Merge pull request civicrm#21 from Edzelopez/CIVI-28

CIVI-28 Handled permission for create contribution API

Author: Edzelopez

api/v3/Contribution.php

@@ -46,6 +46,14 @@ function civicrm_api3_contribution_create(&$params) {
   _civicrm_api3_custom_format_params($params, $values, 'Contribution');
   $params = array_merge($params, $values);
 
+  if (empty($params['id'])) {
+    $op = 'add';
+  }
+  CRM_Financial_BAO_FinancialType::getAvailableFinancialTypes($types, $op);
+  if (!in_array($params['financial_type_id'], array_keys($types))) {
+    return civicrm_api3_create_error('You do not have permission to create this contribution');
+  }
+
   if (!empty($params['id']) && !empty($params['contribution_status_id'])) {
     $error = array();
     //throw error for invalid status change such as setting completed back to pending