BUG

normal user can edit any survey

AFFTED VERSION

6.2.10

SUMMRUY

normal user has view permiision in survey . But still that user can edit the survey by adding that survey to his own group .

STEP TO REPRODUCE

1. There is already a superadmin(user-A) present .
2. now from user-A account add new user called "user-B" .
3. Gives bellow permission for user-B \

Survey groups  --> create and view 
Surveys ---> view

so, as per permission user-B cant edit any survey

4. now user-A create a survey called "survey-A" . user-B cant edit this survey .

5. now goto user-B account and here user-B can see above survey-A but cant edit this .

6. Now user-B create a survey-group called group-B and owner is himself of this group .

7. now user-B change the survey group of survey-A to group-B . check image https://imgur.com/ZmsBSMo

8. After this user-B can edit the survey-A

Impact

normal user can edit any survey