Hmm, looks like I may have found the culprit...

class SurveyAdmin extends Survey_Common_Action
{
/**

• Initiates the survey action, checks for superadmin permission
• @access public
• @param CController $controller
• @param string $id

• @return void
  */
  public function construct($controller, $id)
  {
  parent::construct($controller, $id);

  if (Yii::app()->session['USER_RIGHT_SUPERADMIN'] != 1)
  {
      die();
  }

  }

Is there really no way to do declarative authorization in Yii? You have to resort to slapping conditionals into each action?

It looks like there is a role-based authorization component built into the framework: http://www.yiiframework.com/doc/guide/1.1/en/topics.auth#defining-authorization-hierarchy

I have submitted the following pull request with the fix I'm using:

https://github.com/LimeSurvey/LimeSurvey/pull/9

I didn't adequately check that pull request before sending it... Here is the corrected version:

https://github.com/LimeSurvey/LimeSurvey/pull/10