Manager role forces a user to be a potential respondent on questionnaires

Manager role forces a user to be a potential respondent on questionnaires

by David Moxley -
Number of replies: 1

Apologies if this is a known issue, but in searching the forum and bug tracker I have not seen it mentioned...

I've found that, on our installation, by giving a user account the "Manager" role (default configuration) at the system level, her account displays as a potential respondent in all questionnaires across the site (Moodle v. 2.7.1+, Build: 20140807 ; Questionnaire v 2.7.0, Build: 2014070401).

This issue arose when a teacher sent a reminder (via questionnaire/show_nonrespondents.php) to all of the non-respondents to an anonymous questionnaire, generating an email (Moodle internal messaging is disabled on our system) to the staff member with Manager role. The staff Manager is not "enrolled" with any role in the course in question.

Given the questionnaire's anonymity, the teacher could not see the staff member as being on the list, but my subsequent testing on other questionnaires/courses with demo accounts confirms that apparently any account with the Manager-role appears as a potential respondent or non-respondent, as the case may be, regardless of the questionnaire or course. Further, clicking on the Manager user's name in the list of non-respondents generates a message confirming that the user is not enrolled in the course, rather than displaying the user profile.

The Manager role is one our site rarely uses, so the problem for us is minor, but assuming the issue is not peculiar to our installation, it could be a bigger problem for others, if not a security issue (for example if one or more functions are mistakenly assessing user capabilities in assembling the non-respondents list for a questionnaire). It may also happen with other roles, as Manager is the only one I have tested.

I hesitate to file a bug report, as this could be unique to our installation or just a boneheaded misunderstanding on my part. We've used Questionnaire with much satisfaction for years - many thanks to the developers who have provide it for us!

Average of ratings: -
In reply to David Moxley

Re: Manager role forces a user to be a potential respondent on questionnaires

by Joseph Rézeau -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers Picture of Translators

Hi David,

Thanks for your interest in the Questionnaire plugin. If you do not want your Manager role to have anything to do with the Questionnaire instances in courses on your Moodle site, simply edit the Manager role and remove all permissions for Questionnaire.

Site administration ► Users / ► Permissions ►Define roles

Manager / Edit role / Filter: Questionnaire : uncheck ALL permissions.

Joseph

EDIT.- See also CONTRIB-5311.