Fixed bug #18799: Admin user with full CPDB permissions can no access…

… attribute section. (#3361) Co-authored-by: Lapiu Dev <devgit@lapiu.biz>
LimeSurvey · Sep 15, 2023 · 5bc3d5f · 5bc3d5f
1 parent 5c4fb4e
commit 5bc3d5f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/application/controllers/admin/ParticipantsAction.php b/application/controllers/admin/ParticipantsAction.php
@@ -1361,6 +1361,8 @@ public function changeblackliststatus()
      */
     public function attributeControl()
     {
+        $this->checkPermission('read');
+
         $title = gT("Attribute management");
         $model = new ParticipantAttributeName();
         if (Yii::app()->request->getParam('ParticipantAttributeName')) {

diff --git a/application/views/admin/participants/partial/topbarBtns/leftSideButtons.php b/application/views/admin/participants/partial/topbarBtns/leftSideButtons.php
@@ -73,7 +73,9 @@
             ],
         ]
     );
+}
 
+if (Permission::model()->hasGlobalPermission('participantpanel', 'read')) {
     $this->widget(
         'ext.ButtonWidget.ButtonWidget',
         [