From 0a3a6c0f88790863f87fabb7074eac7842b477d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcos=20Garci=CC=81a=20de=20La=20Fuente?=
 <marcosgdf@gmail.com>
Date: Sun, 5 Jan 2014 19:13:12 +0100
Subject: [PATCH] Restricted survey creation to
 $user->rights->opensurvey->write

---
 htdocs/opensurvey/wizard/choix_autre.php   | 3 +++
 htdocs/opensurvey/wizard/choix_date.php    | 3 +++
 htdocs/opensurvey/wizard/create_survey.php | 4 +++-
 htdocs/opensurvey/wizard/index.php         | 4 +++-
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/htdocs/opensurvey/wizard/choix_autre.php b/htdocs/opensurvey/wizard/choix_autre.php
index fb869d65c69db..302cbfccf6af8 100644
--- a/htdocs/opensurvey/wizard/choix_autre.php
+++ b/htdocs/opensurvey/wizard/choix_autre.php
@@ -27,6 +27,9 @@
 require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/opensurvey/fonctions.php");
 
+// Security check
+if (!$user->rights->opensurvey->write) accessforbidden ();
+
 /*
  * Action
  */
diff --git a/htdocs/opensurvey/wizard/choix_date.php b/htdocs/opensurvey/wizard/choix_date.php
index 606b1ecf8736f..25f6ddc245361 100644
--- a/htdocs/opensurvey/wizard/choix_date.php
+++ b/htdocs/opensurvey/wizard/choix_date.php
@@ -27,6 +27,9 @@
 require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/opensurvey/fonctions.php");
 
+// Security check
+if (!$user->rights->opensurvey->write) accessforbidden ();
+
 //le format du sondage est DATE
 $_SESSION["formatsondage"] = "D";
 
diff --git a/htdocs/opensurvey/wizard/create_survey.php b/htdocs/opensurvey/wizard/create_survey.php
index cad66b34d4a99..a8169d9d5da77 100644
--- a/htdocs/opensurvey/wizard/create_survey.php
+++ b/htdocs/opensurvey/wizard/create_survey.php
@@ -27,8 +27,10 @@
 require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/opensurvey/fonctions.php");
 
-$langs->load("opensurvey");
+// Security check
+if (!$user->rights->opensurvey->write) accessforbidden ();
 
+$langs->load("opensurvey");
 
 // On teste toutes les variables pour supprimer l'ensemble des warnings PHP
 // On transforme en entites html les données afin éviter les failles XSS
diff --git a/htdocs/opensurvey/wizard/index.php b/htdocs/opensurvey/wizard/index.php
index 6bb6403ff7274..fab1a86320dcb 100644
--- a/htdocs/opensurvey/wizard/index.php
+++ b/htdocs/opensurvey/wizard/index.php
@@ -28,8 +28,10 @@
 require_once(DOL_DOCUMENT_ROOT."/core/lib/files.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/opensurvey/fonctions.php");
 
-$langs->load("opensurvey");
+// Security check
+if (!$user->rights->opensurvey->write) accessforbidden ();
 
+$langs->load("opensurvey");
 
 /*
  * View