Relationship Graph

Relationship Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

This bug affects 1 person(s).
 6
IDProjectCategoryView StatusLast Update
16440Feature requestsSurvey editingpublic2023-12-18 16:44
ReporterDenisChenu Assigned Tocdorin  
PrioritynoneSeverityfeature 
Status resolvedResolutionfixed 
Summary16440: Survey group Permission : minimal system
Description

Currently : there are no Permission system , but allowing some Permission in Survey Group

Additional Information

Need :

Global permission

  • Survey group : Create/Read (all)/Write (all)/ Delete (all)

Survey groups permission

  • Add the owner (all rights on all group)
  • Group content management
  • [OPTION] Survey in this group (copy Global rights)

And :

  • Create getObjectBasePermissions with object as survey and surveygroup (for starting) and use it in \Permission and views.

SurveyGroup 1 (or the default one) is a specific group : all user have read right on it.

TagsNo tags attached.
Attached Files
Bug heat6
Story point estimate
Users affected %

Relationships

related to 16767 closedcdorin Bug reports User without right can see and update group name and description 
related to 16799 closedgabrieljenik Bug reports User with read + create survey : invalid list shown 
related to 14551 closedDenisChenu Bug reports user can grant more permissions on a survey than he has himself 
related to 15421 closedcdorin Feature requests Survey group Permission : minimal system 
related to 16428 closedDenisChenu Bug reports Simple user reset Survey group to default one 
related to 16919 assignedollehar Bug reports Missing test suite for survey group permissions 
related to 16459 assignedDenisChenu Bug reports Add a way to extend Survey list in administration (for Permission) 
related to 19270 new Bug reports Permission edit page is more usable for SurveyGroup than for Survey 

Activities

DenisChenu

DenisChenu

2020-06-30 16:37

developer   ~58585

Some user story

User story #1 : Group owner

  1. Create a user who can create group and surey
  2. This user can create 2 groups (for example) Draft, Ready, Archived
  3. This user can manage is own survey like he want.

User story #2 : Survey inside groups : Global permssion on survey in Survey group

  1. Have an "Accoutancy" department
  2. Create a Survey group "Accountancy Survey"
  3. Add "Accountancy" director to have Read /update rights on all survey in "Accountancy Survey" + read on "Accountancy Survey"
  4. Put all accountancy surveys in "Accountancy Survey"
  5. Some time ago : a new "Accoutancy" assistant come : give him the rights survey inside group.

No need to manage who can access to survey inside this group one by one …

DenisChenu

DenisChenu

2020-06-30 16:39

developer   ~58586

For information : when update : an user with "All surveys" write have directlry "Read all" on all group.
I must check for "Read all survey" : i don't know.

DenisChenu

DenisChenu

2020-06-30 16:53

developer   ~58590

Oh … and "Themes options for this survey group" need a new Permission or not ?

DenisChenu

DenisChenu

2020-06-30 17:07

developer   ~58591

DenisChenu

DenisChenu

2020-06-30 17:08

developer   ~58592

Send a document

cdorin

cdorin

2020-09-01 17:16

reporter   ~59675

Last edited: 2020-09-01 17:19

Hey Denis,
Looks very good! Would like to discuss a couple of points a bit further:

1) What do you think about adding the permission to "create" surveys in survey group permissions? (I see that the checkbox is missing)
2) A theme options row for survey group permissions is needed, indeed. Would be OK to have only Update and View/Read permissions only?
3) Please check the #develop branch all the time for new commits since we also refactor certain parts of the software (surveyadmincontroller and themeoptions controller are left).
4) About "Content": Does it cover the right to read/view & update survey settings (where survey settings inheritance is taking place) ?
5) About "Content": Is it necessary to have the "Delete" option? If you delete the group, what would then happen with the questions located inside of it get deleted? We should think of an option to confirm whether the user wants to delete the surveys inside a survey a group or if the surveys should be transferred to another group.

In case smth else comes into my mind - will write it down here for everyone.
Thanks for your suggestion and feature request!

DenisChenu

DenisChenu

2020-09-01 17:45

developer   ~59676

1) What do you think about adding the permission to "create" surveys in survey group permissions? (I see that the checkbox is missing)

I think it's hard to «create survey in group» , but you're right : there are a lack of Permission

3 solutions :

  • Create : mean "adding survey in this group". What for "Remove Survey in this group" ?
  • "Permission on surveys list : adding and remove surveys from this group" ? Only Create (Add) + View/read + Delete (mean remove)
  • "Permission on surveys list : adding and remove surveys from this group" view + update (mean add and remove)

2)à A theme options row for survey group permissions is needed, indeed. Would be OK to have only Update and View/Read permissions only?
See https://bugs.limesurvey.org/view.php?id=16440#c58590

BUT : related with template right management. Then user need READ access to the theme + update option to Theme on Survey Group.
What about uploading pictures ?

About "Content": Is it necessary to have the "Delete" option?

Right : no reason to have delete (currently)

4) About "Content": Does it cover the right to read/view & update survey settings (where survey settings inheritance is taking place) ?

To be choosen : Can add a new line for SurveyGroup settings only or use this one . In my opinion: best is to have only one checkbox for both, but if needed can separate.

DenisChenu

DenisChenu

2020-09-01 17:48

developer   ~59677

About create,

See odt :
Surveys in group : Same options than global settings, except create already in Survey group / read Permission

In fact : if you can see the SurveyGroup in the dropdown : you already can select this group in Survey management

Else : must think differently : SurveyGroup dropdown take only "add" options ?

cdorin

cdorin

2020-09-01 18:15

reporter   ~59678

1) What do you think about adding the permission to "create" surveys in survey group permissions? (I see that the checkbox is missing)

I think it's hard to «create survey in group» , but you're right : there are a lack of Permission

Ok, then we do not need to add the "create survey" permissions since it's not worth it in the first phase.

3 solutions :

  • Create : mean "adding survey in this group". What for "Remove Survey in this group" ?
  • "Permission on surveys list : adding and remove surveys from this group" ? Only Create (Add) + View/read + Delete (mean remove)
  • "Permission on surveys list : adding and remove surveys from this group" view + update (mean add and remove)

I would go for: - "Permission on surveys list : adding and remove surveys from this group" view + update (mean add and remove) . Add + View/read + Delete may add too much confusion. Update already means that you are editing the surveys located inside the survey group.

One follow up question in that regard: what does "Add" mean - from which groups can the survey group manager add questions ? -> Will it depend on which group view permission he has? It could end up a bit complicated. Perhaps I can document some use cases to have in mind when creating this functionality?

2)à A theme options row for survey group permissions is needed, indeed. Would be OK to have only Update and View/Read permissions only?

See https://bugs.limesurvey.org/view.php?id=16440#c58590

BUT : related with template right management. Then user need READ access to the theme + update option to Theme on Survey Group.
What about uploading pictures ?

I would not go for image upload at the moment. Isee you cannot upload new imagines in admin/themeoptions/sa/updatesurveygroup -> it would overcomplicate too much the project for the first iteration/version of the feature.

3) About "Content": Is it necessary to have the "Delete" option?

Right : no reason to have delete (currently)

Ok, so the Delete checkbox can be removed.

5)) About "Content": Does it cover the right to read/view & update survey settings (where survey settings inheritance is taking place) ?

To be choosen : Can add a new line for SurveyGroup settings only or use this one . In my opinion: best is to have only one checkbox for both, but if needed can separate.

Hmm, no need to add a new line for Surveygroup settings imo. Better to use one checkbox for both options.

DenisChenu

DenisChenu

2020-09-01 19:00

developer   ~59679

OK,

I start with this :) and make new screenshot when it's ready

DenisChenu

DenisChenu

2020-10-20 10:19

developer   ~60290

@cdorin : 2 questions

  1. Allow "public" group: all user see this group and can put Survey inside this group : OK ?
  2. Did owner of a group (without Survey global rights) can update all surveys in this group ? I think adding a global setting if needed. If needed : need 2 different rights (Object) : SureyGroup + SurvyesInGroup
cdorin

cdorin

2020-10-20 12:48

reporter   ~60297

Hey Denis!

  1. Sounds good - where will be the setting located?
  2. Good point. IMO, I consider it is better if the owner of the group cannot update nor view the surveys in this group (I am thinking of privacy - as a worker, maybe you don;t have to share your responses with your manager). Therefore, for a surveygroup owner to see and edit surveys inside his/her group, he/she should receive surveygroup survey-related permissions.
    What are your thoughts?
DenisChenu

DenisChenu

2020-10-20 14:28

developer   ~60305

1 : new attribute in SurveyGroup i think
2: my client want SurveyGroup owner have all rights on survey. But when thinking unsure it's a good option. It's really more simple to have 'owner of groups' have all rights on survey. I check to have a solution to allow or not this via global settings.

cdorin

cdorin

2020-10-20 15:04

reporter   ~60306

1: Sure, sounds good.
2: I am not sure about having a setting in global settings about that - mostly because it will complicate the software. Perhaps we should stick first to providing all rights on survey to the owner of the group (since it makes sense in many scenarios after all...), and see how LS users use the survey group permissions feature. And discuss after about a solution in the global settings.

DenisChenu

DenisChenu

2020-10-20 15:16

developer   ~60307

For 2 : if Group owner don't have right on surveys : i'm unsure on the real feature … it must be clear for user.

There are #2 : give all rights on SureyGroups => give all rights on Surveys …
Must be really clear too … and well documented

cdorin

cdorin

2020-10-20 15:23

reporter   ~60309

2: Agree. So, the group owner will get all the survey-related permissions.

Can that be reflected on the survey group permissions in any way?

DenisChenu

DenisChenu

2020-10-20 15:27

developer   ~60310

Can that be reflected on the survey group permissions in any way?

? Your question is unclear for me here.

cdorin

cdorin

2020-10-20 15:35

reporter   ~60312

Nevermind - was just wondering where the survey group owner will be listed. But he will appear anyway on the survey group list page: localhost/index.php?r=admin/survey/sa/listsurveys#surveygroups

DenisChenu

DenisChenu

2020-10-20 15:44

developer   ~60313

Must remind of this ;)

DenisChenu

DenisChenu

2020-10-22 16:57

developer   ~60370

Currently : anybody can add/delete/update any groups … even without any rights …

cdorin

cdorin

2020-10-22 18:38

reporter   ~60377

Yes , thus the necessity of having survey group permissions at the global level to block that...

DenisChenu

DenisChenu

2020-10-22 18:47

developer   ~60378

OK,

You confirm we can remove current rights then :)

Maybe i add a Plugin (core and activated) : User with Survey rights can see group of the survey :).

It can be a great plugin for sample :)

cdorin

cdorin

2020-10-22 18:53

reporter   ~60379

What do you mean by "removing current rights" ?
About Plugin: what do you mean by users with survey rights (global permissions) can see the group of the survey? You mean the survey group settings, ability to add and delete groups etc?

DenisChenu

DenisChenu

2020-10-22 19:18

developer   ~60380

What do you mean by "removing current rights" ?

User without any rights can update all groups .

Since adding permission check : this user loose this right :)

About Plugin: what do you mean by users with survey rights (global permissions) can see the group of the survey? You mean the survey group settings, ability to add and delete groups etc?

No :

  1. UserA have right on Survey1 (and no other right)
  2. Survey1 are in SurveyGroup1
    => UserA see SurveyGroup1 in list.

I think it's OK , don't need plugin, sorry :)

cdorin

cdorin

2020-10-23 09:45

reporter   ~60385

Ah, thanks - took me some time :D

About second point: yes, sounds amazing :)

DenisChenu

DenisChenu

2020-10-31 11:18

developer   ~60478

To be tested (and improved …)

DenisChenu

DenisChenu

2020-11-05 10:13

developer   ~60552

Nevermind - was just wondering where the survey group owner will be listed. But he will appear anyway on the survey group list page: localhost/index.php?r=admin/survey/sa/listsurveys#surveygroups

Like Survey : show to user, can be updated if user are owner or superadmin : https://github.com/LimeSurvey/LimeSurvey/blob/14b53db7ffe02d85020adab4690937fd1b1de835/application/views/admin/survey/subview/accordion/_generaloptions_panel.php#L124

But i show it if user didn't have right to update

DenisChenu

DenisChenu

2020-11-05 10:39

developer   ~60554

Document updated :

  • Add Survey group permission right
  • Add Surveys settings right
  • Add «available» survey group option
DenisChenu

DenisChenu

2020-11-05 11:05

developer   ~60556

DenisChenu

DenisChenu

2020-11-10 15:46

developer   ~60606

Adding test idea

cdorin

cdorin

2020-11-11 22:03

reporter   ~60615

Hey Denis,

thanks for your work! Haven't finished testing everything. Got the following two points so far:
1) On Create a Permission by Survey groups: at the moment, I can add survey group permissions to a simple user only and only if I am a superadministrator. Who should have the right?
2) Minor issue: when creating a group, you can choose Parent Group - there you have the possibility to visualise group names , including the ones that are not publicly available (hope I saw correctly). Perhaps the groups that are not listed as publicly available should not be listed under Parent group as well?

cdorin

cdorin

2020-11-11 22:20

reporter   ~60616

You can kick yourself out: if you give yourself survey group security permissions, you can take them from yourself.
Another issue to think of (related to the one above), If I have survey group security settings, Once I access survey group permission page, I can give myself "survey settings" and "surveys in this group" permissions.
Do not have now in mind a proposed solution - it s something we need to think of.

DenisChenu

DenisChenu

2020-11-12 08:03

developer   ~60620

1) On Create a Permission by Survey groups: at the moment, I can add survey group permissions to a simple user only and only if I am a superadministrator. Who should have the right?

It must be same than Create Survey, can you check ?

2) Minor issue: when creating a group, you can choose Parent Group - there you have the possibility to visualise group names , including the ones that are not publicly available (hope I saw correctly). Perhaps the groups that are not listed as publicly available should not be listed under Parent group as well?

Right, i must check. User can see on list ONLY surveys group where :

  1. He have right on Siurveys group
  2. Surveys group are set to publiclly available
  3. User have one right on Survey inside group

About 3 : maybe we must disable it for parent ?

Do not have now in mind a proposed solution - it s something we need to think of.

I start with "allow only security if you have right" BUT : there are an issue on survey.

See : https://bugs.limesurvey.org/view.php?id=16767

I can fix it BUT only when move Survey Permission management and SurveysGroup permission management using same function ....
I don't rewrite both at same time

See https://bugs.limesurvey.org/view.php?id=14551

DenisChenu

DenisChenu

2020-11-12 08:05

developer   ~60621

PS : about Permission control on save and view

See
https://github.com/LimeSurvey/LimeSurvey/pull/1632/files#diff-beaf430650e7a0fdc9312621e8f179e93ed78092d7bec1d9dca4b4a7832196a3R50

I start but need more rewrite for Survey at same time.

DenisChenu

DenisChenu

2020-11-17 16:38

developer   ~60680

1) On Create a Permission by Survey groups: at the moment, I can add survey group permissions to a simple user only and only if I am a superadministrator. Who should have the right?

I create a SureyGroup user allow : User (all) + SurveyGroup (all) : see screenshot when he create an user.

Exactly the same for Survey (but with Survey ;)

DenisChenu

DenisChenu

2020-11-17 17:25

developer   ~60681

2) Minor issue: when creating a group, you can choose Parent Group - there you have the possibility to visualise group names , including the ones that are not publicly available (hope I saw correctly). Perhaps the groups that are not listed as publicly available should not be listed under Parent group as well?

Fixed in https://github.com/LimeSurvey/LimeSurvey/pull/1632/commits/d8040440152b13461426e96808566b808ebe33bd

DenisChenu

DenisChenu

2020-11-17 17:26

developer   ~60682

Another issue to think of (related to the one above), If I have survey group security settings, Once I access survey group permission page, I can give myself "survey settings" and "surveys in this group" permissions.

Since survey have same issue : https://bugs.limesurvey.org/view.php?id=16767

I was happy to fix it for both when this one was merged (separate pull request purpose).

cdorin

cdorin

2020-11-19 20:05

reporter   ~60712

Thanks @DenisChenu for comments!

Did another round of small testing this evening and got the following 4 points (everything is related to survey group permissions at global level):
1) Survey Settings (where the inherited global survey settings are) of a survey should be available only if that user has the global Survey Group Update permission. At the moment it’s possible just with View/Read.
2) "Settings for this survey group" should be available for editing only if the survey group Update permission exists
3) What permissions is View/Read supposed to provide? If a survey is publicly made available, the user can see it anyway (view read permission not needed if I checked correctly). Perhaps, without view/read permission, the user should not see be able to see any survey group?
4) Is this intended behaviour (just to confirm): If there is a survey inside a survey group, the Delete button will not be displayed even if you have the Delete permission

DenisChenu

DenisChenu

2020-11-20 09:25

developer   ~60714

1) Survey Settings (where the inherited global survey settings are) of a survey should be available only if that user has the global Survey Group Update permission. At the moment it’s possible just with View/Read.

Survey settings for group are show to User who have "Syrvey setting Read" right , but : no save button (and if try to save with hacking : 403 error) : maybe we can add a alert ? Or a readonly on element ?

2) "Settings for this survey group" should be available for editing only if the survey group Update permission exists

No : can be seen if you have Read group, not shown if you get right on list by Survey. BUT : again : no way to save (403+no button) and here : shown at readonly

3) What permissions is View/Read supposed to provide? If a survey is publicly made available, the user can see it anyway (view read permission not needed if I checked correctly). Perhaps, without view/read permission, the user should not see be able to see any survey group?

See 1 and 2 : you can view the description and the available Survey Theme

4) Is this intended behaviour (just to confirm): If there is a survey inside a survey group, the Delete button will not be displayed even if you have the Delete permission

It's not already in current stable version . Since you can not delete it : we hide the button.

I add the delete/group/right control only. Maybe we need to check if have parent too.

DenisChenu

DenisChenu

2020-11-20 09:26

developer   ~60715

cdorin

cdorin

2020-11-20 09:28

reporter   ~60716

Great, thanks for info! didn t pay attention to the lack of save button for point 2 :) .

Will continue testing today

DenisChenu

DenisChenu

2020-11-20 09:43

developer   ~60717

there are an issue on the list on the last version ....
If you can update ?

About 2 : i think i check to add a visual information at top maybe ?

DenisChenu

DenisChenu

2020-11-20 10:16

developer   ~60718

Add permissions: is still there if you have only READ permission : i remove it.

Or maybe it's due to "Create group" ? I check . I think you can not "create" right, only update : adding a new user is part to update ?
Becaus e: only create : you can add an user, but don't give any right ... then you can not give right to user ...

cdorin

cdorin

2020-12-22 10:40

reporter   ~61018

I rechecked the whole flow.
Looks great.
I think the best way to find inconsistencies is to start writing the manual section for it: https://manual.limesurvey.org/Survey_Group_Permissions

Issue History

Date Modified Username Field Change
2020-06-30 16:34 DenisChenu New Issue
2020-06-30 16:34 DenisChenu File Added: Capture d’écran du 2020-06-30 15-27-40.png
2020-06-30 16:34 DenisChenu File Added: Capture d’écran du 2020-06-30 15-35-32.png
2020-06-30 16:34 DenisChenu File Added: Capture d’écran du 2020-06-30 16-31-54.png
2020-06-30 16:37 DenisChenu Note Added: 58585
2020-06-30 16:39 DenisChenu Additional Information Updated
2020-06-30 16:39 DenisChenu Note Added: 58586
2020-06-30 16:39 DenisChenu Additional Information Updated
2020-06-30 16:40 DenisChenu Relationship added child of 15421
2020-06-30 16:40 DenisChenu Relationship replaced related to 15421
2020-06-30 16:53 DenisChenu Note Added: 58590
2020-06-30 17:07 DenisChenu Note Added: 58591
2020-06-30 17:07 DenisChenu File Added: Survey group Permission.odt
2020-06-30 17:08 DenisChenu Note Added: 58592
2020-07-08 11:01 DenisChenu Relationship added related to 16459
2020-09-01 17:16 cdorin Note Added: 59675
2020-09-01 17:16 cdorin Assigned To => cdorin
2020-09-01 17:16 cdorin Status new => assigned
2020-09-01 17:19 cdorin Note Edited: 59675
2020-09-01 17:45 DenisChenu Note Added: 59676
2020-09-01 17:45 DenisChenu File Added: Capture d’écran du 2020-09-01 17-39-44.png
2020-09-01 17:48 DenisChenu Note Added: 59677
2020-09-01 17:48 DenisChenu File Added: Capture d’écran du 2020-09-01 17-47-08.png
2020-09-01 18:15 cdorin Note Added: 59678
2020-09-01 19:00 DenisChenu Note Added: 59679
2020-10-20 09:52 DenisChenu Assigned To cdorin => DenisChenu
2020-10-20 10:19 DenisChenu Note Added: 60290
2020-10-20 12:48 cdorin Note Added: 60297
2020-10-20 13:02 cdorin Relationship added related to 16428
2020-10-20 13:03 cdorin Issue Monitored: Jmantysalo
2020-10-20 14:28 DenisChenu Note Added: 60305
2020-10-20 15:04 cdorin Note Added: 60306
2020-10-20 15:16 DenisChenu Note Added: 60307
2020-10-20 15:23 cdorin Note Added: 60309
2020-10-20 15:27 DenisChenu Note Added: 60310
2020-10-20 15:35 cdorin Note Added: 60312
2020-10-20 15:44 DenisChenu Note Added: 60313
2020-10-21 08:07 DenisChenu Relationship added related to 16767
2020-10-22 16:57 DenisChenu Note Added: 60370
2020-10-22 18:38 cdorin Note Added: 60377
2020-10-22 18:47 DenisChenu Note Added: 60378
2020-10-22 18:53 cdorin Note Added: 60379
2020-10-22 19:18 DenisChenu Note Added: 60380
2020-10-23 09:45 cdorin Note Added: 60385
2020-10-31 11:18 DenisChenu Assigned To DenisChenu => cdorin
2020-10-31 11:18 DenisChenu Status assigned => ready for testing
2020-10-31 11:18 DenisChenu Note Added: 60478
2020-10-31 11:19 DenisChenu Relationship added related to 16799
2020-11-05 10:13 DenisChenu Note Added: 60552
2020-11-05 10:39 DenisChenu Note Added: 60554
2020-11-05 11:05 DenisChenu Note Added: 60556
2020-11-05 11:05 DenisChenu File Added: Survey group Permission - v1.1.0.odt
2020-11-10 15:46 DenisChenu Note Added: 60606
2020-11-10 15:46 DenisChenu File Added: Survey group Permission - v1.2.0.odt
2020-11-11 22:03 cdorin Note Added: 60615
2020-11-11 22:20 cdorin Note Added: 60616
2020-11-12 08:03 DenisChenu Note Added: 60620
2020-11-12 08:03 DenisChenu Relationship added related to 14551
2020-11-12 08:05 DenisChenu Note Added: 60621
2020-11-17 16:38 DenisChenu Note Added: 60680
2020-11-17 16:38 DenisChenu File Added: Capture d’écran du 2020-11-17 16-36-46.png
2020-11-17 17:25 DenisChenu Note Added: 60681
2020-11-17 17:26 DenisChenu Note Added: 60682
2020-11-19 20:05 cdorin Note Added: 60712
2020-11-20 09:25 DenisChenu Note Added: 60714
2020-11-20 09:26 DenisChenu Note Added: 60715
2020-11-20 09:26 DenisChenu File Added: Capture d’écran du 2020-11-20 09-15-10.png
2020-11-20 09:28 cdorin Note Added: 60716
2020-11-20 09:43 DenisChenu Note Added: 60717
2020-11-20 10:16 DenisChenu Note Added: 60718
2020-11-21 12:37 DenisChenu Relationship replaced parent of 16459
2020-12-22 10:40 cdorin Note Added: 61018
2020-12-22 16:22 ollehar Relationship added related to 16919
2022-09-15 15:58 DenisChenu Relationship deleted parent of 16459
2022-09-15 15:58 DenisChenu Relationship added related to 16459
2023-11-23 10:49 DenisChenu Relationship added related to 19270
2023-12-18 16:44 DenisChenu Status ready for testing => resolved
2023-12-18 16:44 DenisChenu Resolution open => fixed