View Issue Details

IDProjectCategoryView StatusLast Update
14557Bug reports[All Projects] User/User groupspublic2019-03-08 11:31
ReporterMazi Assigned Tomarkusfluer  
PrioritynoneSeveritymajor 
Status assignedResolutionopen 
Product Version3.15.x 
Target VersionFixed in Version 
Summary14557: User with very limited rights is allowed to set expiry date at survey list screen
Description

A user who has no additional global rights and at survey level is only allowed to view quotas can pick a survey at the survey list and set the expiration date using the "mass action" drop down for selected surveys and selecting "Set expiry date".

Steps To Reproduce

Create a new user with no global rights.
Assign the user to a test survey and give rights to only view quotas.
Go to the survey list and select the survey.
Use the drop down bottom left (see screenshot) to set an expiry date.

TagsNo tags attached.
Complete LimeSurvey version number (& build)3.14.8+180829
I will donate to the project if issue is resolvedNo
BrowserChrome
Database & DB-VersionMySQL 5
Server OS (if known)Linux
Webserver software & version (if known)Apache 2
PHP Version7.2

Activities

Mazi

Mazi

2019-02-20 10:55

partner  

survey_expiration.png (19,882 bytes)
survey_expiration.png (19,882 bytes)
quota_rights.png (36,988 bytes)
quota_rights.png (36,988 bytes)
DenisChenu

DenisChenu

2019-02-21 14:40

developer   ~50661

Hope delete is OK ?

Did you test Survey theme too ?

cdorin

cdorin

2019-03-08 11:25

manager   ~50832

issue with the permissions system

DenisChenu

DenisChenu

2019-03-08 11:31

developer   ~50833

@cdorin : no : issue in MAssAction : it not testing Permission on surveys …

See : https://github.com/LimeSurvey/LimeSurvey/blob/5ee5ce1c94572443e97f23321632a0571d0cb491/application/controllers/admin/surveyadmin.php#L62 Permission is checked
But here : Permission not checked : https://github.com/LimeSurvey/LimeSurvey/blob/5ee5ce1c94572443e97f23321632a0571d0cb491/application/controllers/admin/surveyadmin.php#L1000

I think the best way is https://github.com/LimeSurvey/LimeSurvey/blob/5ee5ce1c94572443e97f23321632a0571d0cb491/application/controllers/admin/surveyadmin.php#L347 : using action for a single survey.

Issue History

Date Modified Username Field Change
2019-02-20 10:55 Mazi New Issue
2019-02-20 10:55 Mazi File Added: survey_expiration.png
2019-02-20 10:55 Mazi File Added: quota_rights.png
2019-02-21 14:40 DenisChenu Note Added: 50661
2019-03-08 11:25 cdorin Assigned To => markusfluer
2019-03-08 11:25 cdorin Status new => assigned
2019-03-08 11:25 cdorin Steps to Reproduce Updated View Revisions
2019-03-08 11:25 cdorin Note Added: 50832
2019-03-08 11:31 DenisChenu Note Added: 50833