View Issue Details

This bug affects 1 person(s).
 6
IDProjectCategoryView StatusLast Update
10528Bug reportsPluginspublic2018-09-28 14:12
ReporterDenisChenu Assigned ToDenisChenu  
PrioritynormalSeverityminor 
Status closedResolutionfixed 
Product Version2.50.x 
Fixed in Version2.50.x 
Summary10528: beforeHasPermission event don't happen for owner of survey
Description

beforeHasPermission event don't happen for owner of survey

Steps To Reproduce

If you set a Permission to false to all user (for erxample : activate survey : false : no user can activate a survey) : a user can create a survey and activate it.

Additional Information

https://github.com/LimeSurvey/LimeSurvey/blob/master/application/models/Permission.php#L601

I don't know waht to do for survey don't exist and console. Think this 2 must be uncontrolled by plugin.

I want to move too Login permission to the plugin : add a new event : globalPermission for example can do the trick.

TagsNo tags attached.
Bug heat6
Complete LimeSurvey version number (& build)160219
I will donate to the project if issue is resolvedNo
Browsernot relevant
Database type & versionnot relevant
Server OS (if known)not relevant
Webserver software & version (if known)not relevant
PHP Versionnot relevant

Relationships

related to 10648 closedc_schmitz Global permissions not working 

Users monitoring this issue

There are no users monitoring this issue.

Activities

ollehar

ollehar

2016-02-19 12:28

administrator   ~35444

You want to add a condition here, so user without activate rights can't activate survey they created? Not sure what your proposed solution is.

DenisChenu

DenisChenu

2016-02-19 13:46

developer   ~35453

Last edited: 2016-02-19 13:47

Hi olle : beforeHasPermission event doc : https://manual.limesurvey.org/BeforeHasPermission
"This event is fired just before a permission is tested. "

Then according to a doc beforeHasPermission must be lauch for

  • Super admin
  • Owner of survey (or any other owner (template/label set if we add it in next year))

Actually it's false with

  • Super admin : it can be a choice : super admin can deactivéte plugin , then not major issue
  • Owner of a survey : i think this must be corrected
  • Command : think it's best if command permission is always true

The exact real condition i need is "deactivate update of survey after activated" . I can do without fixing event, but think it's best if the core event is fixed.

Then i think

  • beforeHasPermission must be tested for any user with remote control or GUI
  • beforeHasPermission don't happen for Command because command is specific.

Denis
PS : issue : super admin have less right than owner of survey

c_schmitz

c_schmitz

2016-02-21 19:54

administrator   ~35482

Just move the check for owner to the HasPermissions() function.

DenisChenu

DenisChenu

2016-02-22 08:54

developer   ~35495

Oh yes, better idea :)

Maybe in the core plugin in future : owner_id come from auth but start with core system:)

DenisChenu

DenisChenu

2016-02-29 14:38

developer   ~35782

https://github.com/LimeSurvey/LimeSurvey/pull/451

DenisChenu

DenisChenu

2016-03-02 17:13

developer   ~35842

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=17729

c_schmitz

c_schmitz

2016-03-07 11:45

administrator   ~36020

Version 2.60 Build 150307 released

c_schmitz

c_schmitz

2016-03-08 11:46

administrator   ~36129

The change you did breaks global permissions completely.
Now a user with no global permissions has access to everything, no limitation.

DenisChenu

DenisChenu

2016-03-08 12:01

developer   ~36133

Fixed

c_schmitz

c_schmitz

2016-03-08 12:32

administrator   ~36135

Version 250+ Build 160308 released

DenisChenu

DenisChenu

2018-09-28 14:12

developer   ~49174

Fix committed to 2.06lts branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=28054

Related Changesets

LimeSurvey: master 0a6682e5

2016-02-29 13:35:03

DenisChenu

Details Diff
Fixed issue 10528: beforeHasPermission event don't happen for owner of survey
Dev: Move the test to hasPermission
Dev: same for CConsoleApplication
Dev: add getOwnerId : maybe this function is better in each model ?
Affected Issues
10528
mod - application/models/Permission.php Diff File

LimeSurvey: 2.06lts 2bfc9d5a

2016-02-29 14:35:03

DenisChenu

Details Diff
Fixed issue 10528: beforeHasPermission event don't happen for owner of survey
Dev: Move the test to hasPermission
Dev: same for CConsoleApplication
Dev: add getOwnerId : maybe this function is better in each model ?
Affected Issues
10528
mod - application/models/Permission.php Diff File

LimeSurvey: master 1a51d7da

2016-03-02 16:13:11

DenisChenu

Details Diff
Merge pull request #451 from Shnoulle/master_fix10528

Fixed issue 10528: beforeHasPermission fixes
Affected Issues
10528
mod - application/models/Permission.php Diff File

LimeSurvey: master f6a17b63

2016-03-08 10:57:27

DenisChenu

Details Diff
Dev: Fixed issue : Permission always return true
Dev: https://github.com/Shnoulle/LimeSurvey-Shnoulle/commit/9cf4b0db35a51c398b4905b694e4f27608f9ec2f child
Affected Issues
10528
mod - application/models/Permission.php Diff File

Issue History

Date Modified Username Field Change
2016-02-19 12:14 DenisChenu New Issue
2016-02-19 12:28 ollehar Note Added: 35444
2016-02-19 13:46 DenisChenu Note Added: 35453
2016-02-19 13:47 DenisChenu Note Edited: 35453
2016-02-21 19:54 c_schmitz Note Added: 35482
2016-02-22 08:53 DenisChenu Assigned To => DenisChenu
2016-02-22 08:53 DenisChenu Status new => assigned
2016-02-22 08:54 DenisChenu Note Added: 35495
2016-02-29 14:38 DenisChenu Note Added: 35782
2016-03-02 17:13 DenisChenu Changeset attached => LimeSurvey master 0a6682e5
2016-03-02 17:13 DenisChenu Changeset attached => LimeSurvey master 1a51d7da
2016-03-02 17:13 DenisChenu Note Added: 35842
2016-03-02 17:13 DenisChenu Resolution open => fixed
2016-03-03 08:13 DenisChenu Status assigned => resolved
2016-03-03 08:13 DenisChenu Fixed in Version => 2.5
2016-03-07 11:45 c_schmitz Note Added: 36020
2016-03-07 11:45 c_schmitz Status resolved => closed
2016-03-08 11:46 c_schmitz Note Added: 36129
2016-03-08 11:46 c_schmitz Status closed => feedback
2016-03-08 11:46 c_schmitz Resolution fixed => reopened
2016-03-08 11:47 c_schmitz Relationship added related to 10648
2016-03-08 12:00 DenisChenu Changeset attached => LimeSurvey master f6a17b63
2016-03-08 12:01 DenisChenu Note Added: 36133
2016-03-08 12:01 DenisChenu Status feedback => assigned
2016-03-08 12:01 DenisChenu Status assigned => resolved
2016-03-08 12:01 DenisChenu Resolution reopened => fixed
2016-03-08 12:32 c_schmitz Note Added: 36135
2016-03-08 12:32 c_schmitz Status resolved => closed
2018-09-28 14:12 DenisChenu Changeset attached => LimeSurvey 2.06lts 2bfc9d5a
2018-09-28 14:12 DenisChenu Note Added: 49174