View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
14732 | Bug reports | User / Groups / Roles | public | 2019-04-03 16:52 | 2021-03-08 19:35 |
Reporter | carrasin | Assigned To | c_schmitz | ||
Priority | low | Severity | block | ||
Status | closed | Resolution | fixed | ||
Product Version | 3.16.x | ||||
Fixed in Version | 3.25.17 | ||||
Summary | 14732: Superadmin user cannot modify members of a group he don't belong | ||||
Description | Superadmin users incluiding 'admin' can see all groups but cannot modify the groups properties or members. As I undestand the security variable 'usercontrolSameGroupPolicy ' only applies for non-admin users. Below the buttons "Edit current user group" and "Delete current user group" it shows : PHP Notice: Trying to get property of non-object in /srv/limesurvey/limesurvey-3.15-20190228-094129/application/views/admin/usergroup/usergroupbar_view.php on line 19, referer: https://servicios.unl.edu.ar/test/encuestas/index.php/admin/usergroups/sa/index | ||||
Steps To Reproduce |
| ||||
Additional Information | We modified two files from the code that fix the problem | ||||
Tags | No tags attached. | ||||
Attached Files | superadmin_groups.diff (2,308 bytes)
Sólo en /srv/limesurvey/limesurvey-3.15-20190228-094129/application/config: config.php diff -ru application/core/Survey_Common_Action.php /srv/limesurvey/limesurvey-3.15-20190228-094129/application/core/Survey_Common_Action.php --- application/core/Survey_Common_Action.php 2019-02-14 08:54:53.000000000 -0300 +++ /srv/limesurvey/limesurvey-3.15-20190228-094129/application/core/Survey_Common_Action.php 2019-03-28 11:27:28.554748919 -0300 @@ -1157,7 +1157,7 @@ if (!empty($ugid)) { $userGroup = UserGroup::model()->findByPk($ugid); $uid = Yii::app()->session['loginID']; - if ($userGroup && $userGroup->hasUser($uid)) { + if (($userGroup && $userGroup->hasUser($uid)) || Permission::model()->hasGlobalPermission('superadmin') ) { $data['userGroup'] = $userGroup; } else { $data['userGroup'] = null; diff -ru application/views/admin/usergroup/viewUserGroup_view.php /srv/limesurvey/limesurvey-3.15-20190228-094129/application/views/admin/usergroup/viewUserGroup_view.php --- application/views/admin/usergroup/viewUserGroup_view.php 2019-02-14 08:54:53.000000000 -0300 +++ /srv/limesurvey/limesurvey-3.15-20190228-094129/application/views/admin/usergroup/viewUserGroup_view.php 2019-03-28 11:17:58.733479788 -0300 @@ -50,7 +50,7 @@ <tr class='<?php echo $currentuser["rowclass"];?>'> <td align='center'> <?php - if(isset($currentuser["displayactions"]) && $currentuser["displayactions"] == true && $currentuser["userid"] != '1') + if ( (isset($currentuser["displayactions"]) && $currentuser["displayactions"] == true || Permission::model()->hasGlobalPermission('superadmin')) && $currentuser["userid"] != '1') { ?> <?php echo CHtml::form(array("admin/usergroups/sa/user/ugid/{$ugid}/action/remove"), 'post'); ?> <button data-toggle="tooltip" data-placement="bottom" title="<?php eT('Delete');?>" type="submit" onclick='return confirm("<?php eT("Are you sure you want to delete this entry?","js");?>")' class="btn btn-default btn-xs "> | ||||
Bug heat | 4 | ||||
Complete LimeSurvey version number (& build) | LimeSurvey-3.15.9-190214 | ||||
I will donate to the project if issue is resolved | No | ||||
Browser | |||||
Database type & version | Postgresql 9.6 | ||||
Server OS (if known) | Debian GNU/Linux 9.8 (stretch) | ||||
Webserver software & version (if known) | |||||
PHP Version | 7.0 | ||||
Fix committed to 3.x-LTS branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=31278 |
|
Thank you for the patch! |
|
Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=31279 |
|
You're welcome, thanks for the tool! |
|
LimeSurvey: 3.x-LTS 16d62242 2021-03-05 18:27 Details Diff |
Fixed issue 14732: Superadmin user cannot modify members of a group he is not a member of |
Affected Issues 14732 |
|
mod - application/core/Survey_Common_Action.php | Diff File | ||
mod - application/views/admin/usergroup/viewUserGroup_view.php | Diff File | ||
LimeSurvey: master 506c5d02 2021-03-05 18:27 Details Diff |
Fixed issue 14732: Superadmin user cannot modify members of a group he is not a member of |
Affected Issues 14732 |
|
mod - application/core/Survey_Common_Action.php | Diff File | ||
mod - application/views/userGroup/viewUserGroup_view.php | Diff File |
Date Modified | Username | Field | Change |
---|---|---|---|
2019-04-03 16:52 | carrasin | New Issue | |
2019-04-03 16:52 | carrasin | File Added: superadmin_groups.diff | |
2019-11-01 17:26 | c_schmitz | Category | User/User groups => User / Groups / Roles |
2019-11-26 18:02 | cdorin | Assigned To | => cdorin |
2019-11-26 18:02 | cdorin | Status | new => assigned |
2021-02-08 17:07 | cdorin | Assigned To | cdorin => |
2021-02-08 17:07 | cdorin | Priority | none => low |
2021-02-08 17:07 | cdorin | Status | assigned => confirmed |
2021-02-08 17:07 | cdorin | Description Updated | |
2021-02-08 17:07 | cdorin | Steps to Reproduce Updated | |
2021-02-08 17:07 | cdorin | Additional Information Updated | |
2021-02-08 17:07 | cdorin | Sync to Zoho Project | => |Yes| |
2021-03-05 17:27 | c_schmitz | Assigned To | => c_schmitz |
2021-03-05 17:27 | c_schmitz | Status | confirmed => assigned |
2021-03-05 17:27 | c_schmitz | Changeset attached | => LimeSurvey 3.x-LTS 16d62242 |
2021-03-05 17:27 | c_schmitz | Note Added: 62799 | |
2021-03-05 17:27 | c_schmitz | Resolution | open => fixed |
2021-03-05 17:27 | c_schmitz | Status | assigned => resolved |
2021-03-05 17:28 | c_schmitz | Note Added: 62800 | |
2021-03-05 17:34 | c_schmitz | Changeset attached | => LimeSurvey master 506c5d02 |
2021-03-05 17:34 | c_schmitz | Note Added: 62803 | |
2021-03-05 18:52 | carrasin | Note Added: 62805 | |
2021-03-08 19:35 | c_schmitz | Fixed in Version | => 3.25.17 |
2021-03-08 19:35 | c_schmitz | Status | resolved => closed |