Fixed issue: Database exception is shown when trying to download file…

…s on a inactive survey
LimeSurvey · Oct 9, 2020 · bd3490c · bd3490c
1 parent 44f35ed
commit bd3490c
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/application/controllers/admin/responses.php b/application/controllers/admin/responses.php
@@ -763,6 +763,12 @@ public function actionDownloadfile($iSurveyId, $iResponseId, $iQID, $iIndex)
         $iResponseId = (int) $iResponseId;
         $iQID = (int) $iQID;
 
+        $oSurvey = Survey::model()->findByPk($iSurveyID);
+        if (!$oSurvey->isActive) {
+            Yii::app()->setFlashMessage(gT("Sorry, this file was not found."), 'error');
+            $this->getController()->redirect(array("admin/survey", "sa"=>"view", "surveyid"=>$iSurveyId));
+        }
+
         if (Permission::model()->hasSurveyPermission($iSurveyId, 'responses', 'read')) {
             $oResponse = Response::model($iSurveyId)->findByPk($iResponseId);
             $aQuestionFiles = $oResponse->getFiles($iQID);
@@ -788,6 +794,8 @@ public function actionDownloadfile($iSurveyId, $iResponseId, $iQID, $iIndex)
             }
             App()->setFlashMessage(gT("Sorry, this file was not found."), 'error');
             $this->getController()->redirect(array("admin/responses", "sa"=>"browse", "surveyid"=>$iSurveyId));
+        } else {
+            throw new CHttpException(403, gT("You do not have permission to access this page."));
         }
     }
 
@@ -804,6 +812,11 @@ public function actionDownloadfiles($iSurveyId, $sResponseId)
     {
 
         if (Permission::model()->hasSurveyPermission($iSurveyId, 'responses', 'read')) {
+            $oSurvey = Survey::model()->findByPk($iSurveyID);
+            if (!$oSurvey->isActive) {
+                Yii::app()->setFlashMessage(gT("Sorry, this file was not found."), 'error');
+                $this->getController()->redirect(array("admin/survey", "sa"=>"view", "surveyid"=>$iSurveyId));
+            }            
             if (!$sResponseId) {
                 // No response id : get all survey files
                 $oCriteria = new CDbCriteria();
@@ -828,6 +841,8 @@ public function actionDownloadfiles($iSurveyId, $sResponseId)
                 App()->setFlashMessage(gT("The requested files do not exist on the server."), 'error');
                 $this->getController()->redirect(array("admin/responses", "sa"=>"browse", "surveyid"=>$iSurveyId));
             }
+        } else {
+            throw new CHttpException(403, gT("You do not have permission to access this page."));
         }
     }