Welcome to the LimeSurvey Community Forum

Ask the community, share ideas, and connect with other LimeSurvey users!

security bug: created admin can give more rights than he owns itself

  • bewi
  • bewi's Avatar Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
5 years 2 months ago #180613 by bewi
as superadmin I created an admin "test1", who has some rights:
[img


as "test1" has the right to create further admins he does so and creates admin "test2" with this rights:
[img


this can be done a third time:
"test2" creates "test3" with this rights:
[img


when "test1" creates a survey he grants "test2" some access (no publishing!):
[img


as "test2" wants "test3" to participate he grants rights to "test3":
[img


Oops: "test3" can publish the survey???
although "test2" has no rights to publish", he can grant the right to publish for "test3"???
The topic has been locked.
  • DenisChenu
  • DenisChenu's Avatar
  • Offline
  • LimeSurvey Community Team
  • LimeSurvey Community Team
More
5 years 2 months ago - 5 years 2 months ago #180619 by DenisChenu
You think a forum is a good place to report an issue ?
www.limesurvey.org/community/bug-tracker

Else :
LimeSurvey version and build number ? (can not reproduce on 3.15.9 git version)
Did it work when saving ?

Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand , plugin development .
I don't answer to private message.
Last edit: 5 years 2 months ago by DenisChenu.
The topic has been locked.
  • bewi
  • bewi's Avatar Topic Author
  • Offline
  • Junior Member
  • Junior Member
More
5 years 1 month ago #180708 by bewi
in my excitement about the bug, I didn't find the bugtracker. Just a lot of hints to contact the forum instead of the support.
meanwhile I added an report over there, so this thread can be deleted.
The topic has been locked.
  • Mazi
  • Mazi's Avatar
  • Offline
  • Official LimeSurvey Partner
  • Official LimeSurvey Partner
More
5 years 1 month ago - 5 years 1 month ago #180713 by Mazi
Thanks for reporting the issue.

For reference, this is the link to the bug report: bugs.limesurvey.org/view.php?id=14551

Best regards/Beste Grüße,
Dr. Marcel Minke
Need Help? We offer professional Limesurvey support: survey-consulting.com
Contact: marcel.minke(at)survey-consulting.com
Last edit: 5 years 1 month ago by Mazi.
The following user(s) said Thank You: DenisChenu
The topic has been locked.
  • DenisChenu
  • DenisChenu's Avatar
  • Offline
  • LimeSurvey Community Team
  • LimeSurvey Community Team
More
5 years 1 month ago #180730 by DenisChenu
Yes and sorry about missunderstanding : can reproduce now (even with surveys update permission to false).

Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member, professional service on demand , plugin development .
I don't answer to private message.
The topic has been locked.

Lime-years ahead

Online-surveys for every purse and purpose