Hello, and greetings from Paris, France

I have recently been asked by some teachers for setting a limesurvey installation. They would like to train their students to use it, and by so, give the rights to each student to create surveys.


The idea is nice, but I have concerns regarding the potential misuse that can be done by "some not too serious" students.

Indeed, as the limesurvey instance will be settled with our university domain and used by non-controlled individuals, people responding to the surveys could be mystified by the university frame by thinking that the survey comes from an institutional organism.

To avoid that, I can prepare a special template to alert people, but this is not enough ; I also can affect students to some groups and not give them the rights to publish surveys, but this is not a very solid solution either, nor is the one to limit the web site access with some firewall...

For those reasons I was looking for a way to forbid for every one (but a super admin) the right to publish surveys... Can someone tell me if this may be done ? Where should I modify the code to make this work ?

Or may be someone have others ideas to solve this issue ?

Thanks for any help !

So you work for a university that is supposed to educate and train people to later work in big corporporations or the government, yet you don't trust them with a simple survey? I guess you guys should close that university down, it is a potential danger to the nation.

Jokes aside: You could think about a htaccess file that renders all survey URLs unusable or soemthing. Not an expert on htaccess though, so just a rough idea.

Maybe someone more knowledgeable might be able to help with a more concrete example.

You can allow URLs containing "activate" only from some IP addresses. You need a RewriteCond for that.

How about blocking plain http and installing a snakeoil https certificate for the domain? Hence the surveys will be totally visible, but most users would guess that there is something unusual in the web address.

On Apache level I guess you could use something like

RewriteCond %{REQUEST_URI} !-f
RewriteRule ^(.+) nothing.invalid [L]

and then "publish" a survey number 123456 by making an empty file by

touch 123456

But then, a nasty student could just wait for that and then change the survey.

Or you can block access to specific IP:s or make a basic http auth with string "Just for testing".

I don't think using hack in htaccess here are the best solutioin.

And currently : we have a clean plugin event for this : beforeHasPermission

If i don't make error : sPermission == 'activate' then return false must do the trick.

Denis

Hello everybody, and thanks a lot for yours contributions !

DenisChenu, your proposal seems the best on my point of view.
I find out that using the "plugin way" to customize LS is really a quick and easy way.

I even found a post where you put a plugin code ( forums.limesurvey.org/forum/french-forum...dmin-par-utilisateur )...

But I was not able to use the beforeHasPermission method. When I tried I just retrieved a 'superadmin' and 'survey' values for the $event array and not the ones I was expecting for... I should have missed something.

Anyway I just used 'beforeSurveyActivate' (for the main stuff) and 'beforeDeactivate' (to forbid plugin deactivation) and this seems to do the job.

Unfortunately, now I have not the time to explore and play with those elements due to the C19 crisis, but I will be back as soon as possible to practice them !

thanks again and have a very nice day.

@holch
hey, do you know any administrator that can trust his/her users ? And, by the way, do you always trust big corpos and govs ?


The "redirection" proposals (paloalto, htaccess apache...) where not as solid as the plugin is because they trick the web habits and still left open some misuses (and are much more annoying to maintain !)

bye

Preventing to activate a survey would be suitable for a "normal" survey tool with a "real" preview function. But LimeSurvey isn't offering a way to really preview a survey. The behaviour changes when an survey is activated. If you cannot activate a survey, you cannot really test your survey 100%: This hasn't change till today.

? The only behaviour update are quota, no ?

@holch
hey, do you know any administrator that can trust his/her users ? And, by the way, do you always trust big corpos and govs ?

At some point I need to have a certain trust in people. It might not always work out perfectly, but hey, there are risks in life.

And yes, I gave our interns access to our survey tool that runs under our domain name. Because I need to trust them to a certain degree. If I wouldn't have at least a minimal trust, I couldn't let them on the premise.

But I understand your point to a certain degree. You don't have any personal contact to most of the students, while I have personal contact to my employees every single day.