From 2dc64f3b8e1e6961becb006f4c0cdd53a3943ea0 Mon Sep 17 00:00:00 2001
From: Dominik Vitt <dominik.vitt.hr@gmail.com>
Date: Thu, 20 Dec 2018 15:42:09 +0100
Subject: [PATCH] Fixed issue #14312: Importing participants from CSV is not
 possible for user with survey/create global permission

---
 application/controllers/admin/tokens.php    | 4 ++--
 application/views/admin/token/token_bar.php | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/application/controllers/admin/tokens.php b/application/controllers/admin/tokens.php
index 1f35131cec6..c2fdb5a2d4a 100644
--- a/application/controllers/admin/tokens.php
+++ b/application/controllers/admin/tokens.php
@@ -1675,7 +1675,7 @@ public function importldap($iSurveyId)
         $iSurveyId = (int) $iSurveyId;
         $survey = Survey::model()->findByPk($iSurveyId);
         $aData = array();
-        if (!Permission::model()->hasSurveyPermission($iSurveyId, 'tokens', 'import')) {
+        if (!(Permission::model()->hasSurveyPermission($iSurveyId, 'tokens', 'import') || Permission::model()->hasGlobalPermission('surveys', 'update'))) {
             Yii::app()->session['flashmessage'] = gT("You do not have permission to access this page.");
             $this->getController()->redirect(array("/admin/survey/sa/view/surveyid/{$iSurveyId}"));
         }
@@ -1918,7 +1918,7 @@ public function import($iSurveyId)
         $aData = array();
         $iSurveyId = (int) $iSurveyId;
         $survey = Survey::model()->findByPk($iSurveyId);
-        if (!Permission::model()->hasSurveyPermission($iSurveyId, 'tokens', 'import')) {
+        if (!(Permission::model()->hasSurveyPermission($iSurveyId, 'tokens', 'import') || Permission::model()->hasGlobalPermission('surveys', 'update'))) {
             Yii::app()->session['flashmessage'] = gT("You do not have permission to access this page.");
             $this->getController()->redirect(array("/admin/survey/sa/view/surveyid/{$iSurveyId}"));
         }
diff --git a/application/views/admin/token/token_bar.php b/application/views/admin/token/token_bar.php
index 556c8796524..206bc65b5c0 100644
--- a/application/views/admin/token/token_bar.php
+++ b/application/views/admin/token/token_bar.php
@@ -14,7 +14,7 @@
             <?php if( isset($token_bar['buttons']['view']) ): ?>
 
                 <!-- Display tokens -->
-                <?php if (Permission::model()->hasSurveyPermission($oSurvey->sid, 'tokens', 'read')): ?>
+                <?php if (Permission::model()->hasSurveyPermission($oSurvey->sid, 'tokens', 'read') || Permission::model()->hasGlobalPermission('surveys', 'update')): ?>
                     <a class="btn btn-default pjax" href='<?php echo $this->createUrl("admin/tokens/sa/browse/surveyid/$oSurvey->sid"); ?>' role="button">
                         <span class="fa fa-list-alt text-success"></span>
                         <?php eT("Display participants"); ?>
@@ -30,7 +30,7 @@
 
                 <!-- Add new token entry -->
                 <ul class="dropdown-menu">
-                <?php if (Permission::model()->hasSurveyPermission($oSurvey->sid, 'tokens', 'create')): ?>
+                <?php if (Permission::model()->hasSurveyPermission($oSurvey->sid, 'tokens', 'create') || Permission::model()->hasGlobalPermission('surveys', 'update')): ?>
                 <li>
                     <a class="pjax" href="<?php echo $this->createUrl("admin/tokens/sa/addnew/surveyid/$oSurvey->sid"); ?>" >
                         <span class="icon-add"></span>
@@ -48,7 +48,7 @@
                 <?php endif; ?>
 
                 <!-- Import tokens -->
-                <?php if (Permission::model()->hasSurveyPermission($oSurvey->sid, 'tokens', 'import')): ?>
+                <?php if (Permission::model()->hasSurveyPermission($oSurvey->sid, 'tokens', 'import') || Permission::model()->hasGlobalPermission('surveys', 'update')): ?>
                     <li role="separator" class="divider"></li>
                     <li>
                         <small><?php eT("Import participants from:"); ?></small>