From 0d8fc49771d2978d8ffc729a66e6bffb8ee35287 Mon Sep 17 00:00:00 2001
From: Tim Otten <totten@civicrm.org>
Date: Fri, 8 Mar 2013 03:02:26 -0500
Subject: [PATCH] CRM-11925 - Modify upgradePermissions to work with all
 permissions (not just single-module permissions)

---
 CRM/Core/Config.php             | 11 +++--------
 CRM/Core/Permission/Base.php    | 13 ++++++-------
 CRM/Core/Permission/Drupal.php  | 16 ++++++----------
 CRM/Core/Permission/Drupal6.php |  2 +-
 4 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/CRM/Core/Config.php b/CRM/Core/Config.php
index aa45c82ec9..668bb7a8b4 100644
--- a/CRM/Core/Config.php
+++ b/CRM/Core/Config.php
@@ -661,14 +661,9 @@ class CRM_Core_Config extends CRM_Core_Config_Variables {
     $module_files = CRM_Extension_System::singleton()->getMapper()->getActiveModuleFiles();
     if ($this->userPermissionClass->isModulePermissionSupported()) {
       // Can store permissions -- so do it!
-      foreach ($module_files as $module_file) {
-        // Consider corner case: Cleaning up old module permissions that have been removed
-        // by unversioned source-code changes.
-        $this->userPermissionClass->upgradePermissions(
-          $module_file['prefix'],
-          $this->userPermissionClass->getModulePermissions($module_file['prefix'])
-        );
-      }
+      $this->userPermissionClass->upgradePermissions(
+        CRM_Core_Permission::basicPermissions()
+      );
     } else {
       // Cannot store permissions -- warn if any modules require them
       $modules_with_perms = array();
diff --git a/CRM/Core/Permission/Base.php b/CRM/Core/Permission/Base.php
index d53e3dfaf8..653ae99323 100644
--- a/CRM/Core/Permission/Base.php
+++ b/CRM/Core/Permission/Base.php
@@ -171,16 +171,15 @@ class CRM_Core_Permission_Base {
   }
 
   /**
-   * Ensure that all cached permissions associated with the given module are
-   * actually defined by that module. This is useful during module upgrade
-   * when the newer module version has removed permission that were defined
-   * in the older version.
+   * Ensure that the CMS supports all the permissions defined by CiviCRM
+   * and its extensions. If there are stale permissions, they should be
+   * deleted. This is useful during module upgrade when the newer module
+   * version has removed permission that were defined in the older version.
    *
-   * @param string $module short-name
-   * @param array $modulePermissions same format as CRM_Core_Permission::getCorePermissions().
+   * @param array $permissions same format as CRM_Core_Permission::getCorePermissions().
    * @see CRM_Core_Permission::getCorePermissions
    */
-  function upgradePermissions($module, $modulePermissions) {
+  function upgradePermissions($permissions) {
     throw new CRM_Core_Exception("Unimplemented method: CRM_Core_Permission_*::upgradePermissions");
   }
 
diff --git a/CRM/Core/Permission/Drupal.php b/CRM/Core/Permission/Drupal.php
index 552c9acbca..d091426067 100644
--- a/CRM/Core/Permission/Drupal.php
+++ b/CRM/Core/Permission/Drupal.php
@@ -104,17 +104,13 @@ class CRM_Core_Permission_Drupal extends CRM_Core_Permission_DrupalBase{
   /**
    * {@inheritdoc}
    */
-  function upgradePermissions($module, $module_permissions) {
-    // Construct a delete query to remove permissions for this module.
-    $query = db_delete('role_permission')
-      ->condition('permission', "$module|%", 'LIKE')
-      ->condition('module', 'civicrm');
-    // Only if the module defines any permissions, exempt those from the delete
-    // process. This approach allows us to delete all permissions for the module
-    // even if the hook_civicrm_permisssion() implementation has been removed.
-    if (!empty($module_permissions)) {
-      $query->condition('permission', array_keys($module_permissions), 'NOT IN');
+  function upgradePermissions($permissions) {
+    if (empty($permissions)) {
+      throw new CRM_Core_Exception("Cannot upgrade permissions: permission list missing");
     }
+    $query = db_delete('role_permission')
+      ->condition('module', 'civicrm')
+      ->condition('permission', array_keys($permissions), 'NOT IN');
     $query->execute();
   }
 }
diff --git a/CRM/Core/Permission/Drupal6.php b/CRM/Core/Permission/Drupal6.php
index 353da32ad0..1aaa4adf20 100644
--- a/CRM/Core/Permission/Drupal6.php
+++ b/CRM/Core/Permission/Drupal6.php
@@ -162,7 +162,7 @@ class CRM_Core_Permission_Drupal6 extends CRM_Core_Permission_DrupalBase {
    *
    * Does nothing in Drupal 6.
    */
-  function upgradePermissions($module, $modulePermissions) {
+  function upgradePermissions($permissions) {
   }
 
   /**
-- 
2.25.1