View Issue Details

Jump to NotesJump to History
This issue affects 1 person(s).
 254
IDProjectCategoryView StatusDate SubmittedLast Update
20447Bug reportsSecuritypublic2026-03-04 17:522026-03-17 08:06
ReporterDenisChenu Assigned Togabrieljenik  
PrioritynoneSeverityminor 
Status in code reviewResolutionopen 
Product Version6.16.x 
Summary20447: Low security : uiser can set any existing theme when save survey
Description

When save survey : any theme can be set

Steps To Reproduce

Steps to reproduce

Create an user
Give him Create survey permission
No permission on theme (can only use inherit, default, and existing)
Log in as this user
Create a survey
Update survey settings; set vanilla (or other one for theme

Expected result

Error alert : no permission on this theme

Actual result

Theme saved

TagsNo tags attached.
Attached Files
Capture vidéo du 2026-03-04 17-51-21.mp4 (2,372,554 bytes)   
Capture vidéo du 2026-03-04 17-51-21.mp4 (2,372,554 bytes)   
Bug heat254
Complete LimeSurvey version number (& build)6.16.11
I will donate to the project if issue is resolvedNo
Browsernot relevant
Database type & versionnot relevant
Server OS (if known)not relevant
Webserver software & version (if known)not relevant
PHP Versionnot relevant

Users monitoring this issue

There are no users monitoring this issue.

Activities

gabrieljenik

gabrieljenik

2026-03-16 20:04

manager   ~84464

https://github.com/LimeSurvey/LimeSurvey/pull/4779
DenisChenu

DenisChenu

2026-03-17 08:06

developer   ~84465

Reset is $sTemplateName = $oSurvey->template;

:)

Issue History

Date Modified Username Field Change
2026-03-04 17:52 DenisChenu New Issue
2026-03-04 17:52 DenisChenu File Added: Capture vidéo du 2026-03-04 17-51-21.mp4
2026-03-05 13:38 tibor.pacalat Assigned To => gabrieljenik
2026-03-05 13:38 tibor.pacalat Status new => assigned
2026-03-16 20:04 gabrieljenik Assigned To gabrieljenik => DenisChenu
2026-03-16 20:04 gabrieljenik Status assigned => ready for code review
2026-03-16 20:04 gabrieljenik Note Added: 84464
2026-03-16 20:04 gabrieljenik Bug heat 250 => 252
2026-03-17 08:06 DenisChenu Assigned To DenisChenu => gabrieljenik
2026-03-17 08:06 DenisChenu Status ready for code review => in code review
2026-03-17 08:06 DenisChenu Note Added: 84465
2026-03-17 08:06 DenisChenu Bug heat 252 => 254