Sounds like a rather serious security issue if anyone can see/edit any template!ß

For information in 2.6lts, tested only template editor. About template rights : only one checkbox for each templates

• User have right on 2 templates, no global rights on templates : can not see Template Editor menu (didn't test if access is out too)
• User have right on 2 templates, + read global rights on templates : can see all templates editor, can not save one (even the 2 checked in templates rights).

PS1 : Finally : template rights (single) is used only for "usage in survey" rights, not in template editor
PS2 : seem mùore a feature request : Single template is "READ(use)" rights, not CRUD rights

Hello gabrieljenik,
This should already be fixed in recent versions.
Can you please check if this issue still exists in the latest version of LimeSurvey and let us know?
Thank you!

I'm sure not …
There are no Permission system for template.

It's a feature

Issue persists.

Created a user with View/read and Update permissions on Templates.
Edited "Template permissions" for that user, granting access to only two themes.

Logged in with that user and entered the "Themes" page. All themes are shown and all can be edited. Changes are saved.

Changes suggested:

• The user should only be able to operate accoridng to the permissions given on the templates he has been given acecss to.
• When a user creates a new theme, he would be receiving access to it.

Created 17190 to avoid missunderstandings about the language

Changes suggested:

Create a complete Theme Permission system.

No ?

Else

• When a user creates a new theme, he would be receiving access to it.

Can create a owner_id for template ? https://github.com/LimeSurvey/LimeSurvey/blob/226d4e8ae8759dc46378f2d3ebe749bacebbab8b/application/models/Permission.php#L759

But need to fix template (as directory) against Template : Template::model against TemplateConfig::model : created when a template is «installed»

@gabrieljenik, should this work similar to a survey:
If I create a new survey, I have all the rights -> same can be applied to a theme.
If a survey is assigned to me, certain rights are defined. -> If I am assigned the right to access a template, the global template rights (e.g. view only or edit or ...) are applied.

Do you envision it to work like this?

Will this be adjusted for LS3 as well or LS 4 only?

Will this be adjusted for LS3 as well or LS 4 only?

My opinion : LS4 using LimeSurvey\Models\Services\PermissionManager and UserPermissionsWidget to manage the HTML.

Do you envision it to work like this?

Hi originally registered this ticket thinking the theme "access" permission provided access to the theme editor.
I was wrong. It was only for using it on surveys.

Then the ticket turned into a feature request.
But that is a confusion. I don't have any specific request nor expectation nor design previewed. :)

If something needs to be done, I would just add a permission system, as for individual surveys, but for individual themes.
Still, not sure if it is worth it right now.

I wish this could be possible