Fixed bug #19002: Unauthorized access to Survey menu entries (#3395)

Co-authored-by: Lapiu Dev <devgit@lapiu.biz>

application/controllers/admin/SurveymenuController.php

@@ -5,6 +5,20 @@
  */
 class SurveymenuController extends SurveyCommonAction
 {
+    /**
+     * SurveymenuController Constructor
+     * @param $controller
+     * @param $id
+     **/
+    public function __construct($controller, $id)
+    {
+        parent::__construct($controller, $id);
+
+        if (!Permission::model()->hasGlobalPermission('settings', 'read')) {
+            throw new CHttpException(403, gT("You do not have permission to access this page."));
+        }
+    }
+
     /**
      * @return string[] action filters
      */
@@ -367,6 +381,7 @@ protected function performAjaxValidation($model)
      **/
     public function index()
     {
+        // Permission check is done in the constructor.
         $this->getController()->redirect(array('admin/menus/sa/view'));
     }
 
@@ -376,6 +391,8 @@ public function index()
      */
     public function view()
     {
+        // Permission check is done in the constructor.
+
         $aData = array();
         $aData['model'] = Surveymenu::model();