View Issue Details

This bug affects 1 person(s).
 6
IDProjectCategoryView StatusLast Update
15200Bug reportsOtherpublic2019-08-30 20:11
Reporterrenatocron Assigned Toc_schmitz  
PrioritynoneSeveritypartial_block 
Status closedResolutionduplicate 
Product Version3.17.x 
Fixed in Version3.17.x 
Summary15200: Unable to submit token first time it loaded on Safari (Iphone and MacOS)
Description

Hello,

I'm upgraded from 3.15.6.190108 to v3.17.9 (and then v3.17.13) because of a lot of security bugfixs and but I now started getting "Please use the LimeSurvey navigation buttons or index. It appears you attempted" when I try to submit the survey for the first time it loaded on that session/device.

It happens with all surveys I have, even if there's a required field or not, but it's always on the first page that the message is shown.

So far, only was able to reproduce it on Safari browser (both desktop and on iPhone). If Chrome is used, it works as expected, even on IOS. On Safari desktop, sometimes I even need to submit it multiple times to get rid of the message.

So, could be my theme messing with the things after the upgrade?

To figure that out, I created a new survey, with just one question group, and only one text question, activated and closed it, changed the setting "Enable token-based response persistence:
" to ON. I also disabled the welcome page. Same error, 100% of the times. I tried setting "Participant may save and resume later" to OFF but I also get the same results.

I found this on the forum:
https://www.limesurvey.org/forum/can-i-do-this-with-limesurvey/100064-please-use-the-limesurvey-navigation-buttons-or-index-it-appears-you-attempted?start=15#185391

It's looks it's the same issue, but I was not able to reproduce when testing with my phone on using my survey. (Samsung browser UA: "Mozilla/5.0 (Linux; Android 8.0.0; ZE553KL Build/OPR1.170623.026) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36" not tested on a Samsung smartphone though)

So, I read it, and found a thing called "Ajax Mode":

I turned off Ajax Mode, I was so happy to disabled it and crossed my fingers, but did not solved the issue :S

I also tried disabling csrf and change the session to the database. Still nothing.

I tried this survey file I put here on 3.15.6+190108 (old testing container I had) and it worked, but this version is too old (but maybe I may use it anyway and just cherry pick the issues I found)

For now, I will try to reproduce it on 3.15.6.190108 (as I did not had tested it on that version)

Steps To Reproduce

Use the survey included on this, activate and close it.

Insert a token.
Open the survey on a Safari with this token.
Try to submit the form (is not needed to fill anything).

Additional Information

load my website page
[27/Aug/2019:18:06:35 +0000] "GET /questionarios/?responder-proxima=1 HTTP/1.1" 200 5620 "https://same.domain.com/lime/index.php/366148" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
my javascript pull the pending surveys:
[27/Aug/2019:18:06:35 +0000] "GET /api/user/me?include_survey=1&api_key=JWT "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
[27/Aug/2019:18:06:36 +0000] "GET /serviceworker.js?mtime=1562966440 HTTP/1.1" 304 0 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"

javascript asks for the URL for awnsering a survey:
[27/Aug/2019:18:06:40 +0000] "POST /api/user/get-survey-token?user_survey_id=3006&api_key=JWT1" 200 112 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
browser redirect it to the survey URL:
[27/Aug/2019:18:06:40 +0000] "GET /lime/index.php/366148?token=275__wwqfg9bduj&lang=pt-BR&newtest=Y HTTP/1.1" 200 4786 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
a bunch of javascript and css:
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/7ebe61a5/noto.css HTTP/1.1" 200 186 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/d70532d0/css/font-awesome.min.css HTTP/1.1" 200 7053 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/6b4f476c/awesome-bootstrap-checkbox/awesome-bootstrap-checkbox.css HTTP/1.1" 200 1387 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/59672cc3/yiistrap.min.css HTTP/1.1" 200 548 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/59672cc3/bootstrap.min.css HTTP/1.1" 200 19663 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/6b4f476c/template-core.css HTTP/1.1" 200 2377 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/cced2354/css/ajaxify.css HTTP/1.1" 200 253 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/6ac2ef80/survey.css HTTP/1.1" 200 1799 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/803f194a/css/animate.css HTTP/1.1" 200 2926 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/803f194a/css/variations/sea_green.css HTTP/1.1" 200 7059 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/803f194a/css/theme.css HTTP/1.1" 200 5560 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/532462c9/jquery-3.1.1.min.js HTTP/1.1" 200 30080 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/803f194a/css/custom.css HTTP/1.1" 200 204 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/6fca9946/build/lslog.js HTTP/1.1" 200 1737 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/9362fc44/pjax.js HTTP/1.1" 200 12638 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/532462c9/jquery-migrate-3.0.0.min.js HTTP/1.1" 200 2714 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/6ac2ef80/survey.js HTTP/1.1" 200 4024 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/6b4f476c/template-core.js HTTP/1.1" 200 1959 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/5a181ab1/moment-with-locales.min.js HTTP/1.1" 200 65607 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/59672cc3/bootstrap.min.js HTTP/1.1" 200 9833 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/cced2354/scripts/ajaxify.js HTTP/1.1" 200 2246 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/cced2354/scripts/theme.js HTTP/1.1" 200 3751 ...
[27/Aug/2019:18:06:40 +0000] "GET /lime/tmp/assets/59672cc3/plugins/bootstrapconfirm/bootstrapconfirm.min.js HTTP/1.1" 200 488 ...
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/cced2354/scripts/custom.js HTTP/1.1" 200 308 ...
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/7f3886d/survey_runtime.js HTTP/1.1" 200 5058 ...
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/89fcf9b8/decimalcustom.js HTTP/1.1" 200 513 ...
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/d8a385cd/em_javascript.js HTTP/1.1" 200 33790 ...
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/7f3886d/nojs.js HTTP/1.1" 200 179 ...
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/5a1f0c57/logo.png HTTP/1.1" 304 0
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/23455bf9/decimal.js HTTP/1.1" 200 31873 "
[27/Aug/2019:18:06:41 +0000] "GET /lime/tmp/assets/7ebe61a5/font-src/Noto/NotoSans-Regular.ttf HTTP/1.1" ...

**** this is strange, but also happen on Chrome, so I dunno
[27/Aug/2019:18:06:41 +0000] "GET /lime/index.php/366148?token=275wwqfg9bduj&lang=pt-BR&newtest=Y HTTP/1.1" 200 4786 "https://same.domain.com/lime/index.php/366148?token=275wwqfg9bduj&lang=pt-BR&newtest=Y" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"

try to submit for the first time, get error
[27/Aug/2019:18:06:46 +0000] "POST /lime/index.php/366148?1566929206044 HTTP/1.1" 200 4880 "https://same.domain.com/lime/index.php/366148?token=275__wwqfg9bduj&lang=pt-BR&newtest=Y" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
[27/Aug/2019:18:06:46 +0000] "GET /lime/tmp/assets/7ebe61a5/font-src/Noto/NotoSans-Bold.ttf HTTP/1.1" 304 0 "https://same.domain.com/lime/index.php/366148?token=275__wwqfg9bduj&lang=pt-BR&newtest=Y" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"

try to submit again, now it works:
[27/Aug/2019:18:06:53 +0000] "POST /lime/index.php/366148?1566929212832 HTTP/1.1" 302 12367 "https://same.domain.com/lime/index.php/366148" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"

survey has a redirect it after completion enabled, so back to my website
[27/Aug/2019:18:06:53 +0000] "GET /serviceworker.js?mtime=1562966440 HTTP/1.1" 304 0 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
[27/Aug/2019:18:06:53 +0000] "GET /api/user/me?include_survey=1&api_key=JWT "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"

-- doing the same using Google Chrome:

my javascript pull the pending surveys:
[27/Aug/2019:18:28:23 +0000] "GET /api/user/me?include_survey=1&api_key=JWT HTTP/1.1" 200 2069 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.123 Mobile/15E148 Safari/605.1" "-"
javascript asks for the URL for awnsering a survey:
[27/Aug/2019:18:28:24 +0000] "POST /api/user/get-survey-token?user_survey_id=3014&api_key=JWT&id=0 HTTP/1.1" 200 112 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.123 Mobile/15E148 Safari/605.1" "-"
browser redirect it to the survey URL:
[27/Aug/2019:18:28:25 +0000] "GET /lime/index.php/366148?token=239yal5zftxmw&lang=pt-BR&newtest=Y HTTP/1.1" 200 4787 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.123 Mobile/15E148 Safari/605.1" "-"
fewer css, but okay? it was a reload, so a few 304
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/803f194a/css/animate.css
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/803f194a/css/variations/sea_green.css HTTP/1.1"
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/803f194a/css/theme.css
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/cced2354/scripts/custom.js
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/803f194a/css/custom.css
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/5a1f0c57/logo.png HTTP/1.1"
[27/Aug/2019:18:28:25 +0000] "GET /lime/tmp/assets/7ebe61a5/font-src/Noto/NotoSans-Regular.ttf
still another GET, the same size of the first and second request of Safari (but differs from the initial request from Chrome)
[27/Aug/2019:18:28:26 +0000] "GET /lime/index.php/366148?token=239
yal5zftxmw&lang=pt-BR&newtest=Y HTTP/1.1" 200 4786 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.123 Mobile/15E148 Safari/605.1" "-"
try to submit
[27/Aug/2019:18:28:28 +0000] "POST /lime/index.php/366148?1566930508306 HTTP/1.1" 302 12359 "https://same.domain.com/lime/index.php/366148?token=239__yal5zftxmw&lang=pt-BR&newtest=Y" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.123 Mobile/15E148 Safari/605.1" "-"
sucessed submit, redirect to javascript again: (sees that chrome aggresive caching does not download again /questionarios, maybe some magic of the serviceworker, but that not relevant here)
[27/Aug/2019:18:28:28 +0000] "GET /api/user/me?include_survey=1&api_key=JWT HTTP/1.1" 200 2100 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.123 Mobile/15E148 Safari/605.1" "-"

TagsNo tags attached.
Attached Files
Bug heat6
Complete LimeSurvey version number (& build)Version 3.17.13+190824
I will donate to the project if issue is resolvedNo
BrowserSafari
Database type & versionPostgresql 10.6
Server OS (if known)Linux docker php
Webserver software & version (if known)apache/php7
PHP Version7.2

Relationships

duplicate of 15212 closedc_schmitz Survey navigation no longer works 

Users monitoring this issue

There are no users monitoring this issue.

Activities

renatocron

renatocron

2019-08-28 00:17

reporter   ~53313

So, I tested on all those versions:
3.15.6+190108 (cited as working on the post)
limesurvey-src-3.16.0 OK
limesurvey-src-3.16.1 OK
limesurvey-src-3.16.5 OK
limesurvey-src-3.17.0 OK
limesurvey-src-3.17.2 OK
limesurvey-src-3.17.3 OK
limesurvey-src-3.17.4 OK
limesurvey-src-3.17.6 OK
limesurvey-src-3.17.7 OK
limesurvey-src-3.17.9 OK

And then I upgraded to 3.17.10+190821.tar.gz and then, the bug lives!

Changes from 3.17.9 (build 190731) to 3.17.10 (build 190821) August 21, 2019
-New translation: Uyghur kindly provided by Namsiz Adam (Carsten Schmitz)
-Fixed issue: cannot save questions anymore (lacrioque)
-Fixed issue: Tagalog translation not available (Carsten Schmitz)
-Fixed issue: Panel integration 500 error (lacrioque)
-Fixed issue [security]: XSS with contructor statements in textedit (lacrioque)
-Fixed issue [security]: Check both mime type and file extension when validating image (Olle Haerstedt) kindly reported by PAVOL MICHALEC/FREDERIK KOĽBÍK from ESET
( https://www.eset.sk )
-Fixed issue [security]: #15137: XSS when use Predefined label sets (Denis Chenu) Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/ (Denis Chenu)
-Fixed issue [security]: #15094 XSS in label title (Denis Chenu) Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/ (Denis Chenu)
-Fixed issue [security]: #15094 XSS in Boxes (thanks to Michele Cisternino) (Denis Chenu)
-Fixed issue 14921: Ranking question on mobile devices (problem with dragging/scrolling) (Markus Flür)
-Fixed issue 14908: The Button "exit and clear survey entrys" should not be on the last page (endmessage) (Patrick Teichmann)
-Fixed issue 14443: "Go to survey" menu icon not working in collapsed menu mode (lacrioque)

I will try manually revert the "cannot save questions anymore" commit to see if the issue is gone (also, "exit and clear survey entrys" is visible at the last page still)

renatocron

renatocron

2019-08-28 00:41

reporter   ~53314

3.17.9 is working (I checked my backup did eailer today, and I was running 3.7.10 on production, not 3.17.9 as cited on the first post, I must have been confused by the release notes and copied the "from" instead of "To")

For now, I will use 3.17.9 as it schema is compatible with 3.7.10 and show no errors (but right now I'm testing on Safari on MacOS because I don't have an iphone to test, I was using one of my coworker).

Also, never mind my comment on "exit and clear survey entrys" as it is only on the "endmessage" page !

"cannot save questions anymore" has nothing to do with the issue, it's on the admin.

DenisChenu

DenisChenu

2019-08-28 08:30

developer   ~53316

Maybe something related to security ?

To have the «Please use the LimeSurvey navigation buttons or index. …» alert : checking if $_SESSION['LEMpostKey'] == $_POST['LEMpostKey'] . This LEMpostKey is update at each page.

Can you check disabling a lot of security in Safari (if it's possible) ?

We must fix in all condition, but sometimes it's more a browser issue (case of Samsung : clearly a browser issue …)

c_schmitz

c_schmitz

2019-08-28 10:36

administrator   ~53320

Last edited: 2019-08-28 10:37

I can see two calls to get the starting page:

GET /lime/index.php/366148?token=275__wwqfg9bduj&lang=pt-BR&newtest=Y HTTP/1.1" 200 4786 "https://same.domain.com/questionarios/?responder-proxima=1" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1" "-"
a bunch of javascript and css:

**** this is strange, but also happen on Chrome, so I dunno
[27/Aug/2019:18:06:41 +0000] "GET /lime/index.php/366148?token=275wwqfg9bduj&lang=pt-BR&newtest=Y HTTP/1.1" 200 4786 "https://same.domain.com/lime/index.php/366148?token=275wwqfg9bduj&l

That is the reason, because every call with 'newtest=Y' will create a new session and the old CRSF token will not be valid anymore.
Question is what sends the second call.

DenisChenu

DenisChenu

2019-08-28 11:36

developer   ~53324

@c_schmitz : strangely it's not an issue with CRSF here :) only with LEMpostKey

renatocron

renatocron

2019-08-28 14:06

reporter   ~53328

Hello!

I captured that log when running with Aajax =Y on setup. That second request does not happen when disabled (but the message issue keep nevertheless)

I found this checkIfUseBrowserNav() on application/helpers/SurveyRuntimeHelper.php, between current master (973959b0566) and 3.17.7 it's running the same code.

Know know this, I changed the error message to include what differs from what.

When the first page load, I got LEMpostKey=382532362,
when submitting, I got:

"Please use the survey navigation buttons or index. It appears you attempted to use the browser back button to re-submit a page. 382532362 != 107537746"

And this page (with the popup) also had the same LEMpostKey=382532362 input value, and the post succeeded.

I need find a way to log everytime LEMpostKey get set, because maybe it's not only on function run() line 431 (setting to mt_rand())

renatocron

renatocron

2019-08-28 14:10

reporter   ~53329

Fun little note:

If I reuse the token, even if after using others, it does not show the message (same browser session):

update lime_tokens_366148 set completed='N', token='111_metataro', usesleft='1';

show the message
update lime_tokens_366148 set completed='N', token='111_metatarometa', usesleft='1';
(others different tokens used 4 more times, always show the message)

update lime_tokens_366148 set completed='N', token='111_metataro', usesleft='1';

message not show

c_schmitz

c_schmitz

2019-08-30 19:47

administrator   ~53369

Please check out https://bugs.limesurvey.org/view.php?id=15212 for a quick solution.

renatocron

renatocron

2019-08-30 20:11

reporter   ~53370

Thank you, I will apply and test it, but only on Tuesday , now I'm without any MacOS/Iphone

Issue History

Date Modified Username Field Change
2019-08-27 23:10 renatocron New Issue
2019-08-27 23:10 renatocron File Added: limesurvey_survey_366148.lss
2019-08-28 00:17 renatocron Note Added: 53313
2019-08-28 00:41 renatocron Note Added: 53314
2019-08-28 08:30 DenisChenu Note Added: 53316
2019-08-28 10:36 c_schmitz Note Added: 53320
2019-08-28 10:37 c_schmitz Note Edited: 53320
2019-08-28 11:36 DenisChenu Note Added: 53324
2019-08-28 14:06 renatocron Note Added: 53328
2019-08-28 14:10 renatocron Note Added: 53329
2019-08-30 19:46 c_schmitz Relationship added duplicate of 15212
2019-08-30 19:46 c_schmitz Assigned To => c_schmitz
2019-08-30 19:46 c_schmitz Status new => closed
2019-08-30 19:46 c_schmitz Resolution open => duplicate
2019-08-30 19:46 c_schmitz Fixed in Version => 3.17.x
2019-08-30 19:47 c_schmitz Note Added: 53369
2019-08-30 20:11 renatocron Note Added: 53370