Fix permission checks on contact create popups

civicrm · Jan 30, 2019 · acf315d · acf315d
1 parent eda4400
commit acf315d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/CRM/Contact/BAO/Contact.php b/CRM/Contact/BAO/Contact.php
@@ -3651,7 +3651,7 @@ public static function isFieldHasLocationType($fieldTitle) {
    * @return bool
    */
   public static function entityRefCreateLinks() {
-    return CRM_Core_Permission::check([['edit all contacts', 'add contacts']]);
+    return CRM_Core_Permission::check([['profile create', 'profile listings and forms']]);
   }
 
 }
diff --git a/CRM/Core/BAO/UFGroup.php b/CRM/Core/BAO/UFGroup.php
@@ -3328,6 +3328,9 @@ public static function setComponentDefaults(&$fields, $componentId, $component,
    * @return array
    */
   public static function getCreateLinks($profiles = '', $appendProfiles = array()) {
+    if (!CRM_Contact_BAO_Contact::entityRefCreateLinks()) {
+      return [];
+    }
     // Default to contact profiles
     if (!$profiles) {
       $profiles = array('new_individual', 'new_organization', 'new_household');