| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 14557 | Bug reports | User / Groups / Roles | public | 2019-02-20 10:55 | 2022-09-27 21:27 |
| Reporter | Mazi | Assigned To | gabrieljenik | ||
| Priority | high | Severity | partial_block | ||
| Status | closed | Resolution | fixed | ||
| Product Version | 3.15.x | ||||
| Summary | 14557: User with very limited rights is allowed to set expiry date at survey list screen | ||||
| Description | A user who has no additional global rights and at survey level is only allowed to view quotas can pick a survey at the survey list and set the expiration date using the "mass action" drop down for selected surveys and selecting "Set expiry date". | ||||
| Steps To Reproduce | Create a new user with no global rights. | ||||
| Tags | No tags attached. | ||||
| Bug heat | 12 | ||||
| Complete LimeSurvey version number (& build) | 3.14.8+180829 | ||||
| I will donate to the project if issue is resolved | No | ||||
| Browser | Chrome | ||||
| Database type & version | MySQL 5 | ||||
| Server OS (if known) | Linux | ||||
| Webserver software & version (if known) | Apache 2 | ||||
| PHP Version | 7.2 | ||||
 |
Hope delete is OK ? Did you test Survey theme too ? |
 |
issue with the permissions system |
|
|
@cdorin : no : issue in MAssAction : it not testing Permission on surveys … See : https://github.com/LimeSurvey/LimeSurvey/blob/5ee5ce1c94572443e97f23321632a0571d0cb491/application/controllers/admin/surveyadmin.php#L62 Permission is checked I think the best way is https://github.com/LimeSurvey/LimeSurvey/blob/5ee5ce1c94572443e97f23321632a0571d0cb491/application/controllers/admin/surveyadmin.php#L347 : using action for a single survey. |
 |
You're using an outdated version of LimeSurvey. Please update to the latest version and check if the bug can still be reproduced. Thank you. |
 |
Please test yourself or ask your quality team to have a look. I am happy to report bugs but as a Limesurvey partner I am not part of the quality management team responsible for checking the ticket status every few months just because it "could" have been fixed. |
|
|
@galads Time to test, next week perhaps? |
|
|
It is possible. I will add to the backlog |
 |
|
|
|
While testing, I notice that the Delete mass action does not work well. It checks the permission, but it does not return a status. Instead of the row showing the status "Error", nothing appears. |
|
|
Fix committed to 3.x-LTS branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=32863 |
|
|
Fix committed to 3.x-LTS branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=32868 |
