LimeSurvey bugs and feature requests - Issues

20738: New editor denies access to users whose survey access comes from survey group permissions (classic editor works)

Tue, 29 Sep 2026 19:21:38 +0200

A user with no superadmin and no global "surveys" permissions, whose access to a survey comes
from survey group permissions, can open and edit that survey in the classic editor, but the new
React editor shows "You don't have permission to access this page."

This is NOT a webserver configuration issue. On the same installation, superadmins use the new
editor without any problem, and /rest/v1/user-permissions returns HTTP 200 with a valid payload
for the affected user. urlFormat is 'path', mod_rewrite is enabled, no reverse proxy involved in
the failing request.

Cause:

The new editor's guard in editor/src/providers/PermissionsProvider.js derives access solely from
the payload of /rest/v1/user-permissions. That endpoint
(application/libraries/Api/Command/V1/UserPermission.php) calls Permission::getPermissions($userId),
which is findAllByAttributes(['uid' => $userId]) - raw permission rows only.
TransformerOutputUserPermissions then keeps only entity === 'global' and entity === 'survey'.

As a result, three access paths that Survey::hasPermission() (application/models/Survey.php, used
by the classic editor) honours are invisible to the new editor:

1. Survey group inheritance - stored as entity = 'surveysingroup', dropped by the transformer.
2. Survey ownership - Permission::hasPermission() returns true for the entity owner even with no
permission row at all. Reproducible by copying a survey: CopySurvey sets owner_id to the
copying user, while copySurveyPermissions() only copies the source survey's rows.
3. Roles - stored with uid = 0 (UserRoleController::applyPermissionFromXML), so they never match
the uid lookup.

The REST backend itself is correct: SurveyDetail and the patch handlers use hasSurveyPermission()
and authorise these users properly. Only the frontend guard rejects them.

Suggested fix: have UserPermission return effective survey permissions (resolving ownership, group
inheritance and roles), or have the guard query an endpoint that answers "can this user read/update
survey X?" using Survey::hasPermission().

Additional information:

- git diff 7.0.7+260729..master is empty for PermissionsProvider.js, UserPermission.php and
TransformerOutputUserPermissions.php, so the issue is present in the current release.
- Workaround, not acceptable in production: granting the global "surveys" -> update permission
makes the new editor work, but it grants write/activate/expire access to EVERY survey in the
installation through the global short-circuit in Survey::hasPermission(), defeating survey group
isolation.
- The attached .lss is a placeholder to satisfy the upload requirement. The survey content is
irrelevant to this bug: reproduction depends on the user and survey group permission
configuration, which an .lss export cannot carry. The steps below build that configuration from
scratch on a clean install.

20737: Index with question by question mode visually roken + usage of nav

Tue, 29 Sep 2026 12:48:15 +0200

With vanilla: the index is visually broken, and don't use nav and navigation

20736: Better difference between No response and not activated

Tue, 29 Sep 2026 12:13:30 +0200

In survey listing : difference between "No response" and "No response tables" is unclear.

20735: Deactivated survey question setting tooltip content is incorrect

Tue, 29 Sep 2026 15:00:56 +0200

The tooltip for question attributes in the new React editor displays "Deactivate survey to edit" even when the survey is deactivated. See screenshot below. This can be replicated also on https://demo.limesurvey.org/.

20734: When DB have an issue unable to fix it

Tue, 29 Sep 2026 12:13:15 +0200

If a survey is set as active== Y but the responses table are deleted or disappears (or any other error ) : no way to login and fix the issue.

20733: Vanilla theme Information and Relationships 1.3.1 rules broken

Tue, 29 Sep 2026 12:27:24 +0200

In French : [Structure du document incohérente] Zone d'en tête et corps de page. Les zones d'entête et de contenu principal ne sont pas structurées sémantiquement. Pour corriger : Encapsuler la zone d'en tête dans une balise

WCAG 2.1 1.3.1 – Information and Relationships
https://www.w3.org/WAI/WCAG21/Understanding/info-and-relationships.html

20730: Quotas are not working on encrypted questions

Mon, 28 Sep 2026 09:46:07 +0200

I noticed that if I have a quota on encrypted question it does not trigger as expected.

20729: Calling export_responses over JSON-RPC with sDocumentType = "csv" always returns HTTP 500 with a TypeError.

Sun, 27 Sep 2026 00:36:38 +0200

Calling export_responses over JSON-RPC with sDocumentType = "csv" always returns HTTP 500 with a TypeError. The same call with "json" or "xls" succeeds on the same survey, same session and same user. CSV export from the admin web UI also works. The problem was already present on 6.x and persisted after upgrading to 7.3.0.

When EXPORT_FORMAT is "xls" or "json" works fine, when "csv" it errors. R code that produces error in step export_b64 <- ls_call:

ls_call <- function(method, params) {
body <- jsonlite::toJSON(list(method = method, id = 1, params = params),
auto_unbox = TRUE)
resp <- httr::POST(LS_API_URL, httr::content_type_json(), body = body)
if (httr::http_error(resp)) {
# Server-side failures put the actual reason in the body, usually as an
# HTML error page -- strip the markup and show just the readable text
txt <- httr::content(resp, as = "text", encoding = "UTF-8")
txt <- gsub("(?is)<(head|script|style)\\b.*?", " ", txt, perl = TRUE)
txt <- gsub("<[^>]+>", " ", txt)
txt <- trimws(gsub("\\s+", " ", txt))
stop(method, ": HTTP ", httr::status_code(resp), "\n", substr(txt, 1, 2000))
}
out <- jsonlite::fromJSON(httr::content(resp, as = "text", encoding = "UTF-8"))
if (!is.null(out$error)) stop(method, ": ", out$error)
if (is.list(out$result) && !is.null(out$result$status)) {
stop(method, ": ", out$result$status)
}
out$result
}

session_key <- ls_call("get_session_key", list(LS_USER, LS_PASSWORD))

export_b64 <- ls_call("export_responses", list(
session_key, survey$survey_id, EXPORT_FORMAT, survey$lang,
COMPLETION, HEADING_TYPE, RESPONSE_TYPE
))

So exporting in xls is the workaround, but given that csv is the standard for data exchange, it would be good to get the "csv" format working.

20728: Answers show encrypted in response view when going to the next page

Mon, 28 Sep 2026 17:25:51 +0200

If you have survey with questions where you set encrypted ON, the response view shows the answers encrypted after going to next page.

20726: Question attributes diverge between React editor and classic editor

Thu, 24 Sep 2026 21:36:11 +0200

This is a problem as fixes don't reach both editors. In some instances it is even worse as different question attributes are attributed to different question themes. For example this blocks a fix for 18721

20725: New Question-Editor - missing button/possibility to manual "Data Entry"

Thu, 24 Sep 2026 17:57:30 +0200

In the new (!) question editor i can't see a button or possibilty to enter the page "data entry" in a running survey in the category "results".
Even not in the "..."-menus.

20724: Page to define or import label sets is not reachable

Fri, 25 Sep 2026 08:30:13 +0200

Page to define or import label sets is not reachable.

20723: When delete a survey : old responses and token table arenot deleted

Thu, 24 Sep 2026 18:03:22 +0200

When deleting a survey: old responses table are not deleted.

20722: When check data integrity : if you have a old response table : it broke

Thu, 24 Sep 2026 17:59:53 +0200

When there are old response table data inetgrity result throiw a DB error

20720: Twitter X button is outdated

Tue, 29 Sep 2026 15:43:52 +0200

The icon and colors need to be updated. This also requires an update for the Remix icons pack.

20719: Access mode button text is untranslated on state change

Tue, 22 Sep 2026 11:45:10 +0200

See screenshot below.

20718: error trying to update to 7.2

Wed, 23 Sep 2026 10:39:47 +0200

Call to undefined function getHtmlLangAttributeValue()

/var/www/limesurvey7/application/core/LSETwigViewRenderer.php(690)

678 // (in the future, should be template dependant done via XML file)
679 $aData["aSurveyInfo"] = array_merge($aData["aSurveyInfo"], $oTemplate->getClassAndAttributes());
680
681 $languagecode = App()->getLanguage();
682 if (!empty($aData['aSurveyInfo']['sid']) && Survey::model()->findByPk($aData['aSurveyInfo']['sid'])) {
683 if (!in_array($languagecode, Survey::model()->findByPk($aData['aSurveyInfo']['sid'])->getAllLanguages())) {
684 $languagecode = Survey::model()->findByPk($aData['aSurveyInfo']['sid'])->language;
685 }
686 }
687
688 $aData["aSurveyInfo"]['languagecode'] = $languagecode;
689 /* Separate from 'languagecode' since some codes (e.g. 'nl-informal') are not valid values for the HTML lang attribute */
690 $aData["aSurveyInfo"]['htmllanguagecode'] = getHtmlLangAttributeValue($languagecode);
691 $aData["aSurveyInfo"]['dir'] = (getLanguageRTL($languagecode)) ? "rtl" : "ltr";
692
693 if (!empty($aData['aSurveyInfo']['sid'])) {
694 $showxquestions = App()->getConfig('showxquestions');
695 $aData["aSurveyInfo"]['bShowxquestions'] = ($showxquestions == 'show' ||
696 ($showxquestions == 'choose' && !isset($aData['aSurveyInfo']['showxquestions'])) ||
697 ($showxquestions == 'choose' && $aData['aSurveyInfo']['showxquestions'] == 'Y'));
698
699
700 // NB: Session is flushed at submit, so sid is not defined here.
701 if (
702 isset($_SESSION['responses_' . $aData['aSurveyInfo']['sid']]) &&

20715: Create 2 other ranking system with the same views ?

Mon, 21 Sep 2026 12:26:50 +0200

New ranking system can be interesting to have 500 items ranked, but it doesn't interesting if we rank only 2 or 3 items for analysis.
Maybe we need 3 ranking question type

1. The new one
2. The old (6.X) one
3. One with one column by choice and save the rank (see https://demo.sondages.pro/714997)

20714: Ranking questions export is not user-friendly

Tue, 22 Sep 2026 10:35:54 +0200

When exporting ranking-type questions, there is a need for a more usable export format.

20713: Export ranking response as full answer export only code

Tue, 22 Sep 2026 08:26:55 +0200

When exporting ranking response and set Full answer : have only code

20709: Could not Download All Files via selecting with one click

Mon, 21 Sep 2026 21:59:28 +0200

In new UI's Results/Responses list when I tried to Download all attached files to that survey via clicking the select all button in header and click Download files below system gives error: "No files to download!"

20708: Concurrent response creation for the same participant

Sat, 19 Sep 2026 18:18:00 +0200

With long survey and some slow servers, there are multiple creations for one particpant.
It can happen too on limesurvey hosting

20704: Different behaviour about duplicate by firstname/lastname email when import participant

Fri, 18 Sep 2026 08:41:35 +0200

When duplicate is found with import CSV : use owner_id
When duplicate is found with import from token table : do not use owner_id

20703: Unable to upxdate firstnale lastname when import CSV in CPDB

Sat, 19 Sep 2026 21:36:58 +0200

As superadmin : when import existing participant (by ID) : lastname and firstname are not updated

20702: Unclear error when try to import participant without permission

Mon, 21 Sep 2026 22:01:31 +0200

When trying to import a user without permission: the errors are unclear