diff --git a/docs/changelog/6.x.x.txt b/docs/changelog/6.x.x.txt index 854393947..78123b171 100644 --- a/docs/changelog/6.x.x.txt +++ b/docs/changelog/6.x.x.txt @@ -21,6 +21,8 @@ for your new submission. - Bugfix [ 952949 ] Survey Export Composite Fails - Updated the Finnish translation thanks to Markus Hynna. + - Fixed a bug where visitors could potentially edit other visitor's USS + submissions. diff --git a/lib/WebGUI/Wobject/USS.pm b/lib/WebGUI/Wobject/USS.pm index 0370e64d9..a8c68c1e7 100644 --- a/lib/WebGUI/Wobject/USS.pm +++ b/lib/WebGUI/Wobject/USS.pm @@ -849,7 +849,7 @@ sub www_viewSubmission { $var{"next.more"} = ($data[0] ne ""); $var{"next.url"} = WebGUI::URL::page('func=viewSubmission&sid='.$data[0].'&wid='.$session{form}{wid}); $var{"next.label"} = WebGUI::International::get(59,$_[0]->get("namespace")); - $var{canEdit} = ($submission->{userId} == $session{user}{userId} || WebGUI::Privilege::isInGroup($_[0]->get("groupToApprove"))); + $var{canEdit} = (($submission->{userId} == $session{user}{userId} || WebGUI::Privilege::isInGroup($_[0]->get("groupToApprove"))) && $session{user}{userId} != 1); $var{"delete.url"} = WebGUI::URL::page('func=deleteSubmission&wid='.$session{form}{wid}.'&sid='.$session{form}{sid}); $var{"delete.label"} = WebGUI::International::get(37,$_[0]->get("namespace")); $var{"edit.url"} = WebGUI::URL::page('func=editSubmission&wid='.$session{form}{wid}.'&sid='.$session{form}{sid});