View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
16509 | Bug reports | Question editor | public | 2020-07-21 02:04 | 2020-08-03 11:23 |
Reporter | gabrieljenik | Assigned To | |||
Priority | none | Severity | block | ||
Status | closed | Resolution | fixed | ||
Product Version | 4.3.4 | ||||
Summary | 16509: Permissions are weakly checked on conditions designer | ||||
Description | While reviewing 16127 got to see that permission checking wasn't checked properly | ||||
Tags | No tags attached. | ||||
Bug heat | 8 | ||||
Complete LimeSurvey version number (& build) | 4.3.4 | ||||
I will donate to the project if issue is resolved | No | ||||
Browser | |||||
Database type & version | Mysql | ||||
Server OS (if known) | |||||
Webserver software & version (if known) | |||||
PHP Version | 7 | ||||
Addedit in the same PR as in the screen reorg |
|
Tested the issue after pulling the PR, I see the copy conditions button and also the user does not have full access. I am not sure what other things to be tested here? Please refer the attachment for more details |
|
I forsee the following testing scenarios: 0) Grab the url for the conditions manager for a given question. Ex: 1) Create a user with no read permissions over a survey. 2) Create a user with read permissions over a survey. 3) Create a user with update permissions over a survey (but not owner neither superadmin). Thanks |
|
Ok, so test case #2 is not being tested successfully, right? |
|
Ok I will test this scenario's and get back to you |
|
That screen doesn't look like the one redesigned. |
|
Tested the issue after pulling the PR, below are my findings. Please refer the attachment for more details 0) Grab the url for the conditions manager for a given question. Ex: 1) Create a user with no read permissions over a survey --Getting a forbidden message 2) Create a user with read permissions over a survey. ---Working as expected 3) Create a user with update permissions over a survey (but not owner neither superadmin). --Getting a forbidden message 4) Create a user with view & update permissions over a survey |
|
Understand #1 and #3 are working as expected, right? |
|
|
|
Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=30337 |
|
Fixed in Release 4.3.8+200803 |
|
LimeSurvey: master f8156841 2020-07-21 04:19
Committer: Details Diff |
Fixed issue 16509: Permissions are weakly checked on conditions designer Added permissions checking for update actions |
Affected Issues 16509 |
|
mod - application/controllers/admin/conditionsaction.php | Diff File | ||
mod - application/views/admin/conditions/conditionshead_view.php | Diff File | ||
mod - application/views/admin/conditions/conditionslist_view.php | Diff File | ||
LimeSurvey: master 4333ad23 2020-07-27 18:49
Committer: Details Diff |
Fixed issue 16509: Permissions are weakly checked on conditions designer Added permissions checking for update actions |
Affected Issues 16509 |
|
mod - application/views/admin/conditions/includes/conditionslist_footer_view.php | Diff File |
Date Modified | Username | Field | Change |
---|---|---|---|
2020-07-21 02:04 | gabrieljenik | New Issue | |
2020-07-21 02:23 | gabrieljenik | Relationship added | related to 16127 |
2020-07-21 02:23 | gabrieljenik | Note Added: 59010 | |
2020-07-24 14:36 |
|
Note Added: 59074 | |
2020-07-24 14:36 |
|
File Added: 16509_Permissions.png | |
2020-07-24 15:08 | gabrieljenik | Note Added: 59075 | |
2020-07-24 15:09 | gabrieljenik | Note Added: 59076 | |
2020-07-24 15:11 | gabrieljenik | Note Edited: 59076 | |
2020-07-24 15:21 |
|
Note Added: 59079 | |
2020-07-24 16:05 |
|
File Deleted: 16509_RedDot.png | |
2020-07-24 19:47 | gabrieljenik | Note Added: 59086 | |
2020-07-24 19:47 | gabrieljenik | File Added: image.png | |
2020-07-27 17:36 |
|
Note Added: 59104 | |
2020-07-27 17:36 |
|
File Added: 16509_Tim_ReadAccess.png | |
2020-07-27 17:36 |
|
File Added: 16509_Tim_NoReadAccess.png | |
2020-07-27 17:36 |
|
File Added: 16509_Tim_UpdateAccess.png | |
2020-07-27 17:36 |
|
File Added: 16509_Tim_View&UpdateAccess.png | |
2020-07-27 18:01 | gabrieljenik | Note Added: 59106 | |
2020-07-28 17:36 |
|
Note Added: 59117 | |
2020-08-03 10:20 |
|
Changeset attached | => LimeSurvey master 4333ad23 |
2020-08-03 10:20 |
|
Changeset attached | => LimeSurvey master f8156841 |
2020-08-03 10:20 |
|
Note Added: 59249 | |
2020-08-03 11:23 | lime_release_bot | Note Added: 59254 | |
2020-08-03 11:23 | lime_release_bot | Status | new => closed |
2020-08-03 11:23 | lime_release_bot | Resolution | open => fixed |