Skip to content
Snippets Groups Projects
Commit c540659b authored by mattwire's avatar mattwire
Browse files

Fix public access to processPublic API

parent 0d4cf3c1
Branches
Tags
1 merge request!2096.8
......@@ -13,10 +13,7 @@ class StripePaymentintent extends Generic\DAOEntity {
public static function permissions() {
$permissions = parent::permissions();
$permissions['processMOTO'] = ['allow stripe moto payments'];
// The "minimum" permission for an API4 call is "access CiviCRM"|"access AJAX API".
// We can't remove the requirement for one of those permissions here.
// So we specify only 'make online contributions' using alterAPIRoutePermissions hook.
// $permissions['processPublic'] = ['make online contributions'];
$permissions['processPublic'] = ['make online contributions'];
return $permissions;
}
......
......@@ -255,18 +255,3 @@ function stripe_civicrm_permission(&$permissions) {
$permissions['allow stripe moto payments'] = E::ts('CiviCRM Stripe: Process MOTO transactions');
}
}
/**
* Implements hook_civicrm_alterApiRoutePermissions().
*
* @see CRM_Utils_Hook::alterApiRoutePermissions
*/
function stripe_civicrm_alterApiRoutePermissions(&$permissions, $entity, $action) {
if ($entity == 'StripePaymentintent') {
// These actions should be accessible to anonymous users; permissions are checked internally
$allowedActions = ['ProcessPublic'];
if (in_array($action, $allowedActions, TRUE)) {
$permissions = 'make online contributions';
}
}
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment