CListPermissions::MergeRights

public function MergeRights($IBLOCK_TYPE_ID, $DB, $POST)
{
	$arResult = array();

	//1) Put into result protected from changes rights
	$arListsPerm = CLists::GetPermission($IBLOCK_TYPE_ID);
	foreach($DB as $RIGHT_ID => $arRight)
	{
		//1) protect groups from module settings
		if(
			preg_match("/^G(\d)$/", $arRight["GROUP_CODE"], $match)
			&& is_array($arListsPerm)
			&& in_array($match[1], $arListsPerm)
		)
			$arResult[$RIGHT_ID] = $arRight;
		else
		{
			//2) protect groups with iblock_% operations
			$arOperations = CTask::GetOperations($arRight['TASK_ID'], true);
			foreach($arOperations as $operation)
			{
				if(preg_match("/^iblock_(?!admin)/", $operation))
				{
					$arResult[$RIGHT_ID] = $arRight;
					break;
				}
			}
		}
	}

	//2) Leave in POST only safe rights
	foreach($POST as $RIGHT_ID => $arRight)
	{
		//1) protect groups from module settings
		if(
			preg_match("/^G(\d)$/", $arRight["GROUP_CODE"], $match)
			&& is_array($arListsPerm)
			&& in_array($match[1], $arListsPerm)
		)
			unset($POST[$RIGHT_ID]);
		else
		{
			//2) protect groups with iblock_% operations
			$arOperations = CTask::GetOperations($arRight['TASK_ID'], true);
			foreach($arOperations as $operation)
			{
				if(preg_match("/^iblock_(?!admin)/", $operation))
				{
					unset($POST[$RIGHT_ID]);
					break;
				}
			}
		}
	}

	//3) Join POST to result
	foreach($POST as $RIGHT_ID => $arRight)
	{
		foreach($arResult as $RIGHT_ID2 => $arRight2)
		{
			if($arRight["GROUP_CODE"] == $arRight2["GROUP_CODE"])
				unset($arResult[$RIGHT_ID2]);
		}
		$arResult[$RIGHT_ID] = $arRight;
	}

	return $arResult;
}