View Issue Details

Related ChangesetsJump to NotesJump to History
This issue affects 3 person(s).
 20
IDProjectCategoryView StatusDate SubmittedLast Update
19414Bug reportsUser / Groups / Rolespublic2024-02-13 16:212026-10-20 17:06
ReporterDenisChenu Assigned Toc_schmitz  
PrioritynoneSeverityminor 
Status closedResolutionfixed 
Product Version5.6.x 
Summary19414: Roles management : No way to assign minimal roles by «admin user»
Description

Since fix https://bugs.limesurvey.org/view.php?id=18977 (18977: Improper Authorization in add role function leads to privilege escalation)
An admin user can not give role with only "Manage survey" for example

Steps To Reproduce

Steps to reproduce

Create role with "Create survey" + "Use theme"
Create an user with

  • All User permssion
  • All Surveys permission
  • All theme permission

As this user : create an user and try to give the role 'SurveyCreator'

Expected result

The user can give this roles

Actual result

No way to give this roles

TagsNo tags attached.
Bug heat20
Complete LimeSurvey version number (& build) 6.4.6
I will donate to the project if issue is resolvedNo
Browsernot relevant
Database type & versionnot relevant
Server OS (if known)not relevant
Webserver software & version (if known)not relevant
PHP Versionnot relevant
Git branch / Pull Request URLN/A

Users monitoring this issue

stevelegare

Activities

DenisChenu

DenisChenu

2024-02-13 16:24

developer   ~79476

An idea to correct this situation would be to have an additional option on roles: who can assign or delete this role. with:

  • superadmin/write OR
  • superadmin (only) OR
  • "Only user permission"

This settings can be only updated by superadmin/write permssion user. And only such user can update roles.
DenisChenu

DenisChenu

2024-02-13 16:25

developer   ~79477

Ping @tibor.pacalat : can you ask if such solution can be accepted in 5.X ?
Else : i need a new plugin … :(
c_schmitz

c_schmitz

2026-10-18 00:52

administrator   ~86529

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=40911
LimeBot

LimeBot

2026-10-20 17:06

administrator   ~86580

Fixed in Release 7.7.0+261020

Related Changesets

LimeSurvey: master 420131d8

2026-10-18 00:52

c_schmitz


Details Diff		 Fixed issue 19414: Administrators without superadmin rights could not assign any role to their users
Dev Assigning roles now removes the individual global permissions of the user		 Affected Issues
19414
mod - application/controllers/UserManagementController.php Diff File
mod - application/extensions/admin/grid/FloatingActionsWidget/actions/UserManagementMassiveActions.php Diff File
mod - application/models/services/UserManager.php Diff File
mod - application/views/userManagement/massiveAction/_updaterole.php Diff File
mod - application/views/userManagement/partial/addrole.php Diff File
mod - tests/unit/models/UserManagerServiceTest.php Diff File

Issue History

Date Modified Username Field Change
2024-02-13 16:21 DenisChenu New Issue
2024-02-13 16:24 DenisChenu Note Added: 79476
2024-02-13 16:24 DenisChenu Bug heat 0 => 2
2024-02-13 16:25 DenisChenu Note Added: 79477
2024-07-01 09:17 DenisChenu Summary No way to assign minimal roles by «admin user» => Roles management : No way to assign minimal roles by «admin user»
2024-10-16 20:07 stevelegare Issue Monitored: stevelegare
2024-10-16 20:07 stevelegare Bug heat 2 => 10
2024-10-24 11:48 sampnot12 Bug heat 10 => 16
2026-10-18 00:52 c_schmitz Changeset attached => LimeSurvey master 420131d8
2026-10-18 00:52 c_schmitz Note Added: 86529
2026-10-18 00:52 c_schmitz Assigned To => c_schmitz
2026-10-18 00:52 c_schmitz Status new => resolved
2026-10-18 00:52 c_schmitz Resolution open => fixed
2026-10-18 00:52 c_schmitz Bug heat 16 => 18
2026-10-20 17:06 LimeBot Note Added: 86580
2026-10-20 17:06 LimeBot Status resolved => closed
2026-10-20 17:06 LimeBot Bug heat 18 => 20