From f362c53186762e18649a26875f6bf7132ded7832 Mon Sep 17 00:00:00 2001
From: Tim Otten <totten@civicrm.org>
Date: Wed, 3 Feb 2021 19:46:12 -0800
Subject: [PATCH] Afform.prefill - Allow anonymous requests

This API has its own security checks
---
 ext/afform/core/afform.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/ext/afform/core/afform.php b/ext/afform/core/afform.php
index 54fe6e8c6e..87c4e24337 100644
--- a/ext/afform/core/afform.php
+++ b/ext/afform/core/afform.php
@@ -394,7 +394,9 @@ function _afform_angular_module_name($fileBaseName, $format = 'camel') {
  * @see CRM_Utils_Hook::alterApiRoutePermissions
  */
 function afform_civicrm_alterApiRoutePermissions(&$permissions, $entity, $action) {
-  if ($entity == 'Afform' && $action == 'submit') {
-    $permissions = CRM_Core_Permission::ALWAYS_ALLOW_PERMISSION;
+  if ($entity == 'Afform') {
+    if ($action == 'prefill' || $action == 'submit') {
+      $permissions = CRM_Core_Permission::ALWAYS_ALLOW_PERMISSION;
+    }
   }
 }
-- 
2.25.1