- Posts: 21
- Thank you received: 2
Welcome to the LimeSurvey Community Forum
Ask the community, share ideas, and connect with other LimeSurvey users!
security bug: created admin can give more rights than he owns itself
- bewi
- Topic Author
- Offline
- Junior Member
Less
More
5 years 2 months ago #180613
by bewi
security bug: created admin can give more rights than he owns itself was created by bewi
as superadmin I created an admin "test1", who has some rights:
as "test1" has the right to create further admins he does so and creates admin "test2" with this rights:
this can be done a third time:
"test2" creates "test3" with this rights:
when "test1" creates a survey he grants "test2" some access (no publishing!):
as "test2" wants "test3" to participate he grants rights to "test3":
Oops: "test3" can publish the survey???
although "test2" has no rights to publish", he can grant the right to publish for "test3"???
as "test1" has the right to create further admins he does so and creates admin "test2" with this rights:
this can be done a third time:
"test2" creates "test3" with this rights:
when "test1" creates a survey he grants "test2" some access (no publishing!):
as "test2" wants "test3" to participate he grants rights to "test3":
Oops: "test3" can publish the survey???
although "test2" has no rights to publish", he can grant the right to publish for "test3"???
The topic has been locked.
- DenisChenu
- Offline
- LimeSurvey Community Team
Less
More
- Posts: 13648
- Thank you received: 2491
5 years 2 months ago - 5 years 2 months ago #180619
by DenisChenu
Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand , plugin development .
I don't answer to private message.
Replied by DenisChenu on topic security bug: created admin can give more rights than he owns itself
You think a forum is a good place to report an issue ?
www.limesurvey.org/community/bug-tracker
Else :
LimeSurvey version and build number ? (can not reproduce on 3.15.9 git version)
Did it work when saving ?
www.limesurvey.org/community/bug-tracker
Else :
LimeSurvey version and build number ? (can not reproduce on 3.15.9 git version)
Did it work when saving ?
Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand , plugin development .
I don't answer to private message.
Last edit: 5 years 2 months ago by DenisChenu.
The topic has been locked.
- bewi
- Topic Author
- Offline
- Junior Member
Less
More
- Posts: 21
- Thank you received: 2
5 years 2 months ago #180708
by bewi
Replied by bewi on topic security bug: created admin can give more rights than he owns itself
in my excitement about the bug, I didn't find the bugtracker. Just a lot of hints to contact the forum instead of the support.
meanwhile I added an report over there, so this thread can be deleted.
meanwhile I added an report over there, so this thread can be deleted.
The topic has been locked.
- Mazi
- Offline
- Official LimeSurvey Partner
5 years 2 months ago - 5 years 2 months ago #180713
by Mazi
Best regards/Beste Grüße,
Dr. Marcel Minke
Need Help? We offer professional Limesurvey support: survey-consulting.com
Contact: marcel.minke(at)survey-consulting.com
Replied by Mazi on topic security bug: created admin can give more rights than he owns itself
Thanks for reporting the issue.
For reference, this is the link to the bug report: bugs.limesurvey.org/view.php?id=14551
For reference, this is the link to the bug report: bugs.limesurvey.org/view.php?id=14551
Best regards/Beste Grüße,
Dr. Marcel Minke
Need Help? We offer professional Limesurvey support: survey-consulting.com
Contact: marcel.minke(at)survey-consulting.com
Last edit: 5 years 2 months ago by Mazi.
The following user(s) said Thank You: DenisChenu
The topic has been locked.
- DenisChenu
- Offline
- LimeSurvey Community Team
Less
More
- Posts: 13648
- Thank you received: 2491
5 years 2 months ago #180730
by DenisChenu
Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand , plugin development .
I don't answer to private message.
Replied by DenisChenu on topic security bug: created admin can give more rights than he owns itself
Yes and sorry about missunderstanding : can reproduce now (even with surveys update permission to false).
Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand , plugin development .
I don't answer to private message.
The topic has been locked.