Access denied error when editing institution group as group admin

[Ghada El-Zoghbi]

Mahara: 16.04.2
DB: Postgres
OS: Linux
Browser: Firefox

A user assigned the role of 'Admin' in a group is not able to update the group.

This group was created via CSV upload and was assigned to an institution (i.e. institution1).

The group admin user is able to enter the settings and make changes. When they click the 'Save group' button, they get an error:

Access denied
You do not have access to view this page.
group_update: cannot update a group in this institution

The check is on line 577 in htdocs/lib/group.php where it checks:

* if (!empty($old->institution) && $old->institution != 'mahara') {

This check was put in for bug: https://bugs.launchpad.net/mahara/+bug/1420590

Which fixes an issue for groups that are in 'no institution'.

What I don't understand is why it's checking - on line 581 - if a user can edit the institution that group belongs to:

* if (!$USER->can_edit_institution($old->institution)) {

Surely if a user is an admin of the group, they can update it - whether that group is associated with an institution or not. And, if the user can edit that institution or not.

Shouldn't this check be if the user is an admin of the group - not institution?

i.e. replace lines 577 to 584 with:

    global $USER;
    if (group_user_access($old->id, $USER->get('id'), true) != 'admin') {
        throw new AccessDeniedException("group_update: cannot update group");
    }

Am I missing something?

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/6756

[Kristina Hoeppner (kris-hoeppner)]

How to test:

1. Create a group via CSV file in an institution.
2. Add another user as administrator for the group. This user should not be a site or institution admin.
3. Ensure that this user can save changed group settings.

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/6756
Committed: https://git.mahara.org/mahara/mahara/commit/d3261e3341b53a41c2966f834cb78780878e69ff
Submitter: Aaron Wells (<email address hidden>)
Branch: master

commit d3261e3341b53a41c2966f834cb78780878e69ff
Author: Ghada El-Zoghbi <email address hidden>
Date: Thu Jul 28 17:34:28 2016 +1000

bug#1607231: Remove check if user is an admin of the institution when updating a group.

behatnotneeded

Change-Id: I2eada9b65cc174900cdb6584c13905410c91c673