Fixed issue #14732: Superadmin user cannot modify members of a group …

…he is not a member of
LimeSurvey · Mar 5, 2021 · 16d6224 · 16d6224
1 parent 241f6ca
commit 16d6224
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 8 deletions.
diff --git a/application/core/Survey_Common_Action.php b/application/core/Survey_Common_Action.php
@@ -1173,7 +1173,7 @@ public function _userGroupBar(array $aData)
             if (!empty($ugid)) {
                 $userGroup = UserGroup::model()->findByPk($ugid);
                 $uid = Yii::app()->session['loginID'];
-                if ($userGroup && $userGroup->hasUser($uid)) {
+                if (($userGroup && $userGroup->hasUser($uid)) || Permission::model()->hasGlobalPermission('superadmin') ) {
                     $data['userGroup'] = $userGroup;
                 } else {
                     $data['userGroup'] = null;

diff --git a/application/views/admin/usergroup/viewUserGroup_view.php b/application/views/admin/usergroup/viewUserGroup_view.php
@@ -44,24 +44,20 @@
                         </tr></thead>
                     <tbody>
                     <?php
-                    foreach ($userloop as $currentuser)
-                    {
+                    foreach ($userloop as $currentuser) {
                         ?>
                         <tr class='<?php echo $currentuser["rowclass"];?>'>
                             <td align='center'>
                             <?php
-                            if(isset($currentuser["displayactions"]) && $currentuser["displayactions"] == true && $currentuser["userid"] != '1')
-                            { ?>
+                            if ((isset($currentuser["displayactions"]) && $currentuser["displayactions"] == true || Permission::model()->hasGlobalPermission('superadmin')) && $currentuser["userid"] != '1') { ?>
                                 <?php echo CHtml::form(array("admin/usergroups/sa/user/ugid/{$ugid}/action/remove"), 'post'); ?>
                                     <button  data-toggle="tooltip" data-placement="bottom" title="<?php eT('Delete');?>" type="submit" onclick='return confirm("<?php eT("Are you sure you want to delete this entry?","js");?>")' class="btn btn-default btn-xs ">
                                         <span class="fa fa-trash text-warning"></span>
                                     </button>
                                     <input name='uid' type='hidden' value='<?php echo $currentuser["userid"]; ?>' />
                                 </form>
                                 <?php
-                            }
-                            else
-                            {
+                            } else {
                                 ?>
                                 &nbsp;
                             <?php