I didn't chek update, but think there are solution

In 3.X … send a 200 white page … (with debug or not)

OK, thanks for testing, Denis.

I'm working on it now!

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30260

Another solution could be to never send both qid AND sid together. sid should come from the question and then be checked for permission.

Another solution could be to never send both qid AND sid together. sid should come from the question and then be checked for permission.

Think it's the best solution, i already report this issue before 2.6lts

question need onlky qid
group need only gid
answer need only aid (but we never edit a single answer)

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30262

@pstelling :

1. no … access on survey id on URL is already done : your commit does nothing . Do you really read the way to reproduce ?
2. https://github.com/LimeSurvey/LimeSurvey/commit/ab3562d77ae684afd93e4d0d2925d9b932cd9485 already fix the issue (but show no questin)
3. can you check : https://bugs.limesurvey.org/view.php?id=16470 before make a new commit

Erg sorry … issue is worst i think : there are NO control even in surevyid in url …

Really worst :

http://limesurvey.local/master/questionEditor/GetAdvancedOptions?surveyid=713583&gid=296&qid=4917 : no control is done
http://limesurvey.local/master/questionEditor/GetQuestionPermissions?surveyid=352826&gid=320&iQuestionId=5146 : no control is done

Maybe other …

Then :

Issues

1. sid/surveyid is NEVER tested in vioew (hope it was in save)
2. question access right are not tested on json part
3. no control if sid of questionid are related to surveyid

We really need a better fix then the current quick fix

Can you link to github instead of your local repo? xD

No : it's sample url :)

I can not really link to github , vbecause create a pull request is more quick than link to ght hub …

1. https://github.com/LimeSurvey/LimeSurvey/blob/ab3562d77ae684afd93e4d0d2925d9b932cd9485/application/controllers/QuestionEditorController.php#L67 must be a 404
2. https://github.com/LimeSurvey/LimeSurvey/blob/ab3562d77ae684afd93e4d0d2925d9b932cd9485/application/controllers/QuestionEditorController.php#L69 : must check on surveyid Permission and send a 401
3. https://github.com/LimeSurvey/LimeSurvey/blob/ab3562d77ae684afd93e4d0d2925d9b932cd9485/application/controllers/QuestionEditorController.php#L69 : must check if qid->sid are equal to surveyid and send a a 400
4. Must do the same on ALL function in this file

Maybe best to create a checked on LSBaseController , i do it after fixing TypeHint

401? That's not default behaviour of LS?

Not a 401, a 403 : https://github.com/LimeSurvey/LimeSurvey/blob/9fd5e78aa6a67b1078a05746c29bceb9f8fab7c0/application/core/Survey_Common_Action.php#L193
Only if extend Survey_Common_Action and use _addPseudoParams

401 mean : you're not connected , you need to be conneceted to access this link
403 : your are identified , but you don't have access to this link

403 doesn't happy anywhere else in the software. Why change the behaviour here?

403 for all no Permission on survey …

Else : show me current way : You mean leave the redirect (302) ? That broke external tool and XHR ?

And because : it's always a good idea to respect standard.

Redirect is already done EVERYWHERE in the software, Denis! It should be consistent.

grep -r 'Permission::model' application/controllers/ -A2 | grep redirect | wc

86 redirects after permission check.

Wait, you're talking about the ajax calls?

Redirect is already done EVERYWHERE in the software, Denis! It should be consistent.
Still a bad solution.

It's not because old code are broken we need to add old code again and again …

I don't care about ajax or not : just send good http header

Well, I care about the software behaving consistently towards the user. :) If you want to change it to 403, make a separate dev issue or feature request. This ticket is about access bugs.

https://github.com/LimeSurvey/LimeSurvey/pull/1479

With invalid survey : it's already a 403 in 3.LTS,
Solution currently pushed do a redirect, this was not consistent

Fixed in Release 4.3.4+200713

GetAdvancedOptions still not protected
GetQuestionPermission still not protected

Strange issue with updating sid (and not gid) : create a question without group ? See screencast
hard to check : thoirw error with devbug

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30352

Fixed in Release 4.3.9+200806