LimeSurvey bugs and feature requests - Issues

20646: REST API returns 401 under HTTP/2: case-sensitive Authorization header lookup breaks the new question editor

Tue, 11 Aug 2026 18:56:38 +0200

The REST API rejects valid bearer tokens when the request arrives over HTTP/2, because the Authorization header is looked up with a case-sensitive array key. As a consequence the new question editor never loads: it hangs forever on "Checking permissions...".

ROOT CAUSE

application/libraries/Api/Rest/Endpoint/EndpointFactory.php, getAuthBearerToken() (~line 226 on master):

$headers = getAllHeaders();
if (isset($headers['Authorization'])
&& strpos($headers['Authorization'], 'Bearer ') === 0) {
$token = substr($headers['Authorization'], 7);
}

The casing of the keys returned by getallheaders() depends on the server stack:

* nginx + PHP-FPM -> PHP rebuilds the names from $_SERVER and title-cases them, so the key is always "Authorization" and the bug is invisible.
* Apache + mod_php -> the names are returned exactly as received on the wire.

HTTP/2 (RFC 9113, section 8.2) requires all header field names to be transmitted in lowercase. So on Apache + mod_php + HTTP/2 the key is "authorization", the isset() check fails, no token is extracted, and every authenticated REST call returns 401.

HTTP header field names are case-insensitive by specification (RFC 9110, section 5.1), so a case-sensitive lookup is incorrect regardless of the HTTP version.

WHY IT IS HARD TO DIAGNOSE

The React editor bootstraps by calling GET /rest/v1/user-permissions. PermissionsProvider has no visible failure path for a rejected request, so the UI stays on the "Checking permissions..." spinner indefinitely. There is no error message, nothing in the application log, and the admin session itself is perfectly valid. The practical effect is that the survey editor is completely unusable - surveys cannot be created, edited or activated - while everything else in the admin interface works normally.

EVIDENCE

Same token, same server, only the HTTP version differs (measured with PHP cURL and CURLOPT_HTTP_VERSION):

before fix: HTTP/2 -> 401 HTTP/1.1 -> 200
after fix: HTTP/2 -> 200 HTTP/1.1 -> 200

The token itself is valid and correctly stored in lime_sessions. Passing the same token via the ?authToken= query parameter - the documented fallback in getAuthToken() - also returns 200 under HTTP/2, which confirms that only the header lookup is at fault.

Header name as seen by PHP for the very same request:

HTTP/2 getallheaders() -> 'authorization' isset($headers['Authorization']) === false
HTTP/1.1 getallheaders() -> 'Authorization' isset($headers['Authorization']) === true

SUGGESTED FIX

Normalise the keys before the lookup - the approach recommended by the PHP manual for getallheaders():

$headers = array_change_key_case(getAllHeaders(), CASE_LOWER);
if (isset($headers['authorization'])
&& strpos($headers['authorization'], 'Bearer ') === 0) {
$token = substr($headers['authorization'], 7);
}

Verified on our installation: after this change the editor loads and surveys can be created and activated normally over HTTP/2.

A secondary improvement worth considering: PermissionsProvider should surface a failed permissions request instead of showing the spinner forever. The silent failure is what made this take a full day to track down.

ADDITIONAL NOTES

The LimeSurvey 7 Question Editor documentation lists urlFormat => 'path' and URL rewriting as the requirements for the new editor. Both were satisfied here. Neither the Authorization header nor HTTP/2 is mentioned, and there is no troubleshooting entry for the hanging "Checking permissions..." screen.

Note that on many shared hosting providers HTTP/2 is enabled automatically together with HTTPS and cannot be turned off per site, so affected users have no configuration-level workaround and must patch the file.

A similar symptom is reported at https://forum.cloudron.io/topic/15623/new-question-editor-require-config.php-change but with a different root cause (404 on /rest/v1/version-info caused by packaging routing); it was fixed by the packager and never reported upstream.

ON THE REQUEST TO ATTACH AN EXAMPLE SURVEY

No .lss file is attached because the issue does not depend on survey content. The failing call is GET /rest/v1/user-permissions, which the editor makes before any survey is loaded, so it reproduces with any survey - or with none at all, by opening the editor on a freshly created installation.

20645: Fruity theme hides selected value in Bootstrap Select dropdown on hover

Mon, 10 Aug 2026 18:00:14 +0200

When using a Bootstrap dropdown (Type: !) in the Fruity theme, the selected answer becomes invisible while the mouse cursor is hovering over the dropdown.

The selected value is still present in the DOM and the Bootstrap Select component retains the correct value. However, the value is not visually displayed while the dropdown button is in its hover/focus/active state.

As soon as the cursor is moved away from the dropdown, the selected value becomes visible again.

(attached is a video of the behavior and a .lss file)

20639: Outdated Documentationx, please advise

Thu, 06 Aug 2026 15:49:21 +0200

We are trying to follow the steps in https://www.limesurvey.org/manual/Installation_security_hints#The_access_to_the_config.php_file

As it turns out, the settings we are supposed to change are no longer located in the config.php file, but can be found here:

limesurvey/application/config/internal.php: 'basePath' => dirname(dirname(__FILE__)),

limesurvey/application/controllers/InstallerController.php: ."\t" . "'runtimePath' => dirname(dirname(dirname(__FILE__))).DIRECTORY_SEPARATOR.'tmp'.DIRECTORY_SEPARATOR.'runtime'," . "\n"

limesurvey/application/config/internal.php: 'rules' => require('routes.php'),

So do they need to be changed at all?
Or can config.php now be moved out of the directory tree with no further changes and a simple

in the placeholder file?

Kindly update your documentation.

20638: Theme options dropdowns do not have any values in Firefox

Thu, 06 Aug 2026 14:17:38 +0200

In the Firefox browser only, the theme options values. These do render on Chromium.

I identified this in all "Theme optiosn"select boxes (e.g. "Theme colors", "Fonts", "Check icon").

All of these work as expected in Chromium-based browsers.

If you switch to Chromium you can edit these values.
Firefox will display the selected values when refreshing the page, but still doesn't give any items in its own dropdown, making it impossible to change the setting through firefox.

20637: 500 Internal Server Error since Update

Fri, 07 Aug 2026 14:53:21 +0200

Lime is very slow and i do not get new answers by participants. When I try to download the dataset for spss or excel i get the error "500 Internal Server Error". We had an update yesterday and i believe that we have the problems since then. Yesterday everything worked fine.

20630: Renaming a parent custom theme breaks child theme inheritance and leaves stale parent references

Tue, 04 Aug 2026 15:33:55 +0200

When a custom theme that serves as the parent of another custom theme is renamed, any child themes that extend it continue to reference the original parent theme internally, even though the Theme Editor overview displays the parent's new name.

As a result, the child theme can no longer resolve inherited assets and becomes unusable in the Theme Editor. Attempting to edit, duplicate, extend, or reinstall the child theme results in errors indicating that inherited files or the parent theme cannot be found, even though the parent theme still exists under its new name.

20626: Bounce tracking freezes at latest 6.x and 7.x version

Thu, 06 Aug 2026 09:08:05 +0200

At the latest LimeSurvey 7 version when I'm starting the bounce processing at my surveys, the screen just freezes and a pop-up shows. I can neither click any button nor return to the previous page. I need to fully reload the screen.

It looks like the script fully crashes. The console does not show any errors.

The popup interface problem shows at the latest 6.x AND 7.x version.

I define bounce settings globally and at my survey selected "Use global settings".

20624: DB crash when updating from 7.0.5 to 7.0.7 due to missing DB version check

Fri, 31 Jul 2026 11:53:42 +0200

While upgrading **LimeSurvey 7.0.5** to **7.0.7**, we encountered a database update failure on a server running **MariaDB 10.1.48**.

As a temporary workaround, we were able to complete the update by changing the column type from `JSON` to `LONGTEXT` in:
`application/helpers/update/updates/Update_709.php` (line **19**)

```php
addColumn("{{responses_" . $sid . "}}", "Q{$parent_qid}", "LONGTEXT");
```

However, we believe the actual issue is that the updater starts the database migration without first verifying that the database server meets the documented minimum requirements.

20623: HTTP Authorization header field not treated as case-insensitive leading to new editor not working

Fri, 31 Jul 2026 12:23:25 +0200

HTTP Authorization header field not treated as case-insensitive leading to new editor not working

In 'application/libraries/Api/Rest/Endpoint/EndpointFactory.php'[1], the check for the "Authorization" header field is not case-insensitive, as mandated by the HTTP standard.
Thus, the new editor won't work (i.e. be stuck with "Checking permissions…") when ran behind a http server or proxy that uses lower cases header fields (for example haproxy in HTTP/2 mode, as HTTP/2 requires the conversion of header fields to lower case).

[1] https://github.com/LimeSurvey/LimeSurvey/blob/9e6aa71beb752f11b68f03c33e554c81c71cdddc/application/libraries/Api/Rest/Endpoint/EndpointFactory.php#L232-L238

20620: statistic export failed with output format PDF and Excel

Tue, 11 Aug 2026 20:06:31 +0200

hello,

when exporting a statistic from a survey with the output format "PDF" and "Excel", the statistic export failed.

20619: Security update available - although LimeSurvey is updated to the latest 6.x version

Sat, 08 Aug 2026 13:23:50 +0200

We currently have two recent versions, one in the 6.x line and one in the 7.x line. Both are considered stable.
Since we cannot switch to the 7.x version anytime soon, but security updates are available for the 6.x version, the message “Security update available” should only be displayed if not all security patches for the 6.x version have been installed.

This leads to uncertainty and unease among users, as this gives the impression that LimeSurvey is being operated with security vulnerabilities, while at the same time handling sensitive data (surveys).

20611: New feature to exclude items at quick translation

Thu, 06 Aug 2026 14:38:28 +0200

The quick translation feature is a very useful tool, especially when making use of a Google Translate API key to automatically translate items to different languages. There are some drawbacks though: When using the auto-translation, it always adjusts all items on the current page/tab. But if parts of the translation have already been reviewed by a native speaker, or if there are equation questions, which the auto-translate sometimes messes up, then you need to redo the whole translation process after the auto-translation was done.

This can easily be solved by having a checkbox for every item, which is enabled by default, but offers the ability for the user to disable the translation feature for certain items.

We could try to develop this and provide a pull request. Is this considered a helpful feature? Then we would give it a try.

20608: datasecurity_notice_label is not rendered correctly with "Collapsible text" and "All in one" survey format

Fri, 17 Jul 2026 14:04:12 +0200

This is a follow up for 19852.

20605: Non consistent branch label

Tue, 21 Jul 2026 18:05:02 +0200

In the Comfort Update screen, the message says there is an unsable update but actually it is a stable one.
See screenshot

20600: When try to create dummy participant : page must be reloaded

Wed, 05 Aug 2026 16:32:36 +0200

When try to create dummy participant, if you don't reload the page, no action is done when you clickthe 1st time
This happen with mandatory attribute.

20599: When questions have a relevance equation, mandatory questions are not enforced.

Thu, 09 Jul 2026 08:57:18 +0200

I am seeing issues in a survey, where I have mandatory questions, and I am able to move forward without answering them
The issue seems to happen when questions have a relevance equation... that seems to kill the enforcement of mandatory questions.
When the questions don't have relevance equations, the mandatory rule is enforced.

This happens on v6 and v7

20598: Token overwrite when opening multiple survey tokens in different tabs of the same browser

Thu, 09 Jul 2026 12:35:34 +0200

When a user opens two distinct token links for the same survey in two different tabs of the same browser session, LimeSurvey overwrites the active token session data with the most recently loaded one. If the user goes back to the first tab and tries to save or proceed, the response data gets cross-contaminated or associated with the second token.

20596: Panel-Integration parameter (Survey-URL-Parameter) missing after copy

Tue, 21 Jul 2026 18:10:46 +0200

When I copy a survey, the panel integration parameters are missing in the result.

When using export / import to "copy" a survey, the panel integration parameters are not missing.

20595: Printable Survey not showing "other", after importing via txt

Mon, 06 Jul 2026 12:03:24 +0200

After importing a Survey via txt the "export" -> "Printable Survey" view does not show any other fields.
A workaround for this is: After importing open every question containing an other field, then saving the question (without any changes).
It seems as if saving the questions changes some parameter in the background, which is necessary for the Printable survey view.

Also it seems that the issue:
only occurs on txt import
applies to all question that have a built in other field option
is unaffected by other position and custom text

20589: Direct link to view single response no longer opens a dedicated page since v7 — only a modal/popup, breaking shareable links

Fri, 07 Aug 2026 09:48:14 +0200

## Expected Behavior

In previous LimeSurvey versions (pre-v7), clicking view/edit on a response opened a dedicated page with its own unique URL, e.g.:

https://umfrage.example.tld/responses/view?surveyId=532561&id=280

This URL was directly shareable, colleagues or reviewers could be sent a link straight to a specific response without needing to log in, navigate to the survey, and manually search for the response ID.

## Problem

* Old-style direct links (responses/view?surveyId=X&id=Y) still resolve to a working page (confirmed on our instance), but this is no longer reachable from the UI itself.
* The response list now only supports a popup for viewing/editing individual responses, and popups cannot be bookmarked, linked, or shared via URL.
* This breaks existing workflows for teams that share direct links to specific responses (e.g. for QA, moderation, or cross-referencing with partners).

## Suggested Fix

Restore the option to open a response in its own dedicated page (either as default behavior or as a user-selectable alternative to the popup), so the URL updates to reflect the currently viewed response and can be copied/shared.

Alternatively: make the popup update the browser URL (e.g. via history.pushState) so the current response state is reflected in a shareable link, similar to how many modern SPA implementations preserve deep-linkability even inside modals.

20578: Survey activation fails when a survey contains a Ranking question due to a consistency check error indicating missing answer opt

Tue, 30 Jun 2026 12:09:37 +0200

Activating a survey containing a Ranking question triggers a consistency check error stating that the question has missing answer options, preventing the survey from being activated.

20576: Partial Scoring for Multiple Choice Questions

Fri, 26 Jun 2026 09:35:03 +0200

Currently, LimeSurvey calculates the score for Multiple Choice questions by summing the assessment values of all selected answer options. As a result, it is not possible to implement a scoring model that is commonly used in knowledge and competency tests.

In many tests, only correctly selected answers should contribute to the score, while incorrectly selected answers should neither receive points nor cause a penalty.

This behavior cannot currently be achieved using the standard Assessment feature.

If incorrect answers are assigned an assessment value of 0, participants can simply select all answer options and still receive the maximum score. Assigning negative values to incorrect answers introduces a penalty-based scoring system, which is not appropriate for many assessment scenarios.

20573: Database : ranking question contains unrelated information

Mon, 29 Jun 2026 17:21:21 +0200

In 7.X database contains the question ID and subquestion ID

But data are related to other subquestion ID

20572: Can not add new element to ranking question in 7.0

Tue, 30 Jun 2026 10:58:03 +0200

In 6.0 : we can add element in ranking quetsion after activation, not tru in 7.0

20568: Implicit conversion from float 0.5 to int loses precision

Fri, 07 Aug 2026 18:23:01 +0200

With crypted attribute , when try to get quartile, we cast as float, not if not crypted.

1. No reason of cast if we do not cast when not crypted (must cast as both)
2. Throw an error with debug set