Afform.prefill - Allow anonymous requests

This API has its own security checks

diff --git a/ext/afform/core/afform.php b/ext/afform/core/afform.php
index 54fe6e8c6eae32901ff6ef868af1afcc5d31175a..87c4e243375693b7f8668fc5649d98e9a167674e 100644 (file)
--- a/ext/afform/core/afform.php
+++ b/ext/afform/core/afform.php
@@ -394,7 +394,9 @@ function _afform_angular_module_name($fileBaseName, $format = 'camel') {
  * @see CRM_Utils_Hook::alterApiRoutePermissions
  */
 function afform_civicrm_alterApiRoutePermissions(&$permissions, $entity, $action) {
-  if ($entity == 'Afform' && $action == 'submit') {
-    $permissions = CRM_Core_Permission::ALWAYS_ALLOW_PERMISSION;
+  if ($entity == 'Afform') {
+    if ($action == 'prefill' || $action == 'submit') {
+      $permissions = CRM_Core_Permission::ALWAYS_ALLOW_PERMISSION;
+    }
   }
 }