See image: when you ask for a question preview, the window is (nearly) empty.
↧
12431: Preview of question is empty
↧
12434: Reflected XSS when viewing questiongroups
A administrator can view questiongroups by navigating to a URL in the following form:<br />
<br />
<a href="https://example.com/index.php?r=admin/questiongroups/sa/view/surveyid/{surveyid}/gid/{gid}">https://example.com/index.php?r=admin/questiongroups/sa/view/surveyid/{surveyid}/gid/{gid}</a><br />
<br />
Within this page, multiple links are embedded for actions on the questiongroup. The gid in these links are taken from the user input from the URL and do not properly encode special characters. Therefore, these links are susceptible for XSS attacks. The following outtakes from the page source show the locations in which html has been injected. The payload used for this is:<br />
"><img src=a onerror=alert(1)>.<br />
<br />
[...]<br />
<!-- Preview simple langue --><br />
<a class="btn btn-default" href="/index.php?r=survey/index/action/previewgroup/sid/162378/gid/"><img src=a onerror=alert(1)>" role="button" target="_blank"><br />
[...]<br />
<!-- Edit button --><br />
<a class="btn btn-default" href="/index.php?r=admin/questiongroups/sa/edit/surveyid/162378/gid/"><img src=a onerror=alert(1)>" role="button"><br />
<span class="icon-edit"></span><br />
Edit current question group </a><br />
[...]<br />
<!-- Check survey logic --><br />
<a class="btn btn-default" href="/index.php?r=admin/expressions/sa/survey_logic_file/sid/162378/gid/"><img src=a onerror=alert(1)>" role="button"><br />
[...]<br />
<!-- can delete group and question --><br />
<a class="btn btn-default" onclick="if (confirm('Deleting this group will also delete any questions and answers it contains. Are you sure you want to continue?')) { window.open('/index.php?r=admin/questiongroups/sa/delete/surveyid/162378/gid/"><img src=a onerror=alert(1)>','_top'); }" role="button"><br />
[...]<br />
<!-- Export --><br />
<a class="btn btn-default" href="/index.php?r=admin/export/sa/group/surveyid/162378/gid/"><img src=a onerror=alert(1)>" role="button"><br />
[...]<br />
<!-- State when page is loaded : for JavaScript--><br />
<li id="explorer" class="dropdownlvl2 dropdownstyle panel panel-default"><br />
<input type="hidden" id="open-explorer" /><br />
<br />
<input type="hidden" id="open-questiongroup" data-gid=""><img src=a onerror=alert(1)>" /><br />
[...]<br />
<div class="panel panel-primary panel-clickable" id="panel-1" data-url="/index.php?r=admin/questions/sa/newquestion/surveyid/162378/gid/"><img src=a onerror=alert(1)>"><br />
[...]
↧
↧
12435: Wrong exports
Bug 1: Exporting 'Started but not yet completed' survey status csv file generates the same csv file as 'All tokens' survey status.<br />
<br />
Bug 2: 'Started' column is missing in the csv export file.<br />
(Need that column so that users can identify those participants who has partially completed.)
↧
12437: Crash on survey with 2 MC questions
CDbException<br />
<br />
The table "{{survey_319294}}" for active record class "SurveyDynamic" cannot be found in the database.<br />
<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\db\ar\CActiveRecord.php(2387)<br />
<br />
2375 <br />
2376 /**<br />
2377 * Constructor.<br />
2378 * @param CActiveRecord $model the model instance<br />
2379 * @throws CDbException if specified table for active record class cannot be found in the database<br />
2380 */<br />
2381 public function __construct($model)<br />
2382 {<br />
2383 $this->_modelClassName=get_class($model);<br />
2384 <br />
2385 $tableName=$model->tableName();<br />
2386 if(($table=$model->getDbConnection()->getSchema()->getTable($tableName))===null)<br />
2387 throw new CDbException(Yii::t('yii','The table "{table}" for active record class "{class}" cannot be found in the database.',<br />
2388 array('{class}'=>$this->_modelClassName,'{table}'=>$tableName)));<br />
2389 <br />
2390 if(($modelPk=$model->primaryKey())!==null || $table->primaryKey===null)<br />
2391 {<br />
2392 $table->primaryKey=$modelPk;<br />
2393 if(is_string($table->primaryKey) && isset($table->columns[$table->primaryKey]))<br />
2394 $table->columns[$table->primaryKey]->isPrimaryKey=true;<br />
2395 elseif(is_array($table->primaryKey))<br />
2396 {<br />
2397 foreach($table->primaryKey as $name)<br />
2398 {<br />
2399 if(isset($table->columns[$name]))<br />
<br />
Stack Trace<br />
#0 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\db\ar\CActiveRecord.php(411): CActiveRecordMetaData->__construct(SurveyDynamic)<br />
#1 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\db\ar\CActiveRecord.php(680): CActiveRecord->getMetaData()<br />
#2 <br />
–<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\models\LSActiveRecord.php(29): CActiveRecord->hasAttribute("created")<br />
<br />
24 * @return array<br />
25 */<br />
26 public function behaviors()<br />
27 {<br />
28 $aBehaviors=array();<br />
29 $sCreateFieldName=($this->hasAttribute('created')?'created':null);<br />
30 $sUpdateFieldName=($this->hasAttribute('modified')?'modified':null);<br />
31 $sDriverName = Yii::app()->db->getDriverName();<br />
32 if ($sDriverName=='sqlsrv' || $sDriverName=='dblib') {<br />
33 $sTimestampExpression=new CDbExpression('GETDATE()');<br />
34 }<br />
<br />
#3 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\db\ar\CActiveRecord.php(396): LSActiveRecord->behaviors()<br />
#4 <br />
–<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\models\SurveyDynamic.php(45): CActiveRecord::model("SurveyDynamic")<br />
<br />
40 if (!is_null($sid)) {<br />
41 self::sid($sid);<br />
42 $refresh = true;<br />
43 }<br />
44 <br />
45 $model = parent::model(__CLASS__);<br />
46 <br />
47 //We need to refresh if we changed sid<br />
48 if ($refresh === true) $model->refreshMetaData();<br />
49 <br />
50 return $model;<br />
<br />
#5 <br />
–<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\core\LSETwigViewRenderer.php(194): SurveyDynamic::model("319294")<br />
<br />
189 if (!empty($aDatas['aSurveyInfo']['sid'])){<br />
190 $surveyid = $aDatas['aSurveyInfo']['sid'];<br />
191 $event->set('surveyId', $aDatas['aSurveyInfo']['sid']);<br />
192 <br />
193 if (!empty($_SESSION['survey_'.$surveyid]['srid'])){<br />
194 $aDatas['aSurveyInfo']['bShowClearAll'] = ! SurveyDynamic::model($surveyid)->isCompleted($_SESSION['survey_'.$surveyid]['srid']);<br />
195 }<br />
196 <br />
197 }<br />
198 <br />
199 App()->getPluginManager()->dispatchEvent($event);<br />
<br />
#6 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\core\LSETwigViewRenderer.php(144): LSETwigViewRenderer->renderTemplateFromString("{# LimeSurvey Copyright (C) 2007-2017 The LimeSurvey P...", array("aSurveyInfo" => array("template" => "default", "language" => "en", "sid" => "319294", "owner_id" => "1", ...)), false)<br />
#7 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\helpers\SurveyRuntimeHelper.php(449): LSETwigViewRenderer->renderTemplateFromFile("layout_main.twig", array("aSurveyInfo" => array("template" => "default", "language" => "en", "sid" => "319294", "owner_id" => "1", ...)), false)<br />
#8 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\controllers\survey\index.php(580): SurveyRuntimeHelper->run("319294", array("surveyid" => "319294", "thissurvey" => array("template" => "default", "language" => "en", "sid" => "319294", "owner_id" => "1", ...), "thisstep" => null, "tokensexist" => 0, ...))<br />
#9 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\application\controllers\survey\index.php(21): index->action()<br />
#10 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\web\actions\CAction.php(76): index->run()<br />
#11 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\web\CController.php(308): CAction->runWithParams(array("lang" => "en", "sid" => "319294"))<br />
#12 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\web\CController.php(286): CController->runAction(index)<br />
#13 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\web\CController.php(265): CController->runActionWithFilters(index, array())<br />
#14 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\web\CWebApplication.php(282): CController->run("index")<br />
#15 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\web\CWebApplication.php(141): CWebApplication->runController("survey/index/sid/319294")<br />
#16 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\framework\base\CApplication.php(185): CWebApplication->processRequest()<br />
#17 <br />
+<br />
D:\Dropbox\sites\limegit.toolsforresearch.com\public_html\index.php(205): CApplication->run()<br />
2017-05-26 21:12:38 Apache/2.4.17 (Win32) OpenSSL/1.0.2d PHP/5.5.30 Yii Framework/1.1.17
↧
12438: Old favicon in GIT 3.0 installation
See image
↧
↧
12439: Information from debug = 2, debugsql =1 not good visible
This happens mainly in admin theme.
↧
12440: Propertie TemplateConfiguration.name undefined
Home page (survey listing) show «La propriété « TemplateConfiguration.name » est indéfinie.» in french
↧
12441: "Resume later" does not work - Error while sending QUERY packet
Hi,<br />
<br />
when conducting a survey a click on "Resume later" leads the participant to a site where the participant can fill in some information to resume to the survey later on. However, after having typed in the necessary information a click on "Save now" leads to a situation where the page is loading for a couple of minutes and then brings up the message mentioned below. During the time where the webpage is loading the backend or any other survey are not accessible. <br />
<br />
I use PHP 7.0 which might be the cause for the error?<br />
<br />
Any other suggestions? <br />
<br />
Thank you.<br />
<br />
Kind regards<br />
<br />
<br />
PHP warning<br />
Error while sending QUERY packet. PID=20896<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/CDbCommand.php(508)<br />
496 Yii::trace('Query result found in cache','system.db.CDbCommand');<br />
497 return $result[0];<br />
498 }<br />
499 }<br />
500 <br />
501 try<br />
502 {<br />
503 if($this->_connection->enableProfiling)<br />
504 Yii::beginProfile('system.db.CDbCommand.query('.$this->getText().$par.')','system.db.CDbCommand.query');<br />
505 <br />
506 $this->prepare();<br />
507 if($params===array())<br />
508 $this->_statement->execute();<br />
509 else<br />
510 $this->_statement->execute($params);<br />
511 <br />
512 if($method==='')<br />
513 $result=new CDbDataReader($this);<br />
514 else<br />
515 {<br />
516 $mode=(array)$mode;<br />
517 call_user_func_array(array($this->_statement, 'setFetchMode'), $mode);<br />
518 $result=$this->_statement->$method();<br />
519 $this->_statement->closeCursor();<br />
520 }<br />
Stack Trace<br />
#0 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/CDbCommand.php(508): PDOStatement->execute()<br />
#1 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/CDbCommand.php(396): CDbCommand->queryInternal("fetchAll", array(2), array())<br />
#2 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/schema/mysql/CMysqlSchema.php(168): CDbCommand->queryAll()<br />
#3 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/schema/mysql/CMysqlSchema.php(128): CMysqlSchema->findColumns(CMysqlTableSchema)<br />
#4 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/schema/CDbSchema.php(96): CMysqlSchema->loadTable("survey_884596")<br />
#5 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/ar/CActiveRecord.php(2386): CDbSchema->getTable("{{survey_884596}}")<br />
#6 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/ar/CActiveRecord.php(411): CActiveRecordMetaData->__construct(SurveyDynamic)<br />
#7 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/ar/CActiveRecord.php(680): CActiveRecord->getMetaData()<br />
#8 –<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/models/LSActiveRecord.php(29): CActiveRecord->hasAttribute("created")<br />
24 * @return array<br />
25 */<br />
26 public function behaviors()<br />
27 {<br />
28 $aBehaviors=array();<br />
29 $sCreateFieldName=($this->hasAttribute('created')?'created':null);<br />
30 $sUpdateFieldName=($this->hasAttribute('modified')?'modified':null);<br />
31 $sDriverName = Yii::app()->db->getDriverName();<br />
32 if ($sDriverName=='sqlsrv' || $sDriverName=='dblib')<br />
33 {<br />
34 $sTimestampExpression=new CDbExpression('GETDATE()');<br />
#9 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/db/ar/CActiveRecord.php(396): LSActiveRecord->behaviors()<br />
#10 –<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/models/SurveyDynamic.php(42): CActiveRecord::model("SurveyDynamic")<br />
37 {<br />
38 self::sid($sid);<br />
39 $refresh = true;<br />
40 }<br />
41 <br />
42 $model = parent::model(__CLASS__);<br />
43 <br />
44 //We need to refresh if we changed sid<br />
45 if ($refresh === true) $model->refreshMetaData();<br />
46 <br />
47 return $model;<br />
#11 –<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/helpers/replacements_helper.php(347): SurveyDynamic::model("884596")<br />
342 $_linkreplace='';<br />
343 }<br />
344 <br />
345 if(isset($thissurvey['sid']) && isset($_SESSION['survey_'.$thissurvey['sid']]['srid']) && $thissurvey['active']=='Y')<br />
346 {<br />
347 $iscompleted=SurveyDynamic::model($surveyid)->isCompleted($_SESSION['survey_'.$thissurvey['sid']]['srid']);<br />
348 }<br />
349 else<br />
350 {<br />
351 $iscompleted=false;<br />
352 }<br />
#12 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/libraries/Save.php(66): templatereplace("<!-- startpage.pstl --> <meta http-equiv="content-type" content=...", array(), array("errormsg" => "Error: Email failed, this may indicate a PHP Mail Setup problem ...", "thissurvey" => array("template" => "default", "language" => "en", "sid" => "884596", "owner_id" => "12", ...), "surveyid" => "884596", "clienttoken" => "", ...))<br />
#13 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/helpers/SurveyRuntimeHelper.php(684): Save->showsaveform()<br />
#14 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/controllers/survey/index.php(611): SurveyRuntimeHelper->run("884596", array("surveyid" => "884596", "thissurvey" => array("template" => "default", "language" => "en", "sid" => "884596", "owner_id" => "12", ...), "thisstep" => "1", "tokensexist" => 0, ...))<br />
#15 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/application/controllers/survey/index.php(70): index->action()<br />
#16 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/web/actions/CAction.php(76): index->run()<br />
#17 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/web/CController.php(308): CAction->runWithParams(array("sid" => "884596"))<br />
#18 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/web/CController.php(286): CController->runAction(index)<br />
#19 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/web/CController.php(265): CController->runActionWithFilters(index, array())<br />
#20 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/web/CWebApplication.php(282): CController->run("index")<br />
#21 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/web/CWebApplication.php(141): CWebApplication->runController("survey/index/sid/884596")<br />
#22 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/framework/base/CApplication.php(185): CWebApplication->processRequest()<br />
#23 +<br />
/is/htdocs/XXX_YYY/www/limesurvey/index.php(214): CApplication->run()
↧
12442: Massive-delete questions fails to delete some questions
Some questions do not get deleted although massive report says "deleted"
↧
↧
12443: Count for list_participants
Since we don't have a "count_participants" method in Remote Control and I've now way of guessing the amount of participants, I've add a "count_results" key to the $aData array so I can' safely create a pagination. <br />
<br />
I don't know if the way I did is the best approach, but It gets the job done. <br />
<br />
In my humble opinion every method with a "limit" option should have another method to count the total amount of results or return it so we know when the results have ended.
↧
12444: Time limit not working correctly
While setting questiontype List (Options), screen is flickering after time has run out on preview.<br />
In the active survey the participant can finish the question even if the time has run out.<br />
<br />
Original ticket:<br />
Hallo,<br />
wenn ich bei meiner Umfrage ein Zeitlimit setzen möchte und habe als Fragentyp "Liste (Optionsfelder)" dann fängt der Bildschirm in der Vorschau an zu flackern sobald die Zeit abgelaufen ist. Wenn ich die Aktion auf "nur deaktivieren" setze dann kann der User die Frage noch in aller Ruhe beantworten obwohl das Limit abgelaufen ist.
↧
12445: Slider "Slider initial value" not recorded in data
When this setting is used, not only should the slider start at that position, but that value should be recorded in the data as an initial value (even if the slider is not manipulated) - <a href="https://manual.limesurvey.org/Question_type_-_Multiple_numerical_input#Slider_initial_value_.28slider_default.29">https://manual.limesurvey.org/Question_type_-_Multiple_numerical_input#Slider_initial_value_.28slider_default.29.</a><br />
<br />
- Currently, the slider starts in the correct position but nothing is recorded in the data <br />
- Expression Manager does not see the initial value <br />
- One cannot advance if the question is mandatory (although I see little use for a mandatory setting on a slider with an initial value, one should still be able to advance in that case)
↧
12448: Allow 'with comment' for all question types
Similar to 'list with comments' I would appreciate the option 'with comments' for all question types.<br />
Why? Many questions cannot be formulated in a finite way leaving often options uncaptured. And those would be helpful.<br />
Working now with 'short/ long comments' after e.g. an array makes the whole survey very long, and you have to declare in the label, that the comment is related to the previous question. Whereas the principle of 'list with comment' is very smart and compact.
↧
↧
12449: Quick translation is not working
It does not save the translations.<br />
No update to 2.6+ possible until next september for my university's server.
↧
12450: DataEntry not opening with array filter questions
Data-entry blank screen with debug=>0
↧
12451: Problem when One user export to pdf
I have LimeSurvey (Version 2.64.7+170404 ) with php7 and MSSQL Server.<br />
<br />
<br />
[Thu Jun 01 13:48:10.256254 2017] [:error] [pid 19692] [client 10.38.23.49:54803] PHP Notice: Undefined property: pdf::$getFontFamily in /var/www/html/limesurvey/application/libraries/admin/pdf.php on line 806, referer: <a href="http://vm-limesurvey-pre/limesurvey/index.php/printanswers/view/surveyid/646934">http://vm-limesurvey-pre/limesurvey/index.php/printanswers/view/surveyid/646934</a><br />
[Thu Jun 01 13:48:10.261062 2017] [:error] [pid 19692] [client 10.38.23.49:54803] PHP Notice: Undefined property: pdf::$getFontFamily in /var/www/html/limesurvey/application/libraries/admin/pdf.php on line 806, referer: <a href="http://vm-limesurvey-pre/limesurvey/index.php/printanswers/view/surveyid/646934">http://vm-limesurvey-pre/limesurvey/index.php/printanswers/view/surveyid/646934</a><br />
[Thu Jun 01 13:48:10.263196 2017] [:error] [pid 19692] [client 10.38.23.49:54803] PHP Notice: Undefined property: pdf::$getFontFamily in /var/www/html/limesurvey/application/libraries/admin/pdf.php on line 806, referer: <a href="http://vm-limesurvey-pre/limesurvey/index.php/printanswers/view/surveyid/646934">http://vm-limesurvey-pre/limesurvey/index.php/printanswers/view/surveyid/646934</a>
↧
12452: Conditional routing doesn't work, all vars are treated as string during comparison
Hi <br />
<br />
On LS 2.65.1+170522 the conditions based on integer variable (e.g Numerical Input) do not work anymore.
↧
↧
12453: Unable to update passwords using Firefox browser
When logged in as admin using the latest version of FIrefox, I am unable to update my password through my profile. I am unable to update any password in the user management section. <br />
<br />
The password fields are visible, but disabled and not able to be changed.<br />
<br />
There is no problem when using Internet Explorer, but this is not always an acceptable solution.
↧
12454: Connection with MySQL Cluster
Hello,<br />
I am going to transfer my Lime Survey from normal MySQL to MySQL cluster. But can anyone please help me to guide how to make the connection in that. As i have set up my MySQL cluster with 3 nodes on local system.<br />
The suggestion is highly appreciated.
↧
12455: Invite email does not let you attach a file
The invite email gives an error if you want to attach a file to the email.
↧