Skip to content
Snippets Groups Projects
Commit c540659b authored by mattwire's avatar mattwire
Browse files

Fix public access to processPublic API

parent 0d4cf3c1
No related branches found
No related tags found
1 merge request!2096.8
......@@ -13,10 +13,7 @@ class StripePaymentintent extends Generic\DAOEntity {
public static function permissions() {
$permissions = parent::permissions();
$permissions['processMOTO'] = ['allow stripe moto payments'];
// The "minimum" permission for an API4 call is "access CiviCRM"|"access AJAX API".
// We can't remove the requirement for one of those permissions here.
// So we specify only 'make online contributions' using alterAPIRoutePermissions hook.
// $permissions['processPublic'] = ['make online contributions'];
$permissions['processPublic'] = ['make online contributions'];
return $permissions;
}
......
......@@ -255,18 +255,3 @@ function stripe_civicrm_permission(&$permissions) {
$permissions['allow stripe moto payments'] = E::ts('CiviCRM Stripe: Process MOTO transactions');
}
}
/**
* Implements hook_civicrm_alterApiRoutePermissions().
*
* @see CRM_Utils_Hook::alterApiRoutePermissions
*/
function stripe_civicrm_alterApiRoutePermissions(&$permissions, $entity, $action) {
if ($entity == 'StripePaymentintent') {
// These actions should be accessible to anonymous users; permissions are checked internally
$allowedActions = ['ProcessPublic'];
if (in_array($action, $allowedActions, TRUE)) {
$permissions = 'make online contributions';
}
}
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment