Fixed issue #10829: Survey admins presented with inappropriate control

buttons Dev: Add redirect after denied access.
LimeSurvey · Apr 15, 2016 · 88f3073 · 88f3073
1 parent 5d07be3
commit 88f3073
Showing 1 changed file with 33 additions and 2 deletions.
diff --git a/application/controllers/admin/questiongroups.php b/application/controllers/admin/questiongroups.php
@@ -38,6 +38,12 @@ function import()
         $action = $_POST['action'];
         $iSurveyID = $surveyid =  $aData['surveyid'] = (int)$_POST['sid'];
 
+        if (!Permission::model()->hasSurveyPermission($surveyid,'surveycontent','import'))
+        {
+            Yii::app()->user->setFlash('error', gT("Access denied"));
+            $this->getController()->redirect(array('admin/survey/sa/listquestiongroups/surveyid/' . $surveyid));
+        }
+
         if ($action == 'importgroup')
         {
             $importgroup = "\n";
@@ -128,7 +134,7 @@ function importView($surveyid)
         }
         else
         {
-            Yii::app()->session['flashmessage'] = gT("We are sorry but you don't have permissions to do this.");
+            Yii::app()->user->setFlash('error', gT("Access denied"));
             $this->getController()->redirect(array('admin/survey/sa/listquestiongroups/surveyid/' . $surveyid));
         }
     }
@@ -144,7 +150,7 @@ function add($surveyid)
         $iSurveyID = $surveyid = sanitize_int($surveyid);
         $aViewUrls = $aData = array();
 
-        if (Permission::model()->hasSurveyPermission($surveyid, 'surveycontent', 'read'))
+        if (Permission::model()->hasSurveyPermission($surveyid, 'surveycontent', 'create'))
         {
             Yii::app()->session['FileManagerContext'] = "create:group:{$surveyid}";
 
@@ -171,6 +177,11 @@ function add($surveyid)
             $aData['surveybar']['saveandclosebutton']['form'] = true;
             $this->_renderWrappedTemplate('survey/QuestionGroups', 'addGroup_view', $aData);
         }
+        else
+        {
+            Yii::app()->user->setFlash('error', gT("Access denied"));
+            $this->getController()->redirect(Yii::app()->request->urlReferrer);
+        }
     }
 
     /**
@@ -290,6 +301,11 @@ public function insert($surveyid)
                 $this->getController()->redirect(array('admin/questiongroups/sa/view/surveyid/' . $surveyid . '/gid/' . $gid));
             }
         }
+        else
+        {
+            Yii::app()->user->setFlash('error', gT("Access denied"));
+            $this->getController()->redirect(Yii::app()->request->urlReferrer);
+        }
     }
 
     /**
@@ -319,6 +335,11 @@ public function delete($iSurveyId, $iGroupId)
             LimeExpressionManager::UpgradeConditionsToRelevance($iSurveyId);
             $this->getController()->redirect(array('admin/survey/sa/listquestiongroups/surveyid/' . $iSurveyId ));
         }
+        else
+        {
+            Yii::app()->user->setFlash('error', gT("Access denied"));
+            $this->getController()->redirect(Yii::app()->request->urlReferrer);
+        }
     }
 
     public function view($surveyid, $gid)
@@ -455,6 +476,11 @@ public function edit($surveyid, $gid)
 
             $this->_renderWrappedTemplate('survey/QuestionGroups', 'editGroup_view', $aData);
         }
+        else
+        {
+            Yii::app()->user->setFlash('error', gT("Access denied"));
+            $this->getController()->redirect(Yii::app()->request->urlReferrer);
+        }
 
     }
 
@@ -524,6 +550,11 @@ public function update($gid)
 
             $this->getController()->redirect(array('admin/questiongroups/sa/edit/surveyid/' . $surveyid . '/gid/' . $gid));
         }
+        else
+        {
+            Yii::app()->user->setFlash('error', gT("Access denied"));
+            $this->getController()->redirect(Yii::app()->request->urlReferrer);
+        }
     }
 
     /**