/** * Decide what permissions to check for an api call * The contact must have all of the returned permissions for the api call to be allowed * * @param $entity: (str) api entity * @param $action: (str) api action * @param $params: (array) api params * * @return array of permissions to check for this entity-action combo */ function _civicrm_api3_permissions($entity, $action, &$params) { $entity = _civicrm_api_get_entity_name_from_camel($entity); $action = strtolower($action); /** * @var array of permissions * * For each entity, we declare an array of permissions required for each action * The action is the array key, possible values: * * create: applies to create (with no id in params) * * update: applies to update, setvalue, create (with id in params) * * get: applies to getcount, getsingle, getvalue and other gets * * delete: applies to delete, replace * * meta: applies to getfields, getoptions, getspec * * default: catch-all for anything not declared * * Note: some APIs declare other actions as well */ $permissions = array(); // These are the default permissions - if any entity does not declare permissions for a given action, // (or the entity does not declare permissions at all) - then the action will be used from here $permissions['default'] = array('meta' => array('access CiviCRM'), 'default' => array('administer CiviCRM')); // Contact permissions $permissions['contact'] = array('create' => array('access CiviCRM', 'add contacts'), 'delete' => array('access CiviCRM', 'delete contacts'), 'get' => array(), 'update' => array('access CiviCRM', 'edit all contacts'), 'getquick' => array(array('access CiviCRM', 'access AJAX API'))); // Contact-related data permissions $permissions['address'] = array('get' => array('access CiviCRM', 'view all contacts'), 'delete' => array('access CiviCRM', 'delete contacts'), 'default' => array('access CiviCRM', 'edit all contacts')); $permissions['email'] = $permissions['address']; $permissions['phone'] = $permissions['address']; $permissions['website'] = $permissions['address']; $permissions['im'] = $permissions['address']; $permissions['loc_block'] = $permissions['address']; $permissions['entity_tag'] = $permissions['address']; $permissions['note'] = $permissions['address']; // Activity permissions $permissions['activity'] = array('delete' => array('access CiviCRM', 'delete activities'), 'default' => array('access CiviCRM', 'view all activities')); // Case permissions $permissions['case'] = array('create' => array('access CiviCRM', 'add cases'), 'delete' => array('access CiviCRM', 'delete in CiviCase'), 'default' => array('access CiviCRM', 'access all cases and activities')); // Financial permissions $permissions['contribution'] = array('get' => array('access CiviCRM', 'access CiviContribute'), 'delete' => array('access CiviCRM', 'access CiviContribute', 'delete in CiviContribute'), 'completetransaction' => array('edit contributions'), 'default' => array('access CiviCRM', 'access CiviContribute', 'edit contributions')); $permissions['line_item'] = $permissions['contribution']; // Custom field permissions $permissions['custom_field'] = array('default' => array('administer CiviCRM', 'access all custom data')); $permissions['custom_group'] = $permissions['custom_field']; // Event permissions $permissions['event'] = array('create' => array('access CiviCRM', 'access CiviEvent', 'edit all events'), 'delete' => array('access CiviCRM', 'access CiviEvent', 'delete in CiviEvent'), 'get' => array('access CiviCRM', 'access CiviEvent', 'view event info'), 'update' => array('access CiviCRM', 'access CiviEvent', 'edit all events')); // File permissions $permissions['file'] = array('default' => array('access CiviCRM', 'access uploaded files')); $permissions['files_by_entity'] = $permissions['file']; // Group permissions $permissions['group'] = array('get' => array('access CiviCRM'), 'default' => array('access CiviCRM', 'edit groups')); $permissions['group_contact'] = $permissions['group']; $permissions['group_nesting'] = $permissions['group']; $permissions['group_organization'] = $permissions['group']; // Membership permissions $permissions['membership'] = array('get' => array('access CiviCRM', 'access CiviMember'), 'delete' => array('access CiviCRM', 'access CiviMember', 'delete in CiviMember'), 'default' => array('access CiviCRM', 'access CiviMember', 'edit memberships')); $permissions['membership_status'] = $permissions['membership']; $permissions['membership_type'] = $permissions['membership']; $permissions['membership_payment'] = array('create' => array('access CiviCRM', 'access CiviMember', 'edit memberships', 'access CiviContribute', 'edit contributions'), 'delete' => array('access CiviCRM', 'access CiviMember', 'delete in CiviMember', 'access CiviContribute', 'delete in CiviContribute'), 'get' => array('access CiviCRM', 'access CiviMember', 'access CiviContribute'), 'update' => array('access CiviCRM', 'access CiviMember', 'edit memberships', 'access CiviContribute', 'edit contributions')); // Participant permissions $permissions['participant'] = array('create' => array('access CiviCRM', 'access CiviEvent', 'register for events'), 'delete' => array('access CiviCRM', 'access CiviEvent', 'edit event participants'), 'get' => array('access CiviCRM', 'access CiviEvent', 'view event participants'), 'update' => array('access CiviCRM', 'access CiviEvent', 'edit event participants')); $permissions['participant_payment'] = array('create' => array('access CiviCRM', 'access CiviEvent', 'register for events', 'access CiviContribute', 'edit contributions'), 'delete' => array('access CiviCRM', 'access CiviEvent', 'edit event participants', 'access CiviContribute', 'delete in CiviContribute'), 'get' => array('access CiviCRM', 'access CiviEvent', 'view event participants', 'access CiviContribute'), 'update' => array('access CiviCRM', 'access CiviEvent', 'edit event participants', 'access CiviContribute', 'edit contributions')); // Pledge permissions $permissions['pledge'] = array('create' => array('access CiviCRM', 'access CiviPledge', 'edit pledges'), 'delete' => array('access CiviCRM', 'access CiviPledge', 'delete in CiviPledge'), 'get' => array('access CiviCRM', 'access CiviPledge'), 'update' => array('access CiviCRM', 'access CiviPledge', 'edit pledges')); $permissions['pledge_payment'] = array('create' => array('access CiviCRM', 'access CiviPledge', 'edit pledges', 'access CiviContribute', 'edit contributions'), 'delete' => array('access CiviCRM', 'access CiviPledge', 'delete in CiviPledge', 'access CiviContribute', 'delete in CiviContribute'), 'get' => array('access CiviCRM', 'access CiviPledge', 'access CiviContribute'), 'update' => array('access CiviCRM', 'access CiviPledge', 'edit pledges', 'access CiviContribute', 'edit contributions')); // Profile permissions $permissions['profile'] = array('get' => array()); $permissions['uf_group'] = array('get' => array('access CiviCRM')); $permissions['uf_field'] = $permissions['uf_group']; // Translate 'create' action to 'update' if id is set if ($action == 'create' && (!empty($params['id']) || !empty($params[$entity . '_id']))) { $action = 'update'; } // let third parties modify the permissions CRM_Utils_Hook::alterAPIPermissions($entity, $action, $params, $permissions); // Merge permissions for this entity with the defaults $perm = CRM_Utils_Array::value($entity, $permissions, array()) + $permissions['default']; // Return exact match if permission for this action has been declared if (isset($perm[$action])) { return $perm[$action]; } // Translate specific actions into their generic equivalents $snippet = substr($action, 0, 3); if ($action == 'replace' || $snippet == 'del') { // 'Replace' is a combination of get+create+update+delete; however, the permissions // on each of those will be tested separately at runtime. This is just a sniff-test // based on the heuristic that 'delete' tends to be the most closesly guarded // of the necessary permissions. $action = 'delete'; } elseif ($action == 'setvalue' || $snippet == 'upd') { $action = 'update'; } elseif ($action == 'getfields' || $action == 'getspec' || $action == 'getoptions') { $action = 'meta'; } elseif ($snippet == 'get') { $action = 'get'; } return isset($perm[$action]) ? $perm[$action] : $perm['default']; }
/** * Decide what permissions to check for an api call * * @param $entity : (str) api entity * @param $action : (str) api action * @param $params : (array) api params * * @return array * Array of permissions to check for this entity-action combo */ function _civicrm_api3_permissions($entity, $action, &$params) { // FIXME: Lowercase entity_names are nonstandard but difficult to fix here // because this function invokes hook_civicrm_alterAPIPermissions $entity = _civicrm_api_get_entity_name_from_camel($entity); /** * @var array of permissions * * For each entity, we declare an array of permissions required for each action * The action is the array key, possible values: * * create: applies to create (with no id in params) * * update: applies to update, setvalue, create (with id in params) * * get: applies to getcount, getsingle, getvalue and other gets * * delete: applies to delete, replace * * meta: applies to getfields, getoptions, getspec * * default: catch-all for anything not declared * * Note: some APIs declare other actions as well * * Permissions should use arrays for AND and arrays of arrays for OR * @see CRM_Core_Permission::check for more documentation */ $permissions = array(); // These are the default permissions - if any entity does not declare permissions for a given action, // (or the entity does not declare permissions at all) - then the action will be used from here $permissions['default'] = array('meta' => array('access CiviCRM'), 'default' => array('administer CiviCRM')); // Note: Additional permissions in DynamicFKAuthorization $permissions['attachment'] = array('default' => array(array('access CiviCRM', 'access AJAX API'))); // Contact permissions $permissions['contact'] = array('create' => array('access CiviCRM', 'add contacts'), 'delete' => array('access CiviCRM', 'delete contacts'), 'get' => array(), 'update' => array(), 'getquick' => array(array('access CiviCRM', 'access AJAX API'))); // CRM-16963 - Permissions for country. $permissions['country'] = array('get' => array('access CiviCRM'), 'default' => array('administer CiviCRM')); // Contact-related data permissions. $permissions['address'] = array('default' => array()); $permissions['email'] = $permissions['address']; $permissions['phone'] = $permissions['address']; $permissions['website'] = $permissions['address']; $permissions['im'] = $permissions['address']; // @todo - implement CRM_Core_BAO_EntityTag::addSelectWhereClause and remove this heavy-handed restriction $permissions['entity_tag'] = array('get' => array('access CiviCRM', 'view all contacts'), 'default' => array('access CiviCRM', 'edit all contacts')); // @todo - ditto $permissions['note'] = $permissions['entity_tag']; // Allow non-admins to get and create tags to support tagset widget // Delete is still reserved for admins $permissions['tag'] = array('get' => array('access CiviCRM'), 'create' => array('access CiviCRM'), 'update' => array('access CiviCRM')); //relationship permissions $permissions['relationship'] = array('get' => array(), 'delete' => array('access CiviCRM', 'edit all contacts'), 'default' => array('access CiviCRM', 'edit all contacts')); // CRM-17741 - Permissions for RelationshipType. $permissions['relationship_type'] = array('get' => array('access CiviCRM'), 'default' => array('administer CiviCRM')); // Activity permissions $permissions['activity'] = array('delete' => array('access CiviCRM', 'delete activities'), 'default' => array('access CiviCRM', 'view all activities')); // Case permissions $permissions['case'] = array('create' => array('access CiviCRM', 'add cases'), 'delete' => array('access CiviCRM', 'delete in CiviCase'), 'default' => array(array('access my cases and activities', 'access all cases and activities'))); $permissions['case_contact'] = $permissions['case']; $permissions['case_type'] = array('default' => array('administer CiviCase'), 'get' => array(array('access my cases and activities', 'access all cases and activities'))); // Campaign permissions $permissions['campaign'] = array('get' => array('access CiviCRM'), 'default' => array(array('administer CiviCampaign', 'manage campaign'))); $permissions['survey'] = $permissions['campaign']; // Financial permissions $permissions['contribution'] = array('get' => array('access CiviCRM', 'access CiviContribute'), 'delete' => array('access CiviCRM', 'access CiviContribute', 'delete in CiviContribute'), 'completetransaction' => array('edit contributions'), 'default' => array('access CiviCRM', 'access CiviContribute', 'edit contributions')); $permissions['line_item'] = $permissions['contribution']; // Custom field permissions $permissions['custom_field'] = array('default' => array('administer CiviCRM', 'access all custom data')); $permissions['custom_group'] = $permissions['custom_field']; // Event permissions $permissions['event'] = array('create' => array('access CiviCRM', 'access CiviEvent', 'edit all events'), 'delete' => array('access CiviCRM', 'access CiviEvent', 'delete in CiviEvent'), 'get' => array('access CiviCRM', 'access CiviEvent', 'view event info'), 'update' => array('access CiviCRM', 'access CiviEvent', 'edit all events')); // Loc block is only used for events $permissions['loc_block'] = $permissions['event']; // File permissions $permissions['file'] = array('default' => array('access CiviCRM', 'access uploaded files')); $permissions['files_by_entity'] = $permissions['file']; // Group permissions $permissions['group'] = array('get' => array('access CiviCRM'), 'default' => array('access CiviCRM', 'edit groups')); $permissions['group_nesting'] = $permissions['group']; $permissions['group_organization'] = $permissions['group']; //Group Contact permission $permissions['group_contact'] = array('get' => array('access CiviCRM'), 'default' => array('access CiviCRM', 'edit all contacts')); // CiviMail Permissions $civiMailBasePerms = array('access CiviMail', 'create mailings', 'schedule mailings', 'approve mailings'); $permissions['mailing'] = array('get' => array('access CiviCRM', $civiMailBasePerms), 'delete' => array('access CiviCRM', $civiMailBasePerms, 'delete in CiviMail'), 'submit' => array('access CiviCRM', array('access CiviMail', 'schedule mailings')), 'default' => array('access CiviCRM', $civiMailBasePerms)); $permissions['mailing_group'] = $permissions['mailing']; $permissions['mailing_job'] = $permissions['mailing']; $permissions['mailing_recipients'] = $permissions['mailing']; $permissions['mailing_a_b'] = array('get' => array('access CiviCRM', 'access CiviMail'), 'delete' => array('access CiviCRM', 'access CiviMail', 'delete in CiviMail'), 'submit' => array('access CiviCRM', array('access CiviMail', 'schedule mailings')), 'default' => array('access CiviCRM', 'access CiviMail')); // Membership permissions $permissions['membership'] = array('get' => array('access CiviCRM', 'access CiviMember'), 'delete' => array('access CiviCRM', 'access CiviMember', 'delete in CiviMember'), 'default' => array('access CiviCRM', 'access CiviMember', 'edit memberships')); $permissions['membership_status'] = $permissions['membership']; $permissions['membership_type'] = $permissions['membership']; $permissions['membership_payment'] = array('create' => array('access CiviCRM', 'access CiviMember', 'edit memberships', 'access CiviContribute', 'edit contributions'), 'delete' => array('access CiviCRM', 'access CiviMember', 'delete in CiviMember', 'access CiviContribute', 'delete in CiviContribute'), 'get' => array('access CiviCRM', 'access CiviMember', 'access CiviContribute'), 'update' => array('access CiviCRM', 'access CiviMember', 'edit memberships', 'access CiviContribute', 'edit contributions')); // Participant permissions $permissions['participant'] = array('create' => array('access CiviCRM', 'access CiviEvent', 'register for events'), 'delete' => array('access CiviCRM', 'access CiviEvent', 'edit event participants'), 'get' => array('access CiviCRM', 'access CiviEvent', 'view event participants'), 'update' => array('access CiviCRM', 'access CiviEvent', 'edit event participants')); $permissions['participant_payment'] = array('create' => array('access CiviCRM', 'access CiviEvent', 'register for events', 'access CiviContribute', 'edit contributions'), 'delete' => array('access CiviCRM', 'access CiviEvent', 'edit event participants', 'access CiviContribute', 'delete in CiviContribute'), 'get' => array('access CiviCRM', 'access CiviEvent', 'view event participants', 'access CiviContribute'), 'update' => array('access CiviCRM', 'access CiviEvent', 'edit event participants', 'access CiviContribute', 'edit contributions')); // Pledge permissions $permissions['pledge'] = array('create' => array('access CiviCRM', 'access CiviPledge', 'edit pledges'), 'delete' => array('access CiviCRM', 'access CiviPledge', 'delete in CiviPledge'), 'get' => array('access CiviCRM', 'access CiviPledge'), 'update' => array('access CiviCRM', 'access CiviPledge', 'edit pledges')); //CRM-16777: Disable schedule reminder for user that have 'edit all events' and 'administer CiviCRM' permission. $permissions['action_schedule'] = array('update' => array(array('access CiviCRM', 'edit all events'))); $permissions['pledge_payment'] = array('create' => array('access CiviCRM', 'access CiviPledge', 'edit pledges', 'access CiviContribute', 'edit contributions'), 'delete' => array('access CiviCRM', 'access CiviPledge', 'delete in CiviPledge', 'access CiviContribute', 'delete in CiviContribute'), 'get' => array('access CiviCRM', 'access CiviPledge', 'access CiviContribute'), 'update' => array('access CiviCRM', 'access CiviPledge', 'edit pledges', 'access CiviContribute', 'edit contributions')); // Profile permissions $permissions['profile'] = array('get' => array()); $permissions['uf_group'] = array('create' => array('access CiviCRM', array('administer CiviCRM', 'manage event profiles')), 'get' => array('access CiviCRM'), 'update' => array('access CiviCRM', array('administer CiviCRM', 'manage event profiles'))); $permissions['uf_field'] = $permissions['uf_join'] = $permissions['uf_group']; $permissions['uf_field']['delete'] = array('access CiviCRM', array('administer CiviCRM', 'manage event profiles')); $permissions['option_value'] = $permissions['uf_group']; $permissions['option_group'] = $permissions['option_value']; $permissions['message_template'] = array('get' => array('access CiviCRM'), 'create' => array('edit message templates'), 'update' => array('edit message templates')); // Translate 'create' action to 'update' if id is set if ($action == 'create' && (!empty($params['id']) || !empty($params[$entity . '_id']))) { $action = 'update'; } // let third parties modify the permissions CRM_Utils_Hook::alterAPIPermissions($entity, $action, $params, $permissions); // Merge permissions for this entity with the defaults $perm = CRM_Utils_Array::value($entity, $permissions, array()) + $permissions['default']; // Return exact match if permission for this action has been declared if (isset($perm[$action])) { return $perm[$action]; } // Translate specific actions into their generic equivalents $snippet = substr($action, 0, 3); if ($action == 'replace' || $snippet == 'del') { // 'Replace' is a combination of get+create+update+delete; however, the permissions // on each of those will be tested separately at runtime. This is just a sniff-test // based on the heuristic that 'delete' tends to be the most closely guarded // of the necessary permissions. $action = 'delete'; } elseif ($action == 'setvalue' || $snippet == 'upd') { $action = 'update'; } elseif ($action == 'getfields' || $action == 'getfield' || $action == 'getspec' || $action == 'getoptions') { $action = 'meta'; } elseif ($snippet == 'get') { $action = 'get'; } return isset($perm[$action]) ? $perm[$action] : $perm['default']; }