Fixed issue #15221: unable to send mail to participants - apache hand…

…ler error 403

Dev: security must check only user request
Dev: fix invalid sid param in quota

application/core/Survey_Common_Action.php

@@ -121,15 +121,16 @@ private function _addPseudoParams($params)
             'browselang' => 'sBrowseLang',
             'tokenids' => 'aTokenIds',
             'tokenid' => 'iTokenId',
-            'subaction' => 'sSubAction',
+            'subaction' => 'sSubAction', // /!\ Already filled by sa : can be different (usage of subaction in quota at 2019-09-04)
         );
-
         // Foreach pseudo, take the key, if it exists,
         // Populate the values (taken as an array) as keys in params
         // with that key's value in the params
         // Chek is 2 params are equal for security issue.
         foreach ($pseudos as $key => $pseudo) {
-            if (isset($params[$key])) {
+            // We care only for user parameters, not by code parameters (see issue #15221)
+            if (Yii::app()->getRequest()->getParam($key)) {
+                $params[$key] = Yii::app()->getRequest()->getParam($key);
                 $pseudo = (array) $pseudo;
                 foreach ($pseudo as $pseud) {
                     if (empty($params[$pseud])) {

application/views/admin/quotas/newanswer_view.php

@@ -4,7 +4,7 @@
 ?>
 
 <div class='side-body <?php echo getSideBodyClass(false); ?>'>
-    <div class="row">                             
+    <div class="row">
         <div class="col-lg-8 content-right">
             <h3>
                 <?php eT("Survey quota");?>: <?php eT("Add answer");?>
@@ -34,7 +34,7 @@
                                 <input name="submit" type="submit" class="submit btn btn-default" value="<?php eT("Next");?>" />
                             </div>
                         </div>
-                        <input type="hidden" name="sid" value="'.$iSurveyId.'" />
+                        <input type="hidden" name="sid" value="<?php echo $iSurveyId;?>" />
                         <input type="hidden" name="action" value="quotas" />
                         <input type="hidden" name="subaction" value="new_answer_two" />
                         <input type="hidden" name="quota_id" value="<?php echo sanitize_int($oQuota->id);?>" />