Standalone - prevent users from deleting own user

civicrm · Dec 7, 2023 · d1dd7d0 · d1dd7d0
1 parent bf23556
commit d1dd7d0
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/ext/standaloneusers/CRM/Standaloneusers/BAO/User.php b/ext/standaloneusers/CRM/Standaloneusers/BAO/User.php
@@ -41,4 +41,26 @@ public static function getTimeZones(): array {
     return $timeZones;
   }
 
+  /**
+   * Check access permission
+   *
+   * @param string $entityName
+   * @param string $action
+   * @param array $record
+   * @param integer|null $userID
+   * @return boolean
+   * @see CRM_Core_DAO::checkAccess
+   */
+  public static function _checkAccess(string $entityName, string $action, array $record, ?int $userID): bool {
+    // Prevent users from deleting their own user account
+    if (in_array($action, ['delete'], TRUE)) {
+      $sess = CRM_Core_Session::singleton();
+      $ufID = (int) $sess->get('ufID');
+      if ($record['id'] == $ufID) {
+        return FALSE;
+      };
+    }
+    return TRUE;
+  }
+
 }