diff --git a/CRM/Event/BAO/Event.php b/CRM/Event/BAO/Event.php index 203c47f4c20..0346117f48c 100644 --- a/CRM/Event/BAO/Event.php +++ b/CRM/Event/BAO/Event.php @@ -2064,9 +2064,7 @@ public static function checkRegistration($params) { * the permission that the user has (or null) */ public static function checkPermission($eventId = NULL, $type = CRM_Core_Permission::VIEW) { - static $permissions = NULL; - - if (empty($permissions)) { + if (!isset(Civi::$statics[__CLASS__]['permissions'])) { $params = array( 'check_permissions' => 1, 'return' => 'title', @@ -2085,19 +2083,19 @@ public static function checkPermission($eventId = NULL, $type = CRM_Core_Permiss // Search again, but only events created by the user. $params['created_id'] = 'user_contact_id'; $result = civicrm_api3('Event', 'get', $params); - $createdEvents = CRM_Utils_Array::collect('title', $result['values']); + $createdEvents = array_keys($result['values']); // Note: for a multisite setup, a user with edit all events, can edit all events // including those from other sites if (CRM_Core_Permission::check('edit all events')) { - $permissions[CRM_Core_Permission::EDIT] = array_keys($allEvents); + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::EDIT] = array_keys($allEvents); } else { - $permissions[CRM_Core_Permission::EDIT] = CRM_ACL_API::group(CRM_Core_Permission::EDIT, NULL, 'civicrm_event', $allEvents, $createdEvents); + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::EDIT] = CRM_ACL_API::group(CRM_Core_Permission::EDIT, NULL, 'civicrm_event', $allEvents, $createdEvents); } if (CRM_Core_Permission::check('edit all events')) { - $permissions[CRM_Core_Permission::VIEW] = array_keys($allEvents); + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::VIEW] = array_keys($allEvents); } else { if (CRM_Core_Permission::check('access CiviEvent') && @@ -2108,25 +2106,25 @@ public static function checkPermission($eventId = NULL, $type = CRM_Core_Permiss // at the same time also allow any hook to override if needed. $createdEvents = array_keys($allEvents); } - $permissions[CRM_Core_Permission::VIEW] = CRM_ACL_API::group(CRM_Core_Permission::VIEW, NULL, 'civicrm_event', $allEvents, $createdEvents); + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::VIEW] = CRM_ACL_API::group(CRM_Core_Permission::VIEW, NULL, 'civicrm_event', $allEvents, $createdEvents); } - $permissions[CRM_Core_Permission::DELETE] = array(); + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::DELETE] = array(); if (CRM_Core_Permission::check('delete in CiviEvent')) { // Note: we want to restrict the scope of delete permission to // events that are editable/viewable (usecase multisite). // We can remove array_intersect once we have ACL support for delete functionality. - $permissions[CRM_Core_Permission::DELETE] = array_intersect($permissions[CRM_Core_Permission::EDIT], - $permissions[CRM_Core_Permission::VIEW] + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::DELETE] = array_intersect(Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::EDIT], + Civi::$statics[__CLASS__]['permissions'][CRM_Core_Permission::VIEW] ); } } if ($eventId) { - return in_array($eventId, $permissions[$type]) ? TRUE : FALSE; + return in_array($eventId, Civi::$statics[__CLASS__]['permissions'][$type]) ? TRUE : FALSE; } - return $permissions; + return Civi::$statics[__CLASS__]['permissions']; } /** diff --git a/tests/phpunit/CRM/Event/BAO/EventPermissionsTest.php b/tests/phpunit/CRM/Event/BAO/EventPermissionsTest.php new file mode 100644 index 00000000000..84828e16ddf --- /dev/null +++ b/tests/phpunit/CRM/Event/BAO/EventPermissionsTest.php @@ -0,0 +1,50 @@ +_contactId = $this->createLoggedInUser(); + $event = $this->eventCreate(array( + 'created_id' => $this->_contactId, + )); + $this->_eventId = $event['id']; + } + + public function testEditOwnEvent() { + CRM_Core_Config::singleton()->userPermissionTemp = ['access civievent', 'access CiviCRM', 'view event info']; + unset(\Civi::$statics['CRM_Event_BAO_Event']['permissions']); + $permissions = CRM_Event_BAO_Event::checkPermission($this->_eventId, CRM_Core_Permission::EDIT); + $this->assertTrue($permissions); + } + +}