From c61885c86ae9923efc61078f29c59d33e39e8385 Mon Sep 17 00:00:00 2001
From: Olle Haerstedt <olle.haerstedt@limesurvey.org>
Date: Fri, 15 Apr 2016 14:19:25 +0200
Subject: [PATCH] Fixed issue #10829: Survey admins presented with
 inappropriate control buttons

Dev: Hide template carousel and survey format (group-by-group etc)
Dev: if user lacks survey update permissions.
---
 .../QuestionGroups/questiongroupbar_view.php  | 14 +++--
 .../views/admin/survey/surveySummary_view.php | 56 ++++++++++---------
 2 files changed, 38 insertions(+), 32 deletions(-)

diff --git a/application/views/admin/survey/QuestionGroups/questiongroupbar_view.php b/application/views/admin/survey/QuestionGroups/questiongroupbar_view.php
index 7c0a932bb39..2f5e2cef182 100644
--- a/application/views/admin/survey/QuestionGroups/questiongroupbar_view.php
+++ b/application/views/admin/survey/QuestionGroups/questiongroupbar_view.php
@@ -15,12 +15,14 @@
             <?php if(isset($questiongroupbar['buttons']['view'])):?>
                 <!-- Buttons -->
 
-                <span class="btntooltip" data-toggle="tooltip" data-placement="bottom" title="<?php if ($surveyIsActive) { echo eT("You can't add questions while the survey is active."); } ?>" >
-                   <a class="btn btn-default <?php if ($surveyIsActive) { echo "disabled"; } ?>" href="<?php echo $this->createUrl('admin/questions/sa/newquestion/surveyid/'.$surveyid.'/gid/'.$gid); ?>" role="button">
-                       <span class="icon-add"></span>
-                       <?php eT("Add new question to group");?>
-                   </a>
-               </span>
+                <?php if(Permission::model()->hasSurveyPermission($surveyid,'surveycontent','create')): ?>
+                    <span class="btntooltip" data-toggle="tooltip" data-placement="bottom" title="<?php if ($surveyIsActive) { echo eT("You can't add questions while the survey is active."); } ?>" >
+                       <a class="btn btn-default <?php if ($surveyIsActive) { echo "disabled"; } ?>" href="<?php echo $this->createUrl('admin/questions/sa/newquestion/surveyid/'.$surveyid.'/gid/'.$gid); ?>" role="button">
+                           <span class="icon-add"></span>
+                           <?php eT("Add new question to group");?>
+                       </a>
+                   </span>
+               <?php endif; ?>
 
                 <?php if(Permission::model()->hasSurveyPermission($surveyid,'surveycontent','update')): ?>
                     <?php if (count($languagelist) > 1): ?>
diff --git a/application/views/admin/survey/surveySummary_view.php b/application/views/admin/survey/surveySummary_view.php
index 9f180d0d357..c841fcf0b18 100644
--- a/application/views/admin/survey/surveySummary_view.php
+++ b/application/views/admin/survey/surveySummary_view.php
@@ -65,28 +65,30 @@
 
                         <!-- Switch : Show questions group by group -->
                         <?php $switchvalue = ($surveyinfo['format']=='G') ? 1 : 0 ; ?>
-                        <div class="row">
-                            <div class="col-sm-12">
-
-                                <label for="format"><?php eT('Format:');?></label>
-                                <div id='switchchangeformat' class="btn-group" role="group">
-                                  <button type="button" data-value='S' class="btn btn-default <?php if($surveyinfo['format']=='S'){echo 'active';}?>"><?php eT('Question by question');?></button>
-                                  <button type="button" data-value='G' class="btn btn-default <?php if($surveyinfo['format']=='G'){echo 'active';}?>"><?php eT('Group by group');?></button>
-                                  <button type="button" data-value='A' class="btn btn-default <?php if($surveyinfo['format']=='A'){echo 'active';}?>"><?php eT('All in one');?></button>
+                        <?php if (Permission::model()->hasSurveyPermission($surveyid,'surveycontent','update')): ?>
+                            <div class="row">
+                                <div class="col-sm-12">
+
+                                    <label for="format"><?php eT('Format:');?></label>
+                                    <div id='switchchangeformat' class="btn-group" role="group">
+                                      <button type="button" data-value='S' class="btn btn-default <?php if($surveyinfo['format']=='S'){echo 'active';}?>"><?php eT('Question by question');?></button>
+                                      <button type="button" data-value='G' class="btn btn-default <?php if($surveyinfo['format']=='G'){echo 'active';}?>"><?php eT('Group by group');?></button>
+                                      <button type="button" data-value='A' class="btn btn-default <?php if($surveyinfo['format']=='A'){echo 'active';}?>"><?php eT('All in one');?></button>
+                                    </div>
+                                    <input type="hidden" id="switch-url" data-url="<?php echo $this->createUrl("admin/survey/sa/changeFormat/surveyid/".$surveyinfo['sid']);?>" />
+                                    <br/><br/>
+                                    <?php /*
+                                    <?php $this->widget('yiiwheels.widgets.switch.WhSwitch', array(
+                                        'name' => 'groupbygroup',
+                                        'id'=>'switchchangeformat',
+                                        'value'=>$switchvalue,
+                                    ));?>
+
+                                    <br/><br/>
+                                    */?>
                                 </div>
-                                <input type="hidden" id="switch-url" data-url="<?php echo $this->createUrl("admin/survey/sa/changeFormat/surveyid/".$surveyinfo['sid']);?>" />
-                                <br/><br/>
-                                <?php /*
-                                <?php $this->widget('yiiwheels.widgets.switch.WhSwitch', array(
-                                    'name' => 'groupbygroup',
-                                    'id'=>'switchchangeformat',
-                                    'value'=>$switchvalue,
-                                ));?>
-
-                                <br/><br/>
-                                */?>
                             </div>
-                        </div>
+                        <?php endif; ?>
 
 
                         <!-- Add Question / group -->
@@ -260,12 +262,14 @@
                     </div>
 
                     <div class="col-sm-6">
-                        <!-- Template carroussel -->
-                        <?php $this->renderPartial( "/admin/survey/subview/_template_carousel", array(
-                            'templates'=>$templates,
-                            'surveyinfo'=>$surveyinfo,
-                            'iSurveyId'=>$surveyid,
-                        )); ?>
+                        <?php if (Permission::model()->hasSurveyPermission($surveyid,'surveycontent','update')): ?>
+                            <!-- Template carroussel -->
+                            <?php $this->renderPartial( "/admin/survey/subview/_template_carousel", array(
+                                'templates'=>$templates,
+                                'surveyinfo'=>$surveyinfo,
+                                'iSurveyId'=>$surveyid,
+                            )); ?>
+                        <?php endif; ?>
                     </div>
 
                     <!-- last visited question -->