diff --git a/ext/standaloneusers/CRM/Standaloneusers/BAO/Role.php b/ext/standaloneusers/CRM/Standaloneusers/BAO/Role.php index 45a85eafe894..586d9a17c2a1 100644 --- a/ext/standaloneusers/CRM/Standaloneusers/BAO/Role.php +++ b/ext/standaloneusers/CRM/Standaloneusers/BAO/Role.php @@ -14,4 +14,25 @@ public static function self_hook_civicrm_post(\Civi\Core\Event\PostEvent $event) Civi::cache('metadata')->clear(); } + /** + * Check access permission + * + * @param string $entityName + * @param string $action + * @param array $record + * @param integer|null $userID + * @return boolean + * @see CRM_Core_DAO::checkAccess + */ + public static function _checkAccess(string $entityName, string $action, array $record, ?int $userID): bool { + // Prevent users from updating or deleting the admin and everyone roles + if (in_array($action, ['delete', 'update'], TRUE)) { + $name = $record['name'] ?? CRM_Core_DAO::getFieldValue(self::class, $record['id']); + if (in_array($name, ['admin', 'everyone'], TRUE)) { + return FALSE; + } + } + return TRUE; + } + }