Dependency Graph

Dependency Graph
related to related to child of child of duplicate of duplicate of

View Issue Details

This bug affects 1 person(s).
 10
IDProjectCategoryView StatusLast Update
18294Bug reportsUser / Groups / Rolespublic2023-10-23 20:58
ReporterDenisChenu Assigned Togabrieljenik  
PrioritynormalSeverityminor 
Status closedResolutionreopened 
Product Version5.3.x 
Summary18294: User can not see group created and user in group created
Description

When user create a new group in 3.X , he was automatically added to this group (and can not remove himself).
It was not true in 5.X
If user was not super admin : he didn't see user in group and group

Steps To Reproduce

Steps to reproduce

  1. usercontrolSameGroupPolicy as true
  2. Create an user with User read/create permission + UserGroup read/create permission
  3. Set User group Policy to On
  4. Log in as this user
  5. Create a new usergroup
  6. Check user group list

1 as super admin

  1. Create a new usergroup
  2. Check user group list

Expected result

User was in list (and can not be remoced)

Actual result

user are not in list

Additional Information
  1. usercontrolSameGroupPolicy as true
TagsNo tags attached.
Bug heat10
Complete LimeSurvey version number (& build)5.3.28
I will donate to the project if issue is resolvedNo
Browsernot relevant
Database type & versionnot relevant
Server OS (if known)not relevant
Webserver software & version (if known)not relevant
PHP Versionnot relevant

Relationships

related to 18289 confirmed User with group creation allowed can not see is own group 
related to 18281 closedtibor.pacalat Users in group are not deleted 

Activities

DenisChenu

DenisChenu

2022-07-29 10:18

developer   ~71240

This one is more easy to fix without potentially broke existing code.
I fix it quickly

The other need fix :

  • we use owner_id : in 3.X , user can create a group and be removed from group by super admin : then need a owner_id update
  • we keep same 3.X functionality ;: what to do with previous group ? Nothing : 18289 still there, Updateing to put owner_id in group : always needed ? Broke potential Permission usage.
gabrieljenik

gabrieljenik

2022-08-26 19:44

manager   ~71535

Well, you are asuming this is bug.
By looking at the discussions on the other tickets, I am not sure it is a bug.

DenisChenu

DenisChenu

2022-08-27 19:40

developer   ~71541

In 3.X , user can create a group and be removed from group by super admin : then need a owner_id update

In 5: user can not see the group after creation…

DenisChenu

DenisChenu

2022-09-09 16:24

developer   ~71667

@ollehar : see other ticket, way to resolve and owner_id issues

With usercontrolSameGroupPolicy
In 3. X :

  1. creator are added to user list
  2. if superadmin remove user from group
  3. creator didn't see group (i didn't test with hacking forms …)

In 5.X :

  1. creator are NOT added to user list
  2. creator didn't see group
  3. But creator seems have some rights on usergroup (Maybe he have same right in 3.X)

See : https://bugs.limesurvey.org/view.php?id=18281#c71525

My opinion :

  1. This fix this issue and ONLY this issue : minor impact

  2. To have a clean owner_id system and Permssion systeml for view : we need to move to PermissionTrait for user and usergroup :

  3. usercontrolSameGroupPolicy == false => All user have read rights on user and on groups

  4. usercontrolSameGroupPolicy == true => User have read right if in same groups OR if there owner in group

  5. user with create right : owner_id is set : user can see it (and move to group)

  6. User update can only update if he have read rights on this user

  7. We need a update owner in UserGroups + Users (but it(s a new feature)

c_schmitz

c_schmitz

2023-05-30 14:49

administrator   ~75254

PLease solve it this way:

For LS5:
The group owner should be member of the group. The patch fixes this, but points to the wrong branch currently (master instead of 5.x).

For LS6:
The group owner can be a group member, but doesn't have to be. However, the group owner should always be able to see/edit group members.

DenisChenu

DenisChenu

2023-05-30 18:46

developer   ~75265

The group owner can be a group member, but doesn't have to be. However, the group owner should always be able to see/edit group members.

Then : need a Permission system adding owner_id in Group model.

Right ?

DenisChenu

DenisChenu

2023-05-30 18:47

developer   ~75266

For LS5:
The group owner should be member of the group. The patch fixes this, but points to the wrong branch currently (master instead of 5.x).

Pull request from Aug 26, 2022 …

tibor.pacalat

tibor.pacalat

2023-09-28 14:12

administrator   ~77398

@DenisChenu what is the status of this ticket? I see one PR https://github.com/LimeSurvey/LimeSurvey/pull/2581 but it is not clear to me how should I proceed.

DenisChenu

DenisChenu

2023-09-28 15:01

developer   ~77405

I need toi update for last 5.X
And create a new one for 6

DenisChenu

DenisChenu

2023-10-02 10:23

developer   ~77457

Last edited: 2023-10-02 10:23

Ready for 5.X

DenisChenu

DenisChenu

2023-10-02 11:10

developer   ~77458

5.X : https://github.com/LimeSurvey/LimeSurvey/pull/2581
master : https://github.com/LimeSurvey/LimeSurvey/pull/3504

DenisChenu

DenisChenu

2023-10-02 17:13

developer   ~77469

Fix committed to 5.x branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=35563

DenisChenu

DenisChenu

2023-10-02 17:20

developer   ~77470

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=35564

tibor.pacalat

tibor.pacalat

2023-10-02 17:20

administrator   ~77471

Tested and merged.

LimeBot

LimeBot

2023-10-04 11:28

administrator   ~77498

Fixed in Release 6.2.10+231004

gabrieljenik

gabrieljenik

2023-10-20 14:44

manager   ~77806

Unluckily, the v6 PR didn't considered a refactorying we have done.
https://github.com/LimeSurvey/LimeSurvey/pull/3447/files#diff-0a0e2b974470e717a216950e1374f76ba04f409a55f562a9b59f91cb79451ccd

Why our refactoring got lost?
#18995 was done & merged.
Then reverted.
That's when this ticket got done.

Not sure what's the best way to handle this.
I think it is best if @DenisChenu you could take the refactoring and merge it in the code you did.

What do you think?

DenisChenu

DenisChenu

2023-10-20 16:17

developer   ~77815

It's about getUserList and protected static function getPermissionCriteria ?

Right ?

Then best seems to include Permission::Trait ,

But totally related to User Permission (update/delete)

DenisChenu

DenisChenu

2023-10-20 16:19

developer   ~77816

V6 PR do the minimal update to fix this issue.

The getpermissionCriterai is realted to whole Permission system for User

Related Changesets

LimeSurvey: 5.x db85fde5

2023-10-02 17:13:07

DenisChenu


Committer: GitHub Details Diff
Fixed issue 18294: User was not added to group created automatically (#2581) Affected Issues
18294
mod - application/controllers/UserGroupController.php Diff File

LimeSurvey: master f83e0e83

2023-10-02 17:20:08

DenisChenu


Committer: GitHub Details Diff
Fixed issue 18294: User can not see group created and user in group created (#3504) Affected Issues
18294
mod - application/helpers/common_helper.php Diff File

Issue History

Date Modified Username Field Change
2022-07-29 10:16 DenisChenu New Issue
2022-07-29 10:16 DenisChenu Assigned To => DenisChenu
2022-07-29 10:16 DenisChenu Status new => confirmed
2022-07-29 10:16 DenisChenu Relationship added related to 18289
2022-07-29 10:18 DenisChenu Note Added: 71240
2022-07-29 10:18 DenisChenu Bug heat 0 => 2
2022-07-29 10:18 DenisChenu Status confirmed => assigned
2022-07-29 10:19 DenisChenu Priority none => normal
2022-08-26 19:23 DenisChenu Assigned To DenisChenu => gabrieljenik
2022-08-26 19:23 DenisChenu Status assigned => ready for code review
2022-08-26 19:44 gabrieljenik Note Added: 71535
2022-08-26 19:44 gabrieljenik Bug heat 2 => 4
2022-08-27 19:40 DenisChenu Note Added: 71541
2022-08-29 15:22 gabrieljenik Assigned To gabrieljenik => DenisChenu
2022-08-29 15:28 DenisChenu Status ready for code review => ready for testing
2022-09-01 13:26 DenisChenu Steps to Reproduce Updated
2022-09-01 13:26 DenisChenu Additional Information Updated
2022-09-09 16:24 DenisChenu Assigned To DenisChenu => ollehar
2022-09-09 16:24 DenisChenu Status ready for testing => ready for merge
2022-09-09 16:24 DenisChenu Note Added: 71667
2022-09-09 16:24 DenisChenu Relationship added related to 18281
2023-05-30 14:49 c_schmitz Note Added: 75254
2023-05-30 14:49 c_schmitz Bug heat 4 => 6
2023-05-30 18:46 DenisChenu Note Added: 75265
2023-05-30 18:47 DenisChenu Note Added: 75266
2023-09-28 14:12 tibor.pacalat Note Added: 77398
2023-09-28 14:12 tibor.pacalat Bug heat 6 => 8
2023-09-28 15:01 DenisChenu Note Added: 77405
2023-10-02 08:50 DenisChenu Assigned To ollehar => DenisChenu
2023-10-02 08:50 DenisChenu Status ready for merge => assigned
2023-10-02 10:23 DenisChenu Note Added: 77457
2023-10-02 10:23 DenisChenu Note Edited: 77457
2023-10-02 11:06 DenisChenu Summary User was not added to group created automatically => User can not see group created and user in group created
2023-10-02 11:10 DenisChenu Note Added: 77458
2023-10-02 12:26 DenisChenu Assigned To DenisChenu => gabrieljenik
2023-10-02 12:26 DenisChenu Status assigned => ready for code review
2023-10-02 14:53 gabrieljenik Assigned To gabrieljenik => DenisChenu
2023-10-02 14:53 gabrieljenik Status ready for code review => ready for testing
2023-10-02 16:37 DenisChenu Assigned To DenisChenu => tibor.pacalat
2023-10-02 17:13 DenisChenu Changeset attached => LimeSurvey 5.x db85fde5
2023-10-02 17:13 DenisChenu Note Added: 77469
2023-10-02 17:13 DenisChenu Assigned To tibor.pacalat => DenisChenu
2023-10-02 17:13 DenisChenu Resolution open => fixed
2023-10-02 17:20 DenisChenu Changeset attached => LimeSurvey master f83e0e83
2023-10-02 17:20 DenisChenu Note Added: 77470
2023-10-02 17:20 tibor.pacalat Status ready for testing => resolved
2023-10-02 17:20 tibor.pacalat Note Added: 77471
2023-10-04 11:28 LimeBot Note Added: 77498
2023-10-04 11:28 LimeBot Status resolved => closed
2023-10-04 11:28 LimeBot Bug heat 8 => 10
2023-10-20 14:44 gabrieljenik Note Added: 77806
2023-10-20 16:16 DenisChenu Status closed => feedback
2023-10-20 16:16 DenisChenu Resolution fixed => reopened
2023-10-20 16:17 DenisChenu Note Added: 77815
2023-10-20 16:19 DenisChenu Note Added: 77816
2023-10-20 16:19 DenisChenu Assigned To DenisChenu => gabrieljenik
2023-10-23 20:58 gabrieljenik Status feedback => closed