Fixed issue #17480: Unable to reload with token + persistence + allow…

… edit (#1986) Dev: Same fix than 3.X + findByPk
LimeSurvey · Jul 30, 2021 · 7e3d62d · 7e3d62d
1 parent 8e882da
commit 7e3d62d
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 7 deletions.
diff --git a/application/helpers/frontend_helper.php b/application/helpers/frontend_helper.php
@@ -40,21 +40,22 @@ function loadanswers()
         }
         $oCriteria->addCondition("saved_control.identifier=:identifier");
         $aParams[':identifier'] = $sLoadName;
+        $oCriteria->params = $aParams;
+        /* relations saved_control is needed: force */
+        $oResponses = SurveyDynamic::model($surveyid)->with('saved_control')->find($oCriteria);
     } elseif (isset($_SESSION['survey_' . $surveyid]['srid'])) {
-        $oCriteria = new CDbCriteria();
-        $oCriteria->condition = "id=:id";
-        $aParams = [':id' => $_SESSION['survey_' . $surveyid]['srid']];
+        /* relations saved_control is not needed : only lazy load */
+        $oResponses = SurveyDynamic::model($surveyid)->findByPk($_SESSION['survey_' . $surveyid]['srid']);
     } else {
         return false;
     }
-    $oCriteria->params = $aParams;
-    $oResponses = SurveyDynamic::model($surveyid)->with('saved_control')->find($oCriteria);
+
     if (!$oResponses) {
         return false;
     }
-    $oResponses->decrypt();
 
-    if (isset($oResponses->saved_control) && $oResponses->saved_control) {
+    /* If we came from reload : check access_code */
+    if (!empty($sLoadName) && !empty($oResponses->saved_control)) {
         $saved_control = $oResponses->saved_control;
         $access_code = $oResponses->saved_control->access_code;
         $md5_code = md5($sLoadPass);
@@ -77,6 +78,9 @@ function loadanswers()
             return false;
         }
     }
+
+    /* Decrypt loaded responses */
+    $oResponses->decrypt();
     // Get if survey is been answered
     $submitdate = $oResponses->submitdate;
     $aRow = $oResponses->attributes;

diff --git a/application/models/Response.php b/application/models/Response.php
@@ -37,6 +37,15 @@ public static function create($surveyId, $scenario = 'insert')
         return parent::create($surveyId, $scenario);
     }
 
+    /** @inheritdoc
+     * Must be set by DB, adding by security here
+     * @see https://bugs.limesurvey.org/view.php?id=17208
+     **/
+    public function primaryKey()
+    {
+        return 'id';
+    }
+
     /**
      * Get all files related to this response and (optionally) question ID.
      *