Fixed issue #18544: Update Theme Options: Survey Group permissions ar…

…e not checked correctly (#2795) Co-authored-by: lapiudevgit <devgit@lapiu.biz>
LimeSurvey · Jan 12, 2023 · 3821109 · 3821109
1 parent f88ecbd
commit 3821109
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/application/controllers/ThemeOptionsController.php b/application/controllers/ThemeOptionsController.php
@@ -367,8 +367,8 @@ public function actionUpdateSurveyGroup(int $id = null, int $gsid, $l = null)
             if (empty($gsid)) {
                 throw new CHttpException(403, gT("You do not have permission to access this page."));
             }
-            $oSurveysInGroup = SurveysInGroup::model()->findByPk($gsid);
-            if (empty($oSurveysInGroup) && !$oSurveysInGroup->hasPermission('surveys', 'update')) {
+            $oSurveysGroups = SurveysGroups::model()->findByPk($gsid);
+            if (empty($oSurveysGroups) || !$oSurveysGroups->hasPermission('surveysettings', 'update')) {
                 throw new CHttpException(403, gT("You do not have permission to access this page."));
             }
         }
@@ -623,8 +623,8 @@ public function actionReset(int $gsid)
             if (empty($gsid)) {
                 throw new CHttpException(403, gT("You do not have permission to access this page."));
             }
-            $oSurveysInGroup = SurveysInGroup::model()->findByPk($gsid);
-            if (empty($oSurveysInGroup) && !$oSurveysInGroup->hasPermission('surveys', 'update')) {
+            $oSurveysGroups = SurveysGroups::model()->findByPk($gsid);
+            if (empty($oSurveysGroups) || !$oSurveysGroups->hasPermission('surveysettings', 'update')) {
                 throw new CHttpException(403, gT("You do not have permission to access this page."));
             }
         }