LimeSurvey bugs and feature requests - Issues

20678: Duplicate control of particpant work diffrently with crypted data and not cryoted data

Wed, 09 Sep 2026 12:51:17 +0200

When importing participants, duplicate use case-insensitive searches for not crypted data and case-sensitive for crypted data

20677: Incorrect image path generated for question background images on Windows Server 2025 with WampServer

Wed, 09 Sep 2026 08:20:40 +0200

When using LimeSurvey with Apache2 on Ubuntu 22.04, images added as a question background image are displayed correctly.

However, when the same functionality is used on Windows Server 2025 with WampServer, LimeSurvey generates an incorrect image URL. The Windows directory separators (`\`) appear to be encoded as `%5C` in the generated `src` attribute.

On Ubuntu 22.04, the generated HTML is:

``

On Windows Server 2025 with WampServer, the generated HTML is:

``

The `%5C` value represents a backslash (`\`). Since backslashes are being used in the generated URL and then URL-encoded, the browser cannot correctly resolve the image path, and the image is not displayed.

This appears to be related to path separator handling on Windows. LimeSurvey may be using Windows filesystem path separators (`\`) when generating a URL, instead of converting them to URL-compatible forward slashes (`/`).

The issue does not occur in the Ubuntu 22.04 + Apache2 environment, where the image URL is generated correctly with forward slashes.

20674: Invalid html lang attribute set for Dutch informal leading to weird auto-translate behavior

Tue, 08 Sep 2026 16:38:54 +0200

Using language Dutch informal sets an invalid html lang attribute, which results in incorrect auto-translation.

20673: Variable names are corrupted when exporting responses in R format

Wed, 09 Sep 2026 13:37:35 +0200

When exporting responses in R format using “R (syntax file)”, the variable names (column names) for options in single-choice, multiple-choice, and other question types appear to have been replaced with internal identifiers.

Previously, these names followed a format such as {Question Code}_{Option Code}. This change has broken all of our R analysis scripts that rely on the previous naming convention.

The downloaded R syntax file contains the following code:

----
# LimeSurvey Field type: F
data[, 10] <- as.numeric(data[, 10])
attributes(data)$variable.labels[10] <- "[Option A] Question 01"
data[, 10] <- factor(data[, 10], levels=c(1,0),labels=c("Yes", "Not selected"))
names(data)[10] <- "Q01__S3289"
# LimeSurvey Field type: F
data[, 11] <- as.numeric(data[, 11])
attributes(data)$variable.labels[11] <- "[Option B] Question 01"
data[, 11] <- factor(data[, 11], levels=c(1,0),labels=c("Yes", "Not selected"))
names(data)[11] <- "Q01__S3290"
# LimeSurvey Field type: F
data[, 12] <- as.numeric(data[, 12])
attributes(data)$variable.labels[12] <- "[Option C] Question 01"
data[, 12] <- factor(data[, 12], levels=c(1,0),labels=c("Yes", "Not selected"))
names(data)[12] <- "Q01__S3291"
....
----

In statements that assign column names, such as `names(data)[10] <- "Q01__S3289"`, the option identifier does not match the answer option code configured in the attached screenshot.

CSV and Excel exports appear to retain the original column names.

20672: HTTP 400 "The requested hostname is invalid" does not mention allowed_hosts.php, leaving admins without a way to recover

Wed, 09 Sep 2026 11:51:07 +0200

When a request arrives with a host name that is not listed in
application/config/allowed_hosts.php, LimeSurvey returns:

400: Bad Request - The requested hostname is invalid.
The request could not be understood by the server due to malformed
syntax. Please do not repeat the request without modifications.

The message does not mention allowed_hosts.php, the config directory, or
any way to fix the situation. An administrator who hits this has no
indication of what is wrong or where to look.

This matters because the allowed hosts file is created automatically, and
the only explanation is shown once and cannot be retrieved later.

In application/controllers/admin/Authentication.php (line 185 in
7.0.13+260903), on the first successful login LimeSurvey writes
allowed_hosts.php containing only the host used at that moment, and shows
a flash message:

"The allowed hosts file (application/config/allowed_hosts.php) has
been created with "%s" as trusted host. For security reasons,
LimeSurvey can only be accessed through that domain. If you need
additional hosts, please edit the allowed hosts file directly."

That wording is clear and actionable. However it is a one-time flash
message. Once it is gone, the administrator has no way to see it again.

The exception itself is thrown in application/core/LSHttpRequest.php
(line 313 in 7.0.13+260903):

public static function checkIsAllowedHost($hostInfo)
{
$host = parse_url($hostInfo, PHP_URL_HOST);
if ($host && !App()->isHostAllowed($host)) {
throw new CHttpException(400, gT("The requested hostname is invalid.", 'unescaped'));
}
}

This is easy to run into with common deployment patterns:

- Install with Docker and log in once through http://localhost:8080
while setting things up, then put the instance behind a domain name.
- Set up through an SSH tunnel or a reverse proxy, then switch to the
public host name.

In both cases the first login writes "localhost" as the only trusted
host, and every later request through the real domain fails with the
generic 400 above.

I hit this while deploying LimeSurvey 7.0.11 in Docker behind nginx. I
had to read the source (LSHttpRequest.php, LSApplicationTrait.php) to
find out that allowed_hosts.php existed at all. An administrator who is
not comfortable reading PHP source would most likely be stuck.

20671: "Undefined array key" warning when restricting available survey languages

Fri, 04 Sep 2026 15:46:47 +0200

See debug log in comments below

20670: PDF export displays file path instead of selected image for image-based multiple-choice answers

Fri, 04 Sep 2026 15:27:22 +0200

When a survey question uses images as the answer options, the selected answer is not rendered as an image in the Print Answers / PDF export. Instead, the PDF displays the file path or filename of the selected image.

20668: Completed/Incomplete responses chart labels get clipped

Thu, 03 Sep 2026 16:20:32 +0200

The values/labels of the "Completed/Incomplete responses" pie chart at the survey results overview page seem to be affected by a responsive sizing problem. Depending on the container size they get cut off partially or completely.

20666: Group with 2 questions and condition crashes with SQL error

Mon, 07 Sep 2026 09:22:44 +0200

Using a survey with 1 question group and 2 questions with 1 condition crashes the survey.

20663: Add version of get_participant_properties to retrieve multiple participants in 1 request

Mon, 31 Aug 2026 11:32:07 +0200

The current RemoteControl API function get_participant_properties is setup so that you can set query parameters to find a participant, and according to the documentation (https://api.limesurvey.org/classes/remotecontrol-handle.html#method_get_participant_properties), it gives an error if there are multiple results. It does not allow providing multiple tokenIds to get the properties of multiple participants at a time.

I'd like to request a version of this (maybe as a new endpoint), where i can supply a list of tokenIds and get the participant properties for all of those. Note that it should be clear which properties are for which token, so either make sure to include the id in the result as well, or return the properties in the same order as requested.

If you want to make it more generic and also use query parameters (not needed if it was up to me), then definitely include the token id in the response, or at least allow me to specify that i want to have the tokenId in a aTokenProperties parameter, just like the existing get_participant_properties. In that case also don't return an error if there are multiple matches.

20661: assign attributes without tokens to a session

Thu, 27 Aug 2026 10:08:20 +0200

token attributes can contain important data for workarounds. They can mimic dynamic lists.
It would nice to have these attributes in open surveys without tokens.
You define a few attributes set and have a rule to assign attributes to participants.
That could be random or allow to change that attribute set via expressionscript during a interview.

Other tools have (dynamic) lists, which can be defined globally. Reusing parts of what LimeSurvey already got might be as good as that.

20660: A server-side error was reported in a supplier survey.

Fri, 04 Sep 2026 15:48:29 +0200

Our survey returned an internal 500 server error. It was related to the LimeSurvey platform rather than a single questionnaire.
Based on the available survey configuration the error was the file attachment (File Upload) field.
The survey contained an attachment question where respondents could upload supporting documents. During processing, LimeSurvey attempted to evaluate or validate the field value as if it were a numeric value. However, the attachment field returns text-based data (such as file metadata, filenames, or JSON content), which can cause calculation or validation functions to fail.
The issue became particularly visible when a respondent uploaded the maximum allowed number of attachments. In that scenario, the attachment field returned a larger structured value, and LimeSurvey failed while processing the response, resulting in an HTTP 500 error and a PHP exception similar to:fmod(): Argument #1 ($num1) must be of type float, string given.
As a result, survey submission failed even though the uploaded files themselves were valid.
The attachment field configuration was changed, especially:Maximum number of files allowed.
Reducing the maximum number of attachments or removing the attachment field from calculations and validation expressions should prevent the error from occurring again.
Note: The root-cause section above is based on the investigation and troubleshooting conclusions discussed around the issue. The enterprise search results confirm the existence of the LimeSurvey-related server error but do not contain a detailed technical diagnosis of the attachment-field processing failure.

20653: Listing submitted responses for surveys take LOTS of time

Mon, 07 Sep 2026 13:49:05 +0200

Browsing survey responses (Responses → Browse responses) is extremely slow for surveys with a non-trivial number of questions and responses, because `getExtendedAnswer()` in `application/helpers/common_helper.php` runs a full, unfiltered `SELECT * FROM questions WHERE sid = :sid` query **on every single rendered cell** of the responses grid, in addition to a `Survey::model()->findByPk()` query per cell. For a page of 10 responses × ~80 columns this adds up to 500+ avoidable queries per page load, and is the dominant cost of the page.

20649: API feature request: expose survey activation consistency check without activating

Wed, 12 Aug 2026 21:38:42 +0200

We are integrating with LimeSurvey through the RemoteControl API and we would like to request an API capability to validate whether a survey is activation-ready, without actually activating it.

Current problem:
At the moment, consistency validation appears to happen only when calling activation-related actions (for example activate_survey). This makes it hard for external tools to provide clear pre-activation guidance to users.

Requested capability:
Please expose a dedicated API method to run the same consistency checks used by activation, but in read-only mode.

Suggested endpoint behavior:

Input: survey_id
Output:
* is_consistent (boolean)
* errors (list of blocking issues)
* warnings (list of non-blocking issues)
Optional structured details per rule, for example:
* no question groups
* no questions
* no active questions
* groups without questions
* other activation blockers detected by core LimeSurvey logic

Why this helps:

External dashboards can show users exactly what must be fixed before activation.
Integrations can avoid failed activation attempts.
Better UX and fewer support issues for admins.
Backward compatibility:

New method can be additive and optional.
Existing activation flow remains unchanged.
Thanks for considering this request.

20645: Fruity theme hides selected value in Bootstrap Select dropdown on hover

Mon, 07 Sep 2026 12:11:01 +0200

When using a Bootstrap dropdown (Type: !) in the Fruity theme, the selected answer becomes invisible while the mouse cursor is hovering over the dropdown.

The selected value is still present in the DOM and the Bootstrap Select component retains the correct value. However, the value is not visually displayed while the dropdown button is in its hover/focus/active state.

As soon as the cursor is moved away from the dropdown, the selected value becomes visible again.

(attached is a video of the behavior and a .lss file)

20638: Theme options dropdowns do not have any values in Firefox

Wed, 12 Aug 2026 14:17:44 +0200

In the Firefox browser only, the theme options values. These do render on Chromium.

I identified this in all "Theme optiosn"select boxes (e.g. "Theme colors", "Fonts", "Check icon").

All of these work as expected in Chromium-based browsers.

If you switch to Chromium you can edit these values.
Firefox will display the selected values when refreshing the page, but still doesn't give any items in its own dropdown, making it impossible to change the setting through firefox.

20637: 500 Internal Server Error since Update

Fri, 07 Aug 2026 14:53:21 +0200

Lime is very slow and i do not get new answers by participants. When I try to download the dataset for spss or excel i get the error "500 Internal Server Error". We had an update yesterday and i believe that we have the problems since then. Yesterday everything worked fine.

20630: Renaming a parent custom theme breaks child theme inheritance and leaves stale parent references

Mon, 07 Sep 2026 12:12:20 +0200

When a custom theme that serves as the parent of another custom theme is renamed, any child themes that extend it continue to reference the original parent theme internally, even though the Theme Editor overview displays the parent's new name.

As a result, the child theme can no longer resolve inherited assets and becomes unusable in the Theme Editor. Attempting to edit, duplicate, extend, or reinstall the child theme results in errors indicating that inherited files or the parent theme cannot be found, even though the parent theme still exists under its new name.

20624: DB crash when updating from 7.0.5 to 7.0.7 due to missing DB version check

Tue, 08 Sep 2026 18:00:11 +0200

While upgrading **LimeSurvey 7.0.5** to **7.0.7**, we encountered a database update failure on a server running **MariaDB 10.1.48**.

As a temporary workaround, we were able to complete the update by changing the column type from `JSON` to `LONGTEXT` in:
`application/helpers/update/updates/Update_709.php` (line **19**)

```php
addColumn("{{responses_" . $sid . "}}", "Q{$parent_qid}", "LONGTEXT");
```

However, we believe the actual issue is that the updater starts the database migration without first verifying that the database server meets the documented minimum requirements.

20619: Security update available - although LimeSurvey is updated to the latest 6.x version

Sat, 08 Aug 2026 13:23:50 +0200

We currently have two recent versions, one in the 6.x line and one in the 7.x line. Both are considered stable.
Since we cannot switch to the 7.x version anytime soon, but security updates are available for the 6.x version, the message “Security update available” should only be displayed if not all security patches for the 6.x version have been installed.

This leads to uncertainty and unease among users, as this gives the impression that LimeSurvey is being operated with security vulnerabilities, while at the same time handling sensitive data (surveys).

20611: New feature to exclude items at quick translation

Thu, 06 Aug 2026 14:38:28 +0200

The quick translation feature is a very useful tool, especially when making use of a Google Translate API key to automatically translate items to different languages. There are some drawbacks though: When using the auto-translation, it always adjusts all items on the current page/tab. But if parts of the translation have already been reviewed by a native speaker, or if there are equation questions, which the auto-translate sometimes messes up, then you need to redo the whole translation process after the auto-translation was done.

This can easily be solved by having a checkbox for every item, which is enabled by default, but offers the ability for the user to disable the translation feature for certain items.

We could try to develop this and provide a pull request. Is this considered a helpful feature? Then we would give it a try.

20608: datasecurity_notice_label is not rendered correctly with "Collapsible text" and "All in one" survey format

Wed, 09 Sep 2026 16:59:44 +0200

This is a follow up for 19852.

20605: Non consistent branch label

Tue, 21 Jul 2026 18:05:02 +0200

In the Comfort Update screen, the message says there is an unsable update but actually it is a stable one.
See screenshot

20600: When try to create dummy participant : page must be reloaded

Mon, 07 Sep 2026 16:28:26 +0200

When try to create dummy participant, if you don't reload the page, no action is done when you clickthe 1st time
This happen with mandatory attribute.

20599: When questions have a relevance equation, mandatory questions are not enforced.

Thu, 09 Jul 2026 08:57:18 +0200

I am seeing issues in a survey, where I have mandatory questions, and I am able to move forward without answering them
The issue seems to happen when questions have a relevance equation... that seems to kill the enforcement of mandatory questions.
When the questions don't have relevance equations, the mandatory rule is enforced.

This happens on v6 and v7