Fixed issue: On group/question preview a PHP error is thrown if the q…

…id/gid is invalid
LimeSurvey · May 15, 2024 · 6ccf4c7 · 6ccf4c7
1 parent 6a4b289
commit 6ccf4c7
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/application/controllers/survey/SurveyIndex.php b/application/controllers/survey/SurveyIndex.php
@@ -106,15 +106,15 @@ public function action()
                 throw new CHttpException(401, $message);
             } else {
                 killSurveySession($surveyid);
-                // Check if group exists
-                $arGroup = QuestionGroup::model()->findByPk(intval($param['gid']));
+                // Check if group exists in this survey
+                $arGroup = QuestionGroup::model()->find("sid = :sid and gid = :gid", [":sid" => $surveyid, ":gid" => intval($param['gid'])]);
                 if (empty($arGroup)) {
                     throw new CHttpException(400, gT("Invalid group ID"));
                 }
                 if ($param['action'] == 'previewquestion') {
                     $previewmode = 'question';
-                    // Check if question exists
-                    $arQuestion = Question::model()->findByPk(intval($param['qid']));
+                    // Check if question exists in this survey and group
+                    $arQuestion = Question::model()->find("sid = :sid and qid = :qid and gid = :gid", [":sid" => $surveyid, ":qid" => intval($param['qid']), ":gid" => intval($param['gid'])]);
                     if (empty($arQuestion)) {
                         throw new CHttpException(400, gT("Invalid question ID"));
                     }