Fixed issue #7193: A shared user can definitively delete a shared par…

…ticipant
LimeSurvey · Mar 11, 2013 · 141b2b0 · 141b2b0
1 parent b0f3a2a
commit 141b2b0
Showing 1 changed file with 5 additions and 6 deletions.
diff --git a/application/models/Participants.php b/application/models/Participants.php
@@ -365,7 +365,6 @@ function deleteParticipants($rows, $bFilter=true)
     {
         // Converting the comma separated IDs to an array and assign chunks of 100 entries to have a reasonable query size
         $aParticipantsIDChunks = array_chunk(explode(",", $rows),100); 
-
         foreach ($aParticipantsIDChunks as $aParticipantsIDs)
         {
 
@@ -389,15 +388,15 @@ function deleteParticipants($rows, $bFilter=true)
     * 
     * @param mixed $aParticipantsIDs
     */
-    function filterParticipantIDs($aParticipantsIDs)
+    function filterParticipantIDs($aParticipantIDs)
     {
-            if (!Yii::app()->session['USER_RIGHT_SUPERADMIN'] && $bFilter) // If not super admin filter the participant IDs first to owner only
+            if (!Yii::app()->session['USER_RIGHT_SUPERADMIN']) // If not super admin filter the participant IDs first to owner only
             {
-                $aCondition=array('and','owner_id=:owner_uid',array('in', 'participant_id', $aParticipantsIDs));
+                $aCondition=array('and','owner_uid=:owner_uid',array('in', 'participant_id', $aParticipantIDs));
                 $aParameter=array(':owner_uid'=>Yii::app()->session['loginID']);
-                $aParticipantIDs=Yii::app()->db->createCommand()->select('participant_id')->from(Survey_links::model()->tableName())->where($aCondition, $aParameter)->queryColumn();
+                $aParticipantIDs=Yii::app()->db->createCommand()->select('participant_id')->from(Participants::model()->tableName())->where($aCondition, $aParameter)->queryColumn();
             }           
-            return $aParticipantsIDs;
+            return $aParticipantIDs;
     }
 
     /**