This is a session management issue to avoid submitting the same page twice, or clicking the browser back button and then re-submitting from it. 1.92 creates a hidden POSTkey value. If the session value and the value on the generated page don't match, then you get the error you're seeing.

Yii will have a different way of managing sessions.

In general, though, I need to make sure that EM doesn't call NavigateForwards() if you click next after having used your browser back button. You'd get the wrong results. EM caches all the information it needs about the current set of relevant questions for performance and data integrity purposes. If you use the browser back button, you invalidate it's ability to do those checks.

Going back is OK, since I don't validate data going backwards - only going forwards.

FYI, there are plenty of frameworks that disable (or don't use) the back button. Disabling it isn't always a mistake (anything Flash-based, for example).

I don't think we really need a POSTkey value in the frontend, as I consider the security risks (session CRF) be very low with something as mundane as survey.

I don'T understand why using the forward button (an thus submitting the same values again) would serve you wrong results?

OK, there is probably a way around this. I'd just need to see whether things works as expected if I use "JumpTo" a prior page value (to get the session state you would have had on a prior page) followed by NavigateForwards(). We'd also need stronger checking of the page # from which the person is submitting next.

Fixed with patch https://github.com/LimeSurvey/LimeSurvey/commit/4850c3d26f79738fdb1ccfc9e25ac1be4d7b657b

1.92RC5 release