CiviCRM Community Forums (archive)

AFAIK, Views queries the CiviCRM DB directly and thus of course bypasses CiviCRM's ACL.

I had gone down the same sort of route outlined by Lobo. This is set to work only for when the view is built off the civicrm_contacts table. I expect extending a similar sort of logic to work with other civi tables as the base table would be possible.

I'd be interested to know if there is a cleaner way to include the necessary civicrm classes.

function civicrm_views_acl_views_query_alter(&$view, &$query) {
  if ($view->base_table == 'civicrm_contact') {
    // Intialize civicrm and load the required classes to
    // call CRM_Contact_BAO_Contact_Permission::cacheClause().
    civicrm_initialize();
    require_once $GLOBALS['civicrm_root'] . '/CRM/Contact/BAO/Contact/Permission.php';
    require_once $GLOBALS['civicrm_root'] . '/CRM/Core/Permission.php';

    // Construct a subquery that returns a list of contacts that the current
    // user has access.
    list($from_clause, $where_clause) = CRM_Contact_BAO_Contact_Permission::cacheClause('civicrm_contact');
    $subquery = "SELECT civicrm_contact.id FROM {civicrm_contact} as civicrm_contact {$from_clause} WHERE {$where_clause}";

    // Include the subquery as a where clause into the views query.
    $civicrm_contact_alias = $query->ensure_table('civicrm_contact');
    $query->add_where(0, "{$civicrm_contact_alias}.id IN ({$subquery})");
  }
}


not sure how much u can do with query alter, but within the civi code we use a left join to the acl table of contact ids and add a where clause

Yeah, I was avoiding that because it seemed like a much more difficult thing to do with the views query object. But you're right, it is about one order of magnitude slower, depending on the query used.

So after a little views battling, here is the more efficient approach using an inner join and where clause as opposed to a subquery.

I'd still like to feedback on how best to include civi class files.

function civicrm_views_acl_views_data() {
  $data = array();
  $data['civicrm_acl_contact_cache']['table']['join']['civicrm_contact'] = array(
    'field' => 'contact_id',
    'left_field' => 'id',
    'type' => 'INNER',
  );
  return $data;
}

function civicrm_views_acl_views_query_alter(&$view, &$query) {
  if ($view->base_table == 'civicrm_contact') {
    // Intialize civicrm and load the required classes to
    // call CRM_Contact_BAO_Contact_Permission::cacheClause().
    civicrm_initialize();
    require_once $GLOBALS['civicrm_root'] . '/CRM/Contact/BAO/Contact/Permission.php';
    require_once $GLOBALS['civicrm_root'] . '/CRM/Core/Permission.php';

    // Grab the SQL fragments that civicrm uses to decide ACL. But first, grab
    // the alias for the civicrm_contact table as defined in the view's query object.
    $civicrm_contact_alias = $query->ensure_table('civicrm_contact');
    list($from_clause, $where_clause) = CRM_Contact_BAO_Contact_Permission::cacheClause($civicrm_contact_alias);

    // Join on the civicrm acl cache table if the $from_clause isn't empty. We are
    // assuming that if it is not empty, that it defines a join just as we implement.
    if ($from_clause) {
      $civicrm_acl_join_object = views_get_table_join('civicrm_acl_contact_cache', 'civicrm_contact');
      // The table alias 'aclContactCache' is hardcoded in CRM_Contact_BAO_Contact_Permission::cacheClause().
      $query->add_relationship('aclContactCache', $civicrm_acl_join_object, 'civicrm_contact');
    }

    // Attach the where condition to the views query.
    $query->add_where(0, $where_clause);
  }
}