What LimeSurvey/LimeSurvey shipped

Security fixes for survey permissions, central participant data and quota actions are in, plus a guard against edits during hosting backups. Release 7.9.0+261029 is out.

This week's changes include three security fixes: survey permissions could be granted beyond the editor's own rights, the central participant database had a missing authorization check, and quota mass actions lacked permission checks for other surveys. Administrators can no longer edit data or start a web database update while the hosting system makes a backup or runs the command-line update. Release 7.9.0+261029 is published. The survey structure panel has been redesigned, and functional tests now run on PostgreSQL and MSSQL as well as MySQL.

This week: three stored XSS fixes, keyboard and screen reader improvements in survey themes and the soft mandatory modal, expression fixes for answers with quotes, a select all survey permissions control, and clearer errors in the new editor. Releases 7.7.0+261020 and 7.8.0+26102

This week's updates include three security fixes for stored cross-site scripting: in the central participant database, in question advanced settings, and via image file names in imported survey themes. Accessibility work also landed, with survey themes no longer forcing keyboard and screen reader users through the whole top menu before the questions, and fixes to the soft mandatory modal for keyboard answering and WCAG 1.3.1, 4.1.2 and hidden element access. Expressions on text answers containing quotes or curly braces now match between the same page and later pages, survey permissions have a select all checkbox again, prepared themes resolve inherited settings, and the new editor shows why saving or activation failed. Releases 7.7.0+261020 and 7.8.0+261026 shipped.

This week: LDAP two-factor login fixed, a broken access control issue in the question conditions designer closed, optional survey links in token exports, shared filters for statistics and response exports, and full-text ranking exports. Release 7.6.0+261013 is out.

This week's changes: two-factor login now works with LDAP and other non-database authentication; a broken access control issue in the question conditions designer was closed; participant token exports can optionally include a survey link; shared filters now apply to statistics, response lists and response exports; ranking answers export as full text when full answers are selected; and the survey list can be sorted by last modified date and has an organize columns dialog. Version 7.6.0+261013 was released.

This week: Map question type is now standalone, plugins can cancel model saves/deletes, AuditLog logs survey deletion, Button question settings work, RemoteControl API errors include error_code, and more.

This week in LimeSurvey: the Map question type is now standalone with interactive maps and configurable providers. Plugins can access model events and cancel saving or deleting a model. The AuditLog plugin now records survey deletion. Button-based questions respect maximum buttons per row and size settings. RemoteControl API failure responses include error_code for several methods. Survey copying no longer fails with error 500 when the user lacks permission for the survey's group. Fruity TwentyThree adds an Automatic hyphenation option.

This week: fixed missing authorization checks and XSS, added survey import from React editor, redesigned response export, file uploads in statistics, and a new RemoteControl API method. Release 7.5.0+261001 is out.

This week we shipped security fixes for missing authorization checks in admin pages and AJAX endpoints, a reflected XSS in survey preview, and validation for file upload statistics. We also added survey import from the React editor, a redesigned response export modal with more formats, file upload support in statistics, and a new RemoteControl API method to list response exports. Exclusive answer options now respect configured random order. The 7.5.0+261001 release includes these changes. These updates improve security and make survey administration and data export more capable for everyone using LimeSurvey.

7.4.0 shipped: Advanced response filtering, one-click email unsubscribe, enhanced question rendering, and critical security fixes for XSS and SQL injection vulnerabilities.

LimeSurvey 7.4.0 is out. This release brings advanced response filtering with AND/OR logic, one-click unsubscribe for email clients, and improved question rendering. We also fixed multiple security vulnerabilities including high-severity XSS in date pickers and SQL injection in statistics. Users with group-level permissions can now access the new editor properly.

7.2.0+260921 released. Security fixes for participant sharing, CPDB deletion, CSV import, XSS in imports, Expression Manager access control, queXML/SPSS exports, and session expiration. Charts now scroll for many options.

LimeSurvey 7.2.0+260921 ships this week with fixes for seven security vulnerabilities affecting participant management, export controls, and input validation. Enhanced features include horizontal scrolling for charts with many options, Expression Manager support in admin emails, and validation improvements in data persistence. Session management now properly invalidates on password change.

LimeSurvey 7.1.1 is out. Quota exit tracking in responses, survey timings visible in tables, improved pie charts, and welcome screen image uploads are ready to use.

LimeSurvey releases 7.1.1 with several quality improvements: quota exit IDs now recorded in responses, survey timing data displayed in response tables, configurable welcome screen images for themes, corrected pie chart display with values on bars, and better alignment for choice buttons. Authentication header support for IIS and HTML language attribute fixes improve compatibility and accessibility across the platform.