security bug: created admin can give more rights than he owns itself

Mehr
4 Monate 4 Wochen her #180613 von bewi
as superadmin I created an admin "test1", who has some rights:
Dateianhang:


as "test1" has the right to create further admins he does so and creates admin "test2" with this rights:
Dateianhang:


this can be done a third time:
"test2" creates "test3" with this rights:
Dateianhang:


when "test1" creates a survey he grants "test2" some access (no publishing!):
Dateianhang:


as "test2" wants "test3" to participate he grants rights to "test3":
Dateianhang:


Oops: "test3" can publish the survey???
although "test2" has no rights to publish", he can grant the right to publish for "test3"???

Bitte Anmelden oder Registrieren um der Konversation beizutreten.

LimeSurvey Partners
Mehr
4 Monate 4 Wochen her - 4 Monate 4 Wochen her #180619 von DenisChenu
You think a forum is a good place to report an issue ?
www.limesurvey.org/community/bug-tracker

Else :
LimeSurvey version and build number ? (can not reproduce on 3.15.9 git version)
Did it work when saving ?

Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand .
An error happen ? Before make a new topic : remind the Debug mode .
Letzte Änderung: 4 Monate 4 Wochen her von DenisChenu.
Folgende Benutzer bedankten sich: LouisGac

Bitte Anmelden oder Registrieren um der Konversation beizutreten.

Mehr
4 Monate 4 Wochen her #180708 von bewi
in my excitement about the bug, I didn't find the Bugtracker. Just a lot of hints to contact the forum instead of the support.
meanwhile I added an report over there, so this thread can be deleted.

Bitte Anmelden oder Registrieren um der Konversation beizutreten.

Mehr
4 Monate 4 Wochen her - 4 Monate 4 Wochen her #180713 von Mazi
Thanks for reporting the issue.

For reference, this is the link to the bug report: bugs.limesurvey.org/view.php?id=14551

Best regards/Beste Grüße,
Dr. Marcel Minke
Need Help? We offer professional Limesurvey support
Contact: marcel.minke(at)survey-consulting.com
Want to use your survey offline -> www.offlinesurveys.com
Letzte Änderung: 4 Monate 4 Wochen her von Mazi.
Folgende Benutzer bedankten sich: DenisChenu

Bitte Anmelden oder Registrieren um der Konversation beizutreten.

Mehr
4 Monate 3 Wochen her #180730 von DenisChenu
Yes and sorry about missunderstanding : can reproduce now (even with surveys update permission to false).

Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand .
An error happen ? Before make a new topic : remind the Debug mode .

Bitte Anmelden oder Registrieren um der Konversation beizutreten.

Jetzt loslegen!

Melden Sie sich jetzt an, und erstellen Sie in wenigen Minuten Ihre erste Umfrage.

Account einrichten

Abonnieren Sie unseren Newsletter

Abonnieren Sie unseren Newsletter für alle Neuigkeiten rund um LimeSurvey
captcha