From d1dd7d0761a172bd6bddf99c66c7c22e48bdfeff Mon Sep 17 00:00:00 2001
From: William Mortada <williammortada@thirdsectordesign.org>
Date: Wed, 6 Dec 2023 00:12:51 +0000
Subject: [PATCH] Standalone - prevent users from deleting own user

---
 .../CRM/Standaloneusers/BAO/User.php          | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/ext/standaloneusers/CRM/Standaloneusers/BAO/User.php b/ext/standaloneusers/CRM/Standaloneusers/BAO/User.php
index b66d9c4bc0..bfbb09a837 100644
--- a/ext/standaloneusers/CRM/Standaloneusers/BAO/User.php
+++ b/ext/standaloneusers/CRM/Standaloneusers/BAO/User.php
@@ -41,4 +41,26 @@ class CRM_Standaloneusers_BAO_User extends CRM_Standaloneusers_DAO_User implemen
     return $timeZones;
   }
 
+  /**
+   * Check access permission
+   *
+   * @param string $entityName
+   * @param string $action
+   * @param array $record
+   * @param integer|null $userID
+   * @return boolean
+   * @see CRM_Core_DAO::checkAccess
+   */
+  public static function _checkAccess(string $entityName, string $action, array $record, ?int $userID): bool {
+    // Prevent users from deleting their own user account
+    if (in_array($action, ['delete'], TRUE)) {
+      $sess = CRM_Core_Session::singleton();
+      $ufID = (int) $sess->get('ufID');
+      if ($record['id'] == $ufID) {
+        return FALSE;
+      };
+    }
+    return TRUE;
+  }
+
 }
-- 
2.25.1