From 250b13bc96aef357d791a3dfe3bb4e0f9620d0c3 Mon Sep 17 00:00:00 2001
From: Eileen McNaughton <emcnaughton@wikimedia.org>
Date: Wed, 15 Mar 2023 09:08:27 +1300
Subject: [PATCH] dev/core#4184 Fix Import over-authorization
---
ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php b/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php
index 4ee6bbbe5ef..0eade33f0db 100644
--- a/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php
+++ b/ext/civiimport/Civi/Api4/Event/Subscriber/ImportSubscriber.php
@@ -104,7 +104,7 @@ class ImportSubscriber extends AutoService implements EventSubscriberInterface {
public function onApiAuthorize(AuthorizeEvent $event): void {
$apiRequest = $event->getApiRequest();
$entity = $apiRequest['entity'];
- if (strpos($entity, 'Import_') === 0) {
+ if (strpos($entity, 'Import_') === 0 && !in_array($event->getActionName(), ['getFields', 'getActions', 'checkAccess'], TRUE)) {
$userJobID = (int) (str_replace('Import_', '', $entity));
if (!UserJob::get(TRUE)->addWhere('id', '=', $userJobID)->selectRowCount()->execute()->count()) {
throw new UnauthorizedException('Import access not permitted');
--
GitLab