From deaf7a83916316170b0d3aa728e8ed41f2d039dc Mon Sep 17 00:00:00 2001
From: larssandergreen <lars@wildsight.ca>
Date: Sun, 2 Jul 2023 22:41:36 -0600
Subject: [PATCH] Don't show SQL text in SK if user does not have view debug
 permission

---
 ext/search_kit/ang/crmSearchAdmin.ang.php                 | 1 +
 .../resultsTable/crmSearchAdminResultsTable.component.js  | 3 +++
 ext/search_kit/ang/crmSearchAdmin/resultsTable/debug.html | 8 +++++---
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/ext/search_kit/ang/crmSearchAdmin.ang.php b/ext/search_kit/ang/crmSearchAdmin.ang.php
index 505641b613..dece897b1b 100644
--- a/ext/search_kit/ang/crmSearchAdmin.ang.php
+++ b/ext/search_kit/ang/crmSearchAdmin.ang.php
@@ -21,5 +21,6 @@ return [
     'all CiviCRM permissions and ACLs',
     'administer CiviCRM',
     'administer afform',
+    'view debug output',
   ],
 ];
diff --git a/ext/search_kit/ang/crmSearchAdmin/resultsTable/crmSearchAdminResultsTable.component.js b/ext/search_kit/ang/crmSearchAdmin/resultsTable/crmSearchAdminResultsTable.component.js
index 2e7d40857f..a9ba405422 100644
--- a/ext/search_kit/ang/crmSearchAdmin/resultsTable/crmSearchAdminResultsTable.component.js
+++ b/ext/search_kit/ang/crmSearchAdmin/resultsTable/crmSearchAdminResultsTable.component.js
@@ -26,6 +26,9 @@
         ctrl.debug = {
           apiParams: JSON.stringify(ctrl.search.api_params, null, 2)
         };
+        ctrl.perm = {
+          viewDebugOutput: CRM.checkPerm('view debug output'),
+        };
         ctrl.results = null;
         ctrl.rowCount = null;
         ctrl.page = 1;
diff --git a/ext/search_kit/ang/crmSearchAdmin/resultsTable/debug.html b/ext/search_kit/ang/crmSearchAdmin/resultsTable/debug.html
index f80476cdaf..a61f99abe9 100644
--- a/ext/search_kit/ang/crmSearchAdmin/resultsTable/debug.html
+++ b/ext/search_kit/ang/crmSearchAdmin/resultsTable/debug.html
@@ -9,8 +9,10 @@
       <strong>API:</strong>
     </div>
     <pre>{{ $ctrl.debug.apiParams }}</pre>
-    <strong>SQL:</strong>
-    <pre ng-if="!$ctrl.debug.sql">{{:: ts('Run search to view SQL') }}</pre>
-    <pre ng-repeat="query in $ctrl.debug.sql">{{ query }}</pre>
+    <div ng-if="$ctrl.perm.viewDebugOutput">
+      <strong>SQL:</strong>
+      <pre ng-if="!$ctrl.debug.sql">{{:: ts('Run search to view SQL') }}</pre>
+      <pre ng-repeat="query in $ctrl.debug.sql">{{ query }}</pre>
+    </div>
   </div>
 </fieldset>
-- 
2.25.1