From 5b96f382c0ea4f7b62d40148201972e9dbdbb5f2 Mon Sep 17 00:00:00 2001
From: samin-z <samin.zavarkesh@gmail.com>
Date: Tue, 20 Oct 2026 14:05:01 +0200
Subject: [PATCH] respondent check

Signed-off-by: samin-z <samin.zavarkesh@gmail.com>
---
 lib/Controller/ApiController.php            |  8 ++-
 tests/Unit/Controller/ApiControllerTest.php | 79 +++++++++++++++++++++
 2 files changed, 86 insertions(+), 1 deletion(-)

diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
index 85485d2b1..6dc85045c 100644
--- a/lib/Controller/ApiController.php
+++ b/lib/Controller/ApiController.php
@@ -1547,7 +1547,6 @@ public function updateSubmission(int $formId, int $submissionId, array $answers)
 			throw new OCSBadRequestException($e->getMessage());
 		}
 
-		// get existing submission of this user
 		try {
 			$submission = $this->submissionMapper->findById($submissionId);
 		} catch (DoesNotExistException) {
@@ -1558,6 +1557,13 @@ public function updateSubmission(int $formId, int $submissionId, array $answers)
 			throw new OCSBadRequestException('Submission doesn\'t belong to given form');
 		}
 
+		if (
+			!in_array(Constants::PERMISSION_RESULTS_DELETE, $this->formsService->getPermissions($form))
+			&& $this->currentUser->getUID() !== $submission->getUserId()
+		) {
+			throw new OCSForbiddenException('You can only update your own submission!');
+		}
+
 		$submission->setTimestamp(time());
 		$this->submissionMapper->update($submission);
 
diff --git a/tests/Unit/Controller/ApiControllerTest.php b/tests/Unit/Controller/ApiControllerTest.php
index b67d6bdbf..0de992dcc 100644
--- a/tests/Unit/Controller/ApiControllerTest.php
+++ b/tests/Unit/Controller/ApiControllerTest.php
@@ -1908,6 +1908,11 @@ public function testUpdateSubmission_success() {
 			->with($form)
 			->willReturn(true);
 
+		$this->formsService->expects($this->once())
+			->method('getPermissions')
+			->with($form)
+			->willReturn([]);
+
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
 			->with($formId)
@@ -2122,6 +2127,11 @@ public function testUpdateSubmission_canEditOthers_withDeletePermission() {
 			->with($form)
 			->willReturn(true);
 
+		$this->formsService->expects($this->once())
+			->method('getPermissions')
+			->with($form)
+			->willReturn([Constants::PERMISSION_RESULTS_DELETE]);
+
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
 			->with($formId)
@@ -2289,6 +2299,11 @@ public function testUpdateSubmission_ownSubmissionWithAllowEditSubmissions() {
 			->with($form)
 			->willReturn(true);
 
+		$this->formsService->expects($this->once())
+			->method('getPermissions')
+			->with($form)
+			->willReturn([]);
+
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
 			->with($formId)
@@ -2355,6 +2370,60 @@ public function testUpdateSubmission_ownSubmissionWithoutAllowEditSubmissions()
 		$this->apiController->updateSubmission($formId, $submissionId, $answers);
 	}
 
+	public function testUpdateSubmission_otherUsersSubmissionDeniedWhenAllowEditSubmissions() {
+		$formId = 1;
+		$submissionId = 42;
+		$answers = ['q1' => ['answer1']];
+
+		$form = new Form();
+		$form->setId($formId);
+		$form->setOwnerId('formOwner');
+		$form->setAllowEditSubmissions(true);
+
+		$submission = new Submission();
+		$submission->setId($submissionId);
+		$submission->setFormId($formId);
+		$submission->setUserId('anotherUser');
+
+		$this->formsService->expects($this->once())
+			->method('loadFormForSubmission')
+			->with(1)
+			->willReturn($form);
+
+		$this->formsService->expects($this->once())
+			->method('canDeleteResults')
+			->with($form)
+			->willReturn(true);
+
+		$this->formsService->expects($this->once())
+			->method('getPermissions')
+			->with($form)
+			->willReturn([Constants::PERMISSION_SUBMIT]);
+
+		$this->formsService->expects($this->once())
+			->method('getQuestions')
+			->with($formId)
+			->willReturn([['id' => 'q1', 'type' => Constants::ANSWER_TYPE_SHORT, 'options' => []]]);
+
+		$this->submissionService->expects($this->once())
+			->method('validateSubmission');
+
+		$this->submissionMapper->expects($this->once())
+			->method('findById')
+			->with($submissionId)
+			->willReturn($submission);
+
+		$this->submissionMapper->expects($this->never())
+			->method('update');
+
+		$this->answerMapper->expects($this->never())
+			->method('deleteBySubmission');
+
+		$this->expectException(OCSForbiddenException::class);
+		$this->expectExceptionMessage('You can only update your own submission!');
+		$this->apiController->updateSubmission($formId, $submissionId, $answers);
+	}
+
 	public function testUpdateSubmission_otherSubmissionWithoutPermission() {
 		// Test that user without RESULTS_DELETE cannot edit others' submissions even if allowEditSubmissions=true
 		$formId = 1;
@@ -2463,6 +2532,11 @@ public function testUpdateSubmission_formOwnerCanEditOthers() {
 			->with($form)
 			->willReturn(true);
 
+		$this->formsService->expects($this->once())
+			->method('getPermissions')
+			->with($form)
+			->willReturn([Constants::PERMISSION_RESULTS_DELETE]);
+
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
 			->with($formId)
@@ -2524,6 +2598,11 @@ public function testUpdateSubmission_resultsDeleteShareCanEditOthers() {
 			->with($form)
 			->willReturn(true);
 
+		$this->formsService->expects($this->once())
+			->method('getPermissions')
+			->with($form)
+			->willReturn([Constants::PERMISSION_RESULTS_DELETE]);
+
 		$this->formsService->expects($this->once())
 			->method('getQuestions')
 			->with($formId)