View Issue Details

Jump to NotesJump to History
This bug affects 1 person(s).
 252
IDProjectCategoryView StatusDate SubmittedLast Update
10329Bug reportsSecuritypublic2016-02-06 22:452016-02-07 20:42
Reporterasshank Assigned Toc_schmitz  
PrioritynormalSeverityminor 
Status closedResolutionduplicate 
Product Version2.50.x 
Summary10329: adminpanel: user sees all Surveys regardless of permissions
Description

When logged in as a user in the adminpanel the list of surveys shows all the surveys not just the surveys the user is owner of.

When compared with 2.06+ I file it as a minor security bug because you see the surveys but there is no permission to manange them.

Steps To Reproduce

Log in as a restricted user (regardless of the userpermissions, but no permissions will be suficient).

Additional Information

Somewhere down the line a query had no ' WHERE owner_id=x'
I was not been able to see where it resides so no github pull this time.

TagsNo tags attached.
Bug heat252
Complete LimeSurvey version number (& build)160206
I will donate to the project if issue is resolvedNo
Browser
Database type & version253
Server OS (if known)unix
Webserver software & version (if known)apache
PHP Version5.3.3

Relationships

Relationship GraphDependency Graph
duplicate of 10325 closedLouisGac User right settings not followed in new interface : survey listing 

Users monitoring this issue

There are no users monitoring this issue.

Activities

asshank

asshank

2016-02-06 22:47

reporter   ~34677

php version 5.5.3 (mistyped)

Issue History

Date Modified Username Field Change
2016-02-06 22:45 asshank New Issue
2016-02-06 22:47 asshank Note Added: 34677
2016-02-07 20:42 c_schmitz Relationship added duplicate of 10325
2016-02-07 20:42 c_schmitz Status new => closed
2016-02-07 20:42 c_schmitz Assigned To => c_schmitz
2016-02-07 20:42 c_schmitz Resolution open => duplicate