Fixed #11004: [security] Unauthorized access to certain admin pages b…

…y restricted admins
LimeSurvey · Apr 22, 2016 · f28ff15 · f28ff15
1 parent 14002a6
commit f28ff15
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 17 deletions.
diff --git a/application/controllers/admin/globalsettings.php b/application/controllers/admin/globalsettings.php
@@ -26,8 +26,10 @@ function __construct($controller, $id)
     {
         parent::__construct($controller, $id);
 
-        if (!Permission::model()->hasGlobalPermission('settings','read')) {
-            die();
+        if (! Permission::model()->hasGlobalPermission('settings', 'read') )
+        {
+            Yii::app()->session['flashmessage'] =gT('Access denied!');
+            $this->getController()->redirect(App()->createUrl("/admin"));
         }
     }
 
@@ -39,11 +41,6 @@ function __construct($controller, $id)
     */
     public function index()
     {
-        if (! Permission::model()->hasGlobalPermission('settings', 'view') )
-        {
-            Yii::app()->session['flashmessage'] =gT('Access denied!');
-            $this->getController()->redirect(App()->createUrl("/admin"));
-        }
         if (!empty($_POST['action'])) {
             $this->_saveSettings();
         }
@@ -52,12 +49,6 @@ public function index()
 
     public function showphpinfo()
     {
-        if (! Permission::model()->hasGlobalPermission('settings', 'view') )
-        {
-            Yii::app()->session['flashmessage'] =gT('Access denied!');
-            $this->getController()->redirect(App()->createUrl("/admin"));
-        }
-
         if (!Yii::app()->getConfig('demoMode')) {
             phpinfo();
         }

diff --git a/application/controllers/admin/homepagesettings.php b/application/controllers/admin/homepagesettings.php
@@ -31,12 +31,12 @@ public function __construct($controller, $id)
      */
     public function view($id)
     {
-        if (! Permission::model()->hasGlobalPermission('settings', 'view') )
+        if (!Permission::model()->hasGlobalPermission('settings', 'read') )
         {
             Yii::app()->session['flashmessage'] =gT('Access denied!');
             $this->getController()->redirect(App()->createUrl("/admin"));
         }
-        $this->_renderWrappedTemplate('homepagesettings', 'view', array(
+        $this->_renderWrappedTemplate('homepagesettings', 'read', array(
             'model'=>$this->loadModel($id),
         ));
     }
@@ -151,7 +151,7 @@ public function delete($id)
      */
     public function index()
     {
-        if (! Permission::model()->hasGlobalPermission('settings', 'view') )
+        if (! Permission::model()->hasGlobalPermission('settings', 'read') )
         {
             Yii::app()->session['flashmessage'] =gT('Access denied!');
             $this->getController()->redirect(App()->createUrl("/admin"));

diff --git a/application/controllers/admin/usergroups.php b/application/controllers/admin/usergroups.php
@@ -262,7 +262,7 @@ function edit($ugid)
     */
     public function index($ugid = false, $header = false)
     {
-        if(!Permission::model()->hasGlobalPermission('usergroups','view'))
+        if(!Permission::model()->hasGlobalPermission('usergroups','read'))
         {
             Yii::app()->session['flashmessage'] =gT('Access denied!');
             $this->getController()->redirect(App()->createUrl("/admin"));