LimeSurvey: master 17f0a0d5

Diff Back to Repository
Author Committer Branch Timestamp Parent
DenisChenu GitHub master 2020-08-06 14:08:31 master ee736100
Affected Issues  16467: Multiple XSS vulnerabilities
 16469: Any admin user can see any question (without read right on survey)
Changeset

Master ls base controller check params (#1479)

Fixed issue 16469: Any admin user can see any question (without read right on survey)
Fixed issue #16467: Reflected XSS vulnerabilities
Dev: add a function to validate int parameters
Dev: throw 400/403 or 404 error

Dev: remove some uneeded redirect and filter

Dev: Move functionnality to an helper function to call
Dev : getValidateSurveyId return a validated sid related with qid and gid

Dev: rename to getValidatedSurveyId
Dev: getQuestionObject must be reviewed : $sureyId must be a mandatory param

Dev: more details in function doc and fix partially phpDoc

Dev: getValidatedSurveyId get the final sid by param
Dev: review test :
mod - application/controllers/LSBaseController.php Diff File
mod - application/controllers/QuestionEditorController.php Diff File
mod - tests/functional/backend/AdminViewsTest.php Diff File