View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update | 
|---|---|---|---|---|---|
| 16509 | Bug reports | Question editor | public | 2020-07-21 02:04 | 2020-08-03 11:23 | 
| Reporter | gabrieljenik | Assigned To | |||
| Priority | none | Severity | block | ||
| Status | closed | Resolution | fixed | ||
| Product Version | 4.3.4 | ||||
| Summary | 16509: Permissions are weakly checked on conditions designer | ||||
| Description | While reviewing 16127 got to see that permission checking wasn't checked properly | ||||
| Tags | No tags attached. | ||||
| Bug heat | 8 | ||||
| Complete LimeSurvey version number (& build) | 4.3.4 | ||||
| I will donate to the project if issue is resolved | No | ||||
| Browser | |||||
| Database type & version | Mysql | ||||
| Server OS (if known) | |||||
| Webserver software & version (if known) | |||||
| PHP Version | 7 | ||||
| Addedit in the same PR as in the screen reorg | |
| Tested the issue after pulling the PR, I see the copy conditions button and also the user does not have full access. I am not sure what other things to be tested here? Please refer the attachment for more details | |
| I forsee the following testing scenarios: 0) Grab the url for the conditions manager for a given question. Ex: 1) Create a user with no read permissions over a survey. 2) Create a user with read permissions over a survey. 3) Create a user with update permissions over a survey (but not owner neither superadmin). Thanks | |
| 
 Ok, so test case #2 is not being tested successfully, right? | |
| Ok I will test this scenario's and get back to you | |
| 
 That screen doesn't look like the one redesigned. | |
| Tested the issue after pulling the PR, below are my findings. Please refer the attachment for more details 0) Grab the url for the conditions manager for a given question. Ex: 1) Create a user with no read permissions over a survey                                                                    --Getting a forbidden message 2) Create a user with read permissions over a survey.                                                                           ---Working as expected 3) Create a user with update permissions over a survey (but not owner neither superadmin).      --Getting a forbidden message 4) Create a user with view & update permissions over a survey | |
| Understand #1 and #3 are working as expected, right? | |
| 
 | |
| Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30337 | |
| Fixed in Release 4.3.8+200803 | |
| LimeSurvey: master f8156841 2020-07-21 04:19 
		Committer:  Details Diff | Fixed issue 16509: Permissions are weakly checked on conditions designer Added permissions checking for update actions | Affected Issues 16509 | |
| mod - application/controllers/admin/conditionsaction.php | Diff File | ||
| mod - application/views/admin/conditions/conditionshead_view.php | Diff File | ||
| mod - application/views/admin/conditions/conditionslist_view.php | Diff File | ||
| LimeSurvey: master 4333ad23 2020-07-27 18:49 
		Committer:  Details Diff | Fixed issue 16509: Permissions are weakly checked on conditions designer Added permissions checking for update actions | Affected Issues 16509 | |
| mod - application/views/admin/conditions/includes/conditionslist_footer_view.php | Diff File | ||
| Date Modified | Username | Field | Change | 
|---|---|---|---|
| 2020-07-21 02:04 | gabrieljenik | New Issue | |
| 2020-07-21 02:23 | gabrieljenik | Relationship added | related to 16127 | 
| 2020-07-21 02:23 | gabrieljenik | Note Added: 59010 | |
| 2020-07-24 14:36 |  | Note Added: 59074 | |
| 2020-07-24 14:36 |  | File Added: 16509_Permissions.png | |
| 2020-07-24 15:08 | gabrieljenik | Note Added: 59075 | |
| 2020-07-24 15:09 | gabrieljenik | Note Added: 59076 | |
| 2020-07-24 15:11 | gabrieljenik | Note Edited: 59076 | |
| 2020-07-24 15:21 |  | Note Added: 59079 | |
| 2020-07-24 16:05 |  | File Deleted: 16509_RedDot.png | |
| 2020-07-24 19:47 | gabrieljenik | Note Added: 59086 | |
| 2020-07-24 19:47 | gabrieljenik | File Added: image.png | |
| 2020-07-27 17:36 |  | Note Added: 59104 | |
| 2020-07-27 17:36 |  | File Added: 16509_Tim_ReadAccess.png | |
| 2020-07-27 17:36 |  | File Added: 16509_Tim_NoReadAccess.png | |
| 2020-07-27 17:36 |  | File Added: 16509_Tim_UpdateAccess.png | |
| 2020-07-27 17:36 |  | File Added: 16509_Tim_View&UpdateAccess.png | |
| 2020-07-27 18:01 | gabrieljenik | Note Added: 59106 | |
| 2020-07-28 17:36 |  | Note Added: 59117 | |
| 2020-08-03 10:20 |  | Changeset attached | => LimeSurvey master 4333ad23 | 
| 2020-08-03 10:20 |  | Changeset attached | => LimeSurvey master f8156841 | 
| 2020-08-03 10:20 |  | Note Added: 59249 | |
| 2020-08-03 11:23 | lime_release_bot | Note Added: 59254 | |
| 2020-08-03 11:23 | lime_release_bot | Status | new => closed | 
| 2020-08-03 11:23 | lime_release_bot | Resolution | open => fixed | 




