crm.fsf.org/20131203/files/sites/all/modules-new/civicrm/CRM/Core/Permission.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.6                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2015                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2015
  32  * $Id$
  33  *
  34  */
  35
  36 /**
  37  * This is the basic permission class wrapper
  38  */
  39 class CRM_Core_Permission {
  40
  41   /**
  42    * Static strings used to compose permissions.
  43    *
  44    * @const
  45    * @var string
  46    */
  47   const EDIT_GROUPS = 'edit contacts in ', VIEW_GROUPS = 'view contacts in ';
  48
  49   /**
  50    * The various type of permissions.
  51    *
  52    * @var int
  53    */
  54   const EDIT = 1, VIEW = 2, DELETE = 3, CREATE = 4, SEARCH = 5, ALL = 6, ADMIN = 7;
  55
  56   /**
  57    * A placeholder permission which always fails.
  58    */
  59   const ALWAYS_DENY_PERMISSION = "*always deny*";
  60
  61   /**
  62    * A placeholder permission which always fails.
  63    */
  64   const ALWAYS_ALLOW_PERMISSION = "*always allow*";
  65
  66   /**
  67    * Various authentication sources.
  68    *
  69    * @var int
  70    */
  71   const AUTH_SRC_UNKNOWN = 0, AUTH_SRC_CHECKSUM = 1, AUTH_SRC_SITEKEY = 2, AUTH_SRC_LOGIN = 4;
  72
  73   /**
  74    * Get the current permission of this user.
  75    *
  76    * @return string
  77    *   the permission of the user (edit or view or null)
  78    */
  79   public static function getPermission() {
  80     $config = CRM_Core_Config::singleton();
  81     return $config->userPermissionClass->getPermission();
  82   }
  83
  84   /**
  85    * Given a permission string or array, check for access requirements
  86    * @param mixed $permissions
  87    *   The permission to check as an array or string -see examples.
  88    *   arrays
  89    *
  90    *  Ex 1
  91    *
  92    *  Must have 'access CiviCRM'
  93    *  (string) 'access CiviCRM'
  94    *
  95    *
  96    *  Ex 2 Must have 'access CiviCRM' and 'access Ajax API'
  97    *   array('access CiviCRM', 'access Ajax API')
  98    *
  99    *  Ex 3 Must have 'access CiviCRM' or 'access Ajax API'
 100    *   array(
 101    *      array('access CiviCRM', 'access Ajax API'),
 102    *   ),
 103    *
 104    *  Ex 4 Must have 'access CiviCRM' or 'access Ajax API' AND 'access CiviEvent'
 105    *  array(
 106    *    array('access CiviCRM', 'access Ajax API'),
 107    *    'access CiviEvent',
 108    *   ),
 109    *
 110    *  Note that in permissions.php this is keyed by the action eg.
 111    *  (access Civi || access AJAX) && (access CiviEvent || access CiviContribute)
 112    *  'myaction' => array(
 113    *    array('access CiviCRM', 'access Ajax API'),
 114    *    array('access CiviEvent', 'access CiviContribute')
 115    *  ),
 116    *
 117    * @return bool
 118    *   true if yes, else false
 119    */
 120   public static function check($permissions) {
 121     $permissions = (array) $permissions;
 122
 123     $tempPerm = CRM_Core_Config::singleton()->userPermissionTemp;
 124
 125     foreach ($permissions as $permission) {
 126       if (is_array($permission)) {
 127         foreach ($permission as $orPerm) {
 128           if (self::check($orPerm)) {
 129             //one of our 'or' permissions has succeeded - stop checking this permission
 130             return TRUE;;
 131           }
 132         }
 133         //none of our our conditions was met
 134         return FALSE;
 135       }
 136       else {
 137         if (
 138           !CRM_Core_Config::singleton()->userPermissionClass->check($permission)
 139           && !($tempPerm && $tempPerm->check($permission))
 140         ) {
 141           //one of our 'and' conditions has not been met
 142           return FALSE;
 143         }
 144       }
 145     }
 146     return TRUE;
 147   }
 148
 149   /**
 150    * Determine if any one of the permissions strings applies to current user.
 151    *
 152    * @param array $perms
 153    * @return bool
 154    */
 155   public static function checkAnyPerm($perms) {
 156     foreach ($perms as $perm) {
 157       if (CRM_Core_Permission::check($perm)) {
 158         return TRUE;
 159       }
 160     }
 161     return FALSE;
 162   }
 163
 164   /**
 165    * Given a group/role array, check for access requirements
 166    *
 167    * @param array $array
 168    *   The group/role to check.
 169    *
 170    * @return bool
 171    *   true if yes, else false
 172    */
 173   public static function checkGroupRole($array) {
 174     $config = CRM_Core_Config::singleton();
 175     return $config->userPermissionClass->checkGroupRole($array);
 176   }
 177
 178   /**
 179    * Get the permissioned where clause for the user.
 180    *
 181    * @param int $type
 182    *   The type of permission needed.
 183    * @param array $tables
 184    *   (reference ) add the tables that are needed for the select clause.
 185    * @param array $whereTables
 186    *   (reference ) add the tables that are needed for the where clause.
 187    *
 188    * @return string
 189    *   the group where clause for this user
 190    */
 191   public static function getPermissionedStaticGroupClause($type, &$tables, &$whereTables) {
 192     $config = CRM_Core_Config::singleton();
 193     return $config->userPermissionClass->getPermissionedStaticGroupClause($type, $tables, $whereTables);
 194   }
 195
 196   /**
 197    * Get all groups from database, filtered by permissions
 198    * for this user
 199    *
 200    * @param string $groupType
 201    *   Type of group(Access/Mailing).
 202    * @param bool $excludeHidden
 203    *   exclude hidden groups.
 204    *
 205    *
 206    * @return array
 207    *   array reference of all groups.
 208    */
 209   public static function group($groupType, $excludeHidden = TRUE) {
 210     $config = CRM_Core_Config::singleton();
 211     return $config->userPermissionClass->group($groupType, $excludeHidden);
 212   }
 213
 214   /**
 215    * @return bool
 216    */
 217   public static function customGroupAdmin() {
 218     $admin = FALSE;
 219
 220     // check if user has all powerful permission
 221     // or administer civicrm permission (CRM-1905)
 222     if (self::check('access all custom data')) {
 223       return TRUE;
 224     }
 225
 226     if (
 227       self::check('administer Multiple Organizations') &&
 228       self::isMultisiteEnabled()
 229     ) {
 230       return TRUE;
 231     }
 232
 233     if (self::check('administer CiviCRM')) {
 234       return TRUE;
 235     }
 236
 237     return FALSE;
 238   }
 239
 240   /**
 241    * @param int $type
 242    * @param bool $reset
 243    *
 244    * @return array
 245    */
 246   public static function customGroup($type = CRM_Core_Permission::VIEW, $reset = FALSE) {
 247     $customGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_CustomField', 'custom_group_id',
 248       array('fresh' => $reset));
 249     $defaultGroups = array();
 250
 251     // check if user has all powerful permission
 252     // or administer civicrm permission (CRM-1905)
 253     if (self::customGroupAdmin()) {
 254       $defaultGroups = array_keys($customGroups);
 255     }
 256
 257     return CRM_ACL_API::group($type, NULL, 'civicrm_custom_group', $customGroups, $defaultGroups);
 258   }
 259
 260   /**
 261    * @param int $type
 262    * @param null $prefix
 263    * @param bool $reset
 264    *
 265    * @return string
 266    */
 267   public static function customGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $reset = FALSE) {
 268     if (self::customGroupAdmin()) {
 269       return ' ( 1 ) ';
 270     }
 271
 272     $groups = self::customGroup($type, $reset);
 273     if (empty($groups)) {
 274       return ' ( 0 ) ';
 275     }
 276     else {
 277       return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
 278     }
 279   }
 280
 281   /**
 282    * @param int $gid
 283    * @param int $type
 284    *
 285    * @return bool
 286    */
 287   public static function ufGroupValid($gid, $type = CRM_Core_Permission::VIEW) {
 288     if (empty($gid)) {
 289       return TRUE;
 290     }
 291
 292     $groups = self::ufGroup($type);
 293     return !empty($groups) && in_array($gid, $groups) ? TRUE : FALSE;
 294   }
 295
 296   /**
 297    * @param int $type
 298    *
 299    * @return array
 300    */
 301   public static function ufGroup($type = CRM_Core_Permission::VIEW) {
 302     $ufGroups = CRM_Core_PseudoConstant::get('CRM_Core_DAO_UFField', 'uf_group_id');
 303
 304     $allGroups = array_keys($ufGroups);
 305
 306     // check if user has all powerful permission
 307     if (self::check('profile listings and forms')) {
 308       return $allGroups;
 309     }
 310
 311     switch ($type) {
 312       case CRM_Core_Permission::VIEW:
 313         if (self::check('profile view')) {
 314           return $allGroups;
 315         }
 316         break;
 317
 318       case CRM_Core_Permission::CREATE:
 319         if (self::check('profile create')) {
 320           return $allGroups;
 321         }
 322         break;
 323
 324       case CRM_Core_Permission::EDIT:
 325         if (self::check('profile edit')) {
 326           return $allGroups;
 327         }
 328         break;
 329
 330       case CRM_Core_Permission::SEARCH:
 331         if (self::check('profile listings')) {
 332           return $allGroups;
 333         }
 334         break;
 335     }
 336
 337     return CRM_ACL_API::group($type, NULL, 'civicrm_uf_group', $ufGroups);
 338   }
 339
 340   /**
 341    * @param int $type
 342    * @param null $prefix
 343    * @param bool $returnUFGroupIds
 344    *
 345    * @return array|string
 346    */
 347   public static function ufGroupClause($type = CRM_Core_Permission::VIEW, $prefix = NULL, $returnUFGroupIds = FALSE) {
 348     $groups = self::ufGroup($type);
 349     if ($returnUFGroupIds) {
 350       return $groups;
 351     }
 352     elseif (empty($groups)) {
 353       return ' ( 0 ) ';
 354     }
 355     else {
 356       return "{$prefix}id IN ( " . implode(',', $groups) . ' ) ';
 357     }
 358   }
 359
 360   /**
 361    * @param int $type
 362    * @param int $eventID
 363    * @param string $context
 364    *
 365    * @return array|null
 366    */
 367   public static function event($type = CRM_Core_Permission::VIEW, $eventID = NULL, $context = '') {
 368     if (!empty($context)) {
 369       if (CRM_Core_Permission::check($context)) {
 370         return TRUE;
 371       }
 372     }
 373     $events = CRM_Event_PseudoConstant::event(NULL, TRUE);
 374     $includeEvents = array();
 375
 376     // check if user has all powerful permission
 377     if (self::check('register for events')) {
 378       $includeEvents = array_keys($events);
 379     }
 380
 381     if ($type == CRM_Core_Permission::VIEW &&
 382       self::check('view event info')
 383     ) {
 384       $includeEvents = array_keys($events);
 385     }
 386
 387     $permissionedEvents = CRM_ACL_API::group($type, NULL, 'civicrm_event', $events, $includeEvents);
 388     if (!$eventID) {
 389       return $permissionedEvents;
 390     }
 391     if (!empty($permissionedEvents)) {
 392       return array_search($eventID, $permissionedEvents) === FALSE ? NULL : $eventID;
 393     }
 394     return NULL;
 395   }
 396
 397   /**
 398    * @param int $type
 399    * @param null $prefix
 400    *
 401    * @return string
 402    */
 403   public static function eventClause($type = CRM_Core_Permission::VIEW, $prefix = NULL) {
 404     $events = self::event($type);
 405     if (empty($events)) {
 406       return ' ( 0 ) ';
 407     }
 408     else {
 409       return "{$prefix}id IN ( " . implode(',', $events) . ' ) ';
 410     }
 411   }
 412
 413   /**
 414    * @param $module
 415    * @param bool $checkPermission
 416    *
 417    * @return bool
 418    */
 419   public static function access($module, $checkPermission = TRUE) {
 420     $config = CRM_Core_Config::singleton();
 421
 422     if (!in_array($module, $config->enableComponents)) {
 423       return FALSE;
 424     }
 425
 426     if ($checkPermission) {
 427       if ($module == 'CiviCase') {
 428         return CRM_Case_BAO_Case::accessCiviCase();
 429       }
 430       else {
 431         return CRM_Core_Permission::check("access $module");
 432       }
 433     }
 434
 435     return TRUE;
 436   }
 437
 438   /**
 439    * Check permissions for delete and edit actions.
 440    *
 441    * @param string $module
 442    *   Component name.
 443    * @param int $action
 444    *   Action to be check across component.
 445    *
 446    *
 447    * @return bool
 448    */
 449   public static function checkActionPermission($module, $action) {
 450     //check delete related permissions.
 451     if ($action & CRM_Core_Action::DELETE) {
 452       $permissionName = "delete in $module";
 453     }
 454     else {
 455       $editPermissions = array(
 456         'CiviEvent' => 'edit event participants',
 457         'CiviMember' => 'edit memberships',
 458         'CiviPledge' => 'edit pledges',
 459         'CiviContribute' => 'edit contributions',
 460         'CiviGrant' => 'edit grants',
 461         'CiviMail' => 'access CiviMail',
 462         'CiviAuction' => 'add auction items',
 463       );
 464       $permissionName = CRM_Utils_Array::value($module, $editPermissions);
 465     }
 466
 467     if ($module == 'CiviCase' && !$permissionName) {
 468       return CRM_Case_BAO_Case::accessCiviCase();
 469     }
 470     else {
 471       //check for permission.
 472       return CRM_Core_Permission::check($permissionName);
 473     }
 474   }
 475
 476   /**
 477    * @param $args
 478    * @param string $op
 479    *
 480    * @return bool
 481    */
 482   public static function checkMenu(&$args, $op = 'and') {
 483     if (!is_array($args)) {
 484       return $args;
 485     }
 486     foreach ($args as $str) {
 487       $res = CRM_Core_Permission::check($str);
 488       if ($op == 'or' && $res) {
 489         return TRUE;
 490       }
 491       elseif ($op == 'and' && !$res) {
 492         return FALSE;
 493       }
 494     }
 495     return ($op == 'or') ? FALSE : TRUE;
 496   }
 497
 498   /**
 499    * @param $item
 500    *
 501    * @return bool|mixed
 502    * @throws Exception
 503    */
 504   public static function checkMenuItem(&$item) {
 505     if (!array_key_exists('access_callback', $item)) {
 506       CRM_Core_Error::backtrace();
 507       CRM_Core_Error::fatal();
 508     }
 509
 510     // if component_id is present, ensure it is enabled
 511     if (isset($item['component_id']) &&
 512       $item['component_id']
 513     ) {
 514       $config = CRM_Core_Config::singleton();
 515       if (is_array($config->enableComponentIDs) &&
 516         in_array($item['component_id'], $config->enableComponentIDs)
 517       ) {
 518         // continue with process
 519       }
 520       else {
 521         return FALSE;
 522       }
 523     }
 524
 525     // the following is imitating drupal 6 code in includes/menu.inc
 526     if (empty($item['access_callback']) ||
 527       is_numeric($item['access_callback'])
 528     ) {
 529       return (boolean ) $item['access_callback'];
 530     }
 531
 532     // check whether the following Ajax requests submitted the right key
 533     // FIXME: this should be integrated into ACLs proper
 534     if (CRM_Utils_Array::value('page_type', $item) == 3) {
 535       if (!CRM_Core_Key::validate($_REQUEST['key'], $item['path'])) {
 536         return FALSE;
 537       }
 538     }
 539
 540     // check if callback is for checkMenu, if so optimize it
 541     if (is_array($item['access_callback']) &&
 542       $item['access_callback'][0] == 'CRM_Core_Permission' &&
 543       $item['access_callback'][1] == 'checkMenu'
 544     ) {
 545       $op = CRM_Utils_Array::value(1, $item['access_arguments'], 'and');
 546       return self::checkMenu($item['access_arguments'][0], $op);
 547     }
 548     else {
 549       return call_user_func_array($item['access_callback'], $item['access_arguments']);
 550     }
 551   }
 552
 553   /**
 554    * @param bool $all
 555    * @param bool $descriptions
 556    *   whether to return descriptions
 557    *
 558    * @return array
 559    */
 560   public static function &basicPermissions($all = FALSE, $descriptions = FALSE) {
 561     if ($descriptions) {
 562       static $permissionsDesc = NULL;
 563
 564       if (!$permissionsDesc) {
 565         $permissionsDesc = self::assembleBasicPermissions($all, $descriptions);
 566       }
 567
 568       return $permissionsDesc;
 569     }
 570     else {
 571       static $permissions = NULL;
 572
 573       if (!$permissions) {
 574         $permissions = self::assembleBasicPermissions($all, $descriptions);
 575       }
 576
 577       return $permissions;
 578     }
 579   }
 580
 581   /**
 582    * @param bool $all
 583    * @param bool $descriptions
 584    *   whether to return descriptions
 585    *
 586    * @return array
 587    */
 588   public static function assembleBasicPermissions($all = FALSE, $descriptions = FALSE) {
 589     $config = CRM_Core_Config::singleton();
 590     $prefix = ts('CiviCRM') . ': ';
 591     $permissions = self::getCorePermissions($descriptions);
 592
 593     if (self::isMultisiteEnabled()) {
 594       $permissions['administer Multiple Organizations'] = array($prefix . ts('administer Multiple Organizations'));
 595     }
 596
 597     if (!$descriptions) {
 598       foreach ($permissions as $name => $attr) {
 599         $permissions[$name] = array_shift($attr);
 600       }
 601     }
 602     if (!$all) {
 603       $components = CRM_Core_Component::getEnabledComponents();
 604     }
 605     else {
 606       $components = CRM_Core_Component::getComponents();
 607     }
 608
 609     foreach ($components as $comp) {
 610       $perm = $comp->getPermissions(FALSE, $descriptions);
 611       if ($perm) {
 612         $info = $comp->getInfo();
 613         foreach ($perm as $p => $attr) {
 614
 615           if (!is_array($attr)) {
 616             $attr = array($attr);
 617           }
 618
 619           $attr[0] = $info['translatedName'] . ': ' . $attr[0];
 620
 621           if ($descriptions) {
 622             $permissions[$p] = $attr;
 623           }
 624           else {
 625             $permissions[$p] = $attr[0];
 626           }
 627         }
 628       }
 629     }
 630
 631     // Add any permissions defined in hook_civicrm_permission implementations.
 632     $module_permissions = $config->userPermissionClass->getAllModulePermissions($descriptions);
 633     $permissions = array_merge($permissions, $module_permissions);
 634     return $permissions;
 635   }
 636
 637   /**
 638    * @return array
 639    */
 640   public static function getAnonymousPermissionsWarnings() {
 641     static $permissions = array();
 642     if (empty($permissions)) {
 643       $permissions = array(
 644         'administer CiviCRM',
 645       );
 646       $components = CRM_Core_Component::getComponents();
 647       foreach ($components as $comp) {
 648         if (!method_exists($comp, 'getAnonymousPermissionWarnings')) {
 649           continue;
 650         }
 651         $permissions = array_merge($permissions, $comp->getAnonymousPermissionWarnings());
 652       }
 653     }
 654     return $permissions;
 655   }
 656
 657   /**
 658    * @param $anonymous_perms
 659    *
 660    * @return array
 661    */
 662   public static function validateForPermissionWarnings($anonymous_perms) {
 663     return array_intersect($anonymous_perms, self::getAnonymousPermissionsWarnings());
 664   }
 665
 666   /**
 667    * Get core permissions.
 668    *
 669    * @return array
 670    */
 671   public static function getCorePermissions() {
 672     $prefix = ts('CiviCRM') . ': ';
 673     $permissions = array(
 674       'add contacts' => array(
 675         $prefix . ts('add contacts'),
 676         ts('Create a new contact record in CiviCRM'),
 677       ),
 678       'view all contacts' => array(
 679         $prefix . ts('view all contacts'),
 680         ts('View ANY CONTACT in the CiviCRM database, export contact info and perform activities such as Send Email, Phone Call, etc.'),
 681       ),
 682       'edit all contacts' => array(
 683         $prefix . ts('edit all contacts'),
 684         ts('View, Edit and Delete ANY CONTACT in the CiviCRM database; Create and edit relationships, tags and other info about the contacts'),
 685       ),
 686       'view my contact' => array(
 687         $prefix . ts('view my contact'),
 688       ),
 689       'edit my contact' => array(
 690         $prefix . ts('edit my contact'),
 691       ),
 692       'delete contacts' => array(
 693         $prefix . ts('delete contacts'),
 694       ),
 695       'access deleted contacts' => array(
 696         $prefix . ts('access deleted contacts'),
 697         ts('Access contacts in the trash'),
 698       ),
 699       'import contacts' => array(
 700         $prefix . ts('import contacts'),
 701         ts('Import contacts and activities'),
 702       ),
 703       'import SQL datasource' => array(
 704         $prefix . ts('import SQL datasource'),
 705         ts('When importing, consume data directly from a SQL datasource'),
 706       ),
 707       'edit groups' => array(
 708         $prefix . ts('edit groups'),
 709         ts('Create new groups, edit group settings (e.g. group name, visibility...), delete groups'),
 710       ),
 711       'administer CiviCRM' => array(
 712         $prefix . ts('administer CiviCRM'),
 713         ts('Perform all tasks in the Administer CiviCRM control panel and Import Contacts'),
 714       ),
 715       'skip IDS check' => array(
 716         $prefix . ts('skip IDS check'),
 717         ts('IDS system is bypassed for users with this permission. Prevents false errors for admin users.'),
 718       ),
 719       'access uploaded files' => array(
 720         $prefix . ts('access uploaded files'),
 721         ts('View / download files including images and photos'),
 722       ),
 723       'profile listings and forms' => array(
 724         $prefix . ts('profile listings and forms'),
 725         ts('Access the profile Search form and listings'),
 726       ),
 727       'profile listings' => array(
 728         $prefix . ts('profile listings'),
 729       ),
 730       'profile create' => array(
 731         $prefix . ts('profile create'),
 732         ts('Use profiles in Create mode'),
 733       ),
 734       'profile edit' => array(
 735         $prefix . ts('profile edit'),
 736         ts('Use profiles in Edit mode'),
 737       ),
 738       'profile view' => array(
 739         $prefix . ts('profile view'),
 740       ),
 741       'access all custom data' => array(
 742         $prefix . ts('access all custom data'),
 743         ts('View all custom fields regardless of ACL rules'),
 744       ),
 745       'view all activities' => array(
 746         $prefix . ts('view all activities'),
 747         ts('View all activities (for visible contacts)'),
 748       ),
 749       'delete activities' => array(
 750         $prefix . ts('Delete activities'),
 751       ),
 752       'access CiviCRM' => array(
 753         $prefix . ts('access CiviCRM'),
 754         ts('Master control for access to the main CiviCRM backend and API'),
 755       ),
 756       'access Contact Dashboard' => array(
 757         $prefix . ts('access Contact Dashboard'),
 758         ts('View Contact Dashboard (for themselves and visible contacts)'),
 759       ),
 760       'translate CiviCRM' => array(
 761         $prefix . ts('translate CiviCRM'),
 762         ts('Allow User to enable multilingual'),
 763       ),
 764       'administer reserved groups' => array(
 765         $prefix . ts('administer reserved groups'),
 766         ts('Edit and disable Reserved Groups (Needs Edit Groups)'),
 767       ),
 768       'administer Tagsets' => array(
 769         $prefix . ts('administer Tagsets'),
 770       ),
 771       'administer reserved tags' => array(
 772         $prefix . ts('administer reserved tags'),
 773       ),
 774       'administer dedupe rules' => array(
 775         $prefix . ts('administer dedupe rules'),
 776         ts('Create and edit rules, change the supervised and unsupervised rules'),
 777       ),
 778       'merge duplicate contacts' => array(
 779         $prefix . ts('merge duplicate contacts'),
 780         ts('Delete Contacts must also be granted in order for this to work.'),
 781       ),
 782       'view debug output' => array(
 783         $prefix . ts('view debug output'),
 784         ts('View results of debug and backtrace'),
 785       ),
 786       'view all notes' => array(
 787         $prefix . ts('view all notes'),
 788         ts("View notes (for visible contacts) even if they're marked admin only"),
 789       ),
 790       'access AJAX API' => array(
 791         $prefix . ts('access AJAX API'),
 792         ts('Allow API access even if Access CiviCRM is not granted'),
 793       ),
 794       'access contact reference fields' => array(
 795         $prefix . ts('access contact reference fields'),
 796         ts('Allow entering data into contact reference fields'),
 797       ),
 798       'create manual batch' => array(
 799         $prefix . ts('create manual batch'),
 800         ts('Create an accounting batch (with Access to CiviContribute and View Own/All Manual Batches)'),
 801       ),
 802       'edit own manual batches' => array(
 803         $prefix . ts('edit own manual batches'),
 804         ts('Edit accounting batches created by user'),
 805       ),
 806       'edit all manual batches' => array(
 807         $prefix . ts('edit all manual batches'),
 808         ts('Edit all accounting batches'),
 809       ),
 810       'view own manual batches' => array(
 811         $prefix . ts('view own manual batches'),
 812         ts('View accounting batches created by user (with Access to CiviContribute)'),
 813       ),
 814       'view all manual batches' => array(
 815         $prefix . ts('view all manual batches'),
 816         ts('View all accounting batches (with Access to CiviContribute)'),
 817       ),
 818       'delete own manual batches' => array(
 819         $prefix . ts('delete own manual batches'),
 820         ts('Delete accounting batches created by user'),
 821       ),
 822       'delete all manual batches' => array(
 823         $prefix . ts('delete all manual batches'),
 824         ts('Delete all accounting batches'),
 825       ),
 826       'export own manual batches' => array(
 827         $prefix . ts('export own manual batches'),
 828         ts('Export accounting batches created by user'),
 829       ),
 830       'export all manual batches' => array(
 831         $prefix . ts('export all manual batches'),
 832         ts('Export all accounting batches'),
 833       ),
 834       'administer payment processors' => array(
 835         $prefix . ts('administer payment processors'),
 836         ts('Add, Update, or Disable Payment Processors'),
 837       ),
 838       'edit message templates' => array(
 839         $prefix . ts('edit message templates'),
 840       ),
 841       'view my invoices' => array(
 842         $prefix . ts('view my invoices'),
 843         ts('Allow users to view/ download their own invoices'),
 844       ),
 845       'edit api keys' => array(
 846         $prefix . ts('edit api keys'),
 847         ts('Edit API keys'),
 848       ),
 849       'edit own api keys' => array(
 850         $prefix . ts('edit own api keys'),
 851         ts('Edit user\'s own API keys'),
 852       ),
 853     );
 854
 855     return $permissions;
 856   }
 857
 858   /**
 859    * Validate user permission across.
 860    * edit or view or with supportable acls.
 861    *
 862    * @return bool
 863    */
 864   public static function giveMeAllACLs() {
 865     if (CRM_Core_Permission::check('view all contacts') ||
 866       CRM_Core_Permission::check('edit all contacts')
 867     ) {
 868       return TRUE;
 869     }
 870
 871     $session = CRM_Core_Session::singleton();
 872     $contactID = $session->get('userID');
 873
 874     //check for acl.
 875     $aclPermission = self::getPermission();
 876     if (in_array($aclPermission, array(
 877       CRM_Core_Permission::EDIT,
 878       CRM_Core_Permission::VIEW,
 879     ))
 880     ) {
 881       return TRUE;
 882     }
 883
 884     // run acl where hook and see if the user is supplying an ACL clause
 885     // that is not false
 886     $tables = $whereTables = array();
 887     $where = NULL;
 888
 889     CRM_Utils_Hook::aclWhereClause(CRM_Core_Permission::VIEW,
 890       $tables, $whereTables,
 891       $contactID, $where
 892     );
 893     return empty($whereTables) ? FALSE : TRUE;
 894   }
 895
 896   /**
 897    * Get component name from given permission.
 898    *
 899    * @param string $permission
 900    *
 901    * @return null|string
 902    *   the name of component.
 903    */
 904   public static function getComponentName($permission) {
 905     $componentName = NULL;
 906     $permission = trim($permission);
 907     if (empty($permission)) {
 908       return $componentName;
 909     }
 910
 911     static $allCompPermissions = array();
 912     if (empty($allCompPermissions)) {
 913       $components = CRM_Core_Component::getComponents();
 914       foreach ($components as $name => $comp) {
 915         //get all permissions of each components unconditionally
 916         $allCompPermissions[$name] = $comp->getPermissions(TRUE);
 917       }
 918     }
 919
 920     if (is_array($allCompPermissions)) {
 921       foreach ($allCompPermissions as $name => $permissions) {
 922         if (array_key_exists($permission, $permissions)) {
 923           $componentName = $name;
 924           break;
 925         }
 926       }
 927     }
 928
 929     return $componentName;
 930   }
 931
 932   /**
 933    * Get all the contact emails for users that have a specific permission.
 934    *
 935    * @param string $permissionName
 936    *   Name of the permission we are interested in.
 937    *
 938    * @return string
 939    *   a comma separated list of email addresses
 940    */
 941   public static function permissionEmails($permissionName) {
 942     $config = CRM_Core_Config::singleton();
 943     return $config->userPermissionClass->permissionEmails($permissionName);
 944   }
 945
 946   /**
 947    * Get all the contact emails for users that have a specific role.
 948    *
 949    * @param string $roleName
 950    *   Name of the role we are interested in.
 951    *
 952    * @return string
 953    *   a comma separated list of email addresses
 954    */
 955   public static function roleEmails($roleName) {
 956     $config = CRM_Core_Config::singleton();
 957     return $config->userRoleClass->roleEmails($roleName);
 958   }
 959
 960   /**
 961    * @return bool
 962    */
 963   public static function isMultisiteEnabled() {
 964     return CRM_Core_BAO_Setting::getItem(CRM_Core_BAO_Setting::MULTISITE_PREFERENCES_NAME,
 965       'is_enabled'
 966     ) ? TRUE : FALSE;
 967   }
 968
 969   /**
 970    * Verify if the user has permission to get the invoice.
 971    *
 972    * @return bool
 973    *   TRUE if the user has download all invoices permission or download my
 974    *   invoices permission and the invoice author is the current user.
 975    */
 976   public static function checkDownloadInvoice() {
 977     global $user;
 978     $cid = CRM_Core_BAO_UFMatch::getContactId($user->uid);
 979     if (CRM_Core_Permission::check('access CiviContribute') ||
 980       (CRM_Core_Permission::check('view my invoices') && $_GET['cid'] == $cid)
 981     ) {
 982       return TRUE;
 983     }
 984     return FALSE;
 985   }
 986
 987 }