Fixed issue #18978: User is able to change survey group's code that i…

…s by default unchangeable (#3401) Co-authored-by: lapiudevgit <devgit@lapiu.biz>
LimeSurvey · Sep 14, 2023 · e86d93c · e86d93c
1 parent f2b3a59
commit e86d93c
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/application/controllers/admin/SurveysGroupsController.php b/application/controllers/admin/SurveysGroupsController.php
@@ -118,6 +118,8 @@ public function update(int $id)
                 throw new CHttpException(403, gT("You do not have permission to access this page."));
             }
             $postSurveysGroups = App()->getRequest()->getPost('SurveysGroups');
+            // Remove name from post data, as it shouldn't be updated
+            unset($postSurveysGroups['name']);
             /* Mimic survey system : only owner and superadmin can update owner … */
             /* After update : potential loose of rights on SurveysGroups */
             if (

diff --git a/application/models/SurveysGroups.php b/application/models/SurveysGroups.php
@@ -69,6 +69,7 @@ public function rules()
             // The following rule is used by search().
             // @todo Please remove those attributes that should not be searched.
             array('gsid, name, title, description, owner_id, parent_id, created, modified, created_by', 'safe', 'on' => 'search'),
+            array('name', 'unsafe' , 'on' => ['update']),
         );
     }