \CRM_ACL_API::group(\CRM_Core_Permission::EDIT, NULL, 'civicrm_event', $events);
+        $param = array('id'=>$apiRequest['params']['id']);
+        $eventId = \CRM_Core_BAO_ActionSchedule::retrieve($param, $value = array());
+        if (in_array($eventId->entity_value, $aclEdit)) {
+          return TRUE;
+        }
+        break;
     }
 
     return FALSE;