View Issue Details
|ID||Project||Category||View Status||Date Submitted||Last Update|
|16330||Bug reports||Encryption||public||2020-05-25 14:55||2021-01-13 08:49|
|Fixed in Version||4.4.0-RC2|
|Summary||16330: Encrypted fields not decrypted correctly when viewing responses using web UI or when exported to .lsa|
Survey includes one question where encryption has been specified (a multiple short text question requesting Firstname, Lastname).
The security.php file has not been changed during the currency of this survey.
|Steps To Reproduce|
1) Import and activate attached survey, which has 16 questions in 4 groups.
1) A simple test survey with one encrypted question of the same type (no other questions in survey) does NOT reproduce the problem - the fields in the question are decrypted correctly.
2) I don't think this is relevant, but "for info" the survey exhibiting the bug, and also the simple test survey noted here, have been moved between LimeSurvey instances - behaviour is the same for each survey regardless of server (other server is on 4.2.3)
|Tags||No tags attached.|
|Complete LimeSurvey version number (& build)||4.2.4+200520|
|I will donate to the project if issue is resolved||No|
|Sync to Zoho Project||Yes|
|Database & DB-Version||MariaDB 10.3.23|
|Server OS (if known)||linux|
|Webserver software & version (if known)||LiteSpeed|
|related to||15669||closed||cdorin||Crypted data are not exported uncrypted|
|related to||15668||closed||cdorin||Crypted data are not shown uncrypted|
|related to||15670||confirmed||Reloading response via token : crypted data|
|related to||16971||new||Unable to use of TOKEN attribute encrypted during survey (expression manager)|
limesurvey_survey_597794.lss (159,608 bytes)
About LSA export : i think it's great if we have a "LSA decrypted" export, then user can choose if done for backup for same server then can be crypted. Or not.
The worst one are Reloading response via token : crypted data
? Are you sure ?
Try to import included lsa : i think it broke with a 500 error (Wrong decryption key! Decryption key has changed since this data were last saved, so data can't be decrypted. Please consult our manual at https://manual.limesurvey.org/Data_encryption#Errors.)
survey_archive_crypted.lsa (5,493 bytes)
Hi - I think I may have diverted attention away from my main issue here by talking about exporting / importing survey archives with encrypted fields.
I did import your test survey and that had an error as expected when I tried to display a response:
This is my issue:
[G01Q07_SQ01] (First name) Ys1jwmKfS1+rYB274j2gO06GPrYdL...
(I've shortened the strings above). No error is shown but the decryption is incorrect (the above strings are different from the DB fields for those questions)
I can confirm i have encrypted field in browse response.
The strange part : « though the simple one-question survey with encryption DOES work.» : you mean a survey with only ONE question (encrypoted) ?
Because a survey with 2 question : one crypted + on not crypted show (and export) only crypted data.
OK : database are not the same, but export as LSA, import as LSA : work and show same data.
Capture d’écran du 2020-05-26 11-51-21.png (16,884 bytes)
Capture d’écran du 2020-05-26 11-51-21.png (16,884 bytes)
Yes that seems to replicate what I'm seeing - both web UI and exported LSA are showing the same data (WRONGLY decrypted version of the DB contents).
Re your previous note - I have made two test surveys - one with only one question that was encrypted, the second survey with two questions, one of which was encrypted. BOTH behaved as expected with the DB fields being encrypted, but shown correctly in the Web UI and being exported unencrypted (as in the attached LSA for the two-question survey).
survey_archive_971865-2.lsa (4,641 bytes)
It's not really wrongly encryted since we can export as lsa and import (in same instance) without issue.
If there are a bad system here : we can not do it :)
Yes I understand what you are saying, the decryption on the 'bad' surveys / fields isn't showing an error so must the actual decryption must be happening correctly, but if so, then the correct plaintext string resulting from that decryption isn't being shown in the UI or the LSA. I have checked to see if a small sub-string of what is displayed in the UI / LSA field is present in the encrypted DB field, and it isn't. So I'm not sure where the output shown in UI / LSA is coming from.
To follow with more examples - I have a short survey done on Version 4.3.3+200707. An export is attached.
You can create multiple questions of different types and some will be correct and others are not.
limesurvey_survey_274463.lss (34,760 bytes)
email.txt (1,201 bytes)
Email that gets sent to admin - encryted fields are "hidden" Hello, A new response was submitted for your survey 'testing'. Click the following link to see the individual response: https://guernseyresearch.com/survey/index.php/admin/responses/sa/view/surveyid/274463/id/11 Click the following link to edit the individual response: https://guernseyresearch.com/survey/index.php/admin/dataentry/sa/editdata/subaction/edit/surveyid/274463/id/11 View statistics by clicking here: https://guernseyresearch.com/survey/index.php/admin/statistics/sa/index/surveyid/274463 The following answers were given by the participant: Response ID : 11 Date submitted : 01-01-1980 00:00:00 Last page : 3 Start language : en Seed : 1238572615 My first question group <p>What color</p> : Red [AO01] <p>email</p> : aKcreBSO7Gov58aIL6MkyrOn8ECq3BWpSsxBYIyR4i6UBq2DjkXV50+Z7PLLHwihHxXLwCATrHvuE7LzycJiBWQvblMxbUJzZEtVaDE3WktaV2M3TGZ6V1dLRThxM3ZDRWhMZnJQUVBpRTJ0bEp5WmkzNllCeEh5NGxsWkNUaThnTmNNaGVqWmsremFVR0RYZzNGRkRXUmhkbVZBWldVPQ== <p>name</p> : 1su1M7yg9GwdTt2P4mSCWTCYnJIwECbYcWUkX3CLd0y4mNPSI5IF8DhdxODp1KdrXiDilOlWAbPSO7OzBfmtBURhdmU=
email.txt (1,201 bytes)
Response1.jpg (142,187 bytes)
Checked both : seems fixed now (export lsa from one system to another instance)
@GuernseyResearch : i confirm the 2 issue on last master.
Can you report separatly maybe ? @cdorin : need 2 issue or can be fixed here ?
This appears to be fixed in Version 4.4.0-RC3+210112
|2020-05-25 14:55||pns1953||New Issue|
|2020-05-25 14:55||pns1953||File Added: limesurvey_survey_597794.lss|
|2020-05-26 10:04||DenisChenu||Relationship added||related to 15669|
|2020-05-26 10:04||DenisChenu||Relationship added||related to 15668|
|2020-05-26 10:04||DenisChenu||Relationship added||related to 15670|
|2020-05-26 10:06||DenisChenu||Note Added: 58020|
|2020-05-26 10:09||DenisChenu||Note Added: 58021|
|2020-05-26 10:09||DenisChenu||File Added: survey_archive_crypted.lsa|
|2020-05-26 11:42||pns1953||Note Added: 58022|
|2020-05-26 11:49||DenisChenu||Note Added: 58023|
|2020-05-26 11:49||DenisChenu||Note Added: 58024|
|2020-05-26 11:49||DenisChenu||File Added: Capture d’écran du 2020-05-26 11-47-31.png|
|2020-05-26 11:52||DenisChenu||Note Added: 58025|
|2020-05-26 11:52||DenisChenu||File Added: Capture d’écran du 2020-05-26 11-51-21.png|
|2020-05-26 11:52||DenisChenu||File Added: Capture d’écran du 2020-05-26 11-50-34.png|
|2020-05-26 12:02||pns1953||Note Added: 58026|
|2020-05-26 12:02||pns1953||File Added: survey_archive_971865-2.lsa|
|2020-05-26 12:31||DenisChenu||Note Added: 58028|
|2020-05-26 12:59||pns1953||Note Added: 58032|
|2020-05-27 15:36||ollehar||Category||Response browsing => Encryption|
|2020-06-30 18:35||GuernseyResearch||Note Added: 58599|
|2020-07-09 00:58||GuernseyResearch||Note Added: 58817|
|2020-07-09 00:58||GuernseyResearch||File Added: limesurvey_survey_274463.lss|
|2020-07-09 00:58||GuernseyResearch||File Added: email.txt|
|2020-07-09 00:58||GuernseyResearch||File Added: Response1.jpg|
|2020-07-09 00:58||GuernseyResearch||File Added: Response2.jpg|
|2020-07-09 00:58||GuernseyResearch||File Added: Response3.jpg|
|2020-09-16 19:29||DenisChenu||Note Added: 59855|
|2020-10-26 14:51||DenisChenu||Note Added: 60412|
|2020-10-28 18:28||eddylackmann||Sync to Zoho Project||=> Yes|
|2020-10-28 18:45||eddylackmann||Sync to Zoho Project||Yes => Yes|
|2020-10-28 18:49||eddylackmann||Sync to Zoho Project||Yes => Yes|
|2021-01-12 17:30||GuernseyResearch||Note Added: 61502|
|2021-01-12 17:35||ollehar||Assigned To||=> ollehar|
|2021-01-12 17:35||ollehar||Status||new => resolved|
|2021-01-12 17:35||ollehar||Resolution||open => fixed|
|2021-01-12 17:35||ollehar||Fixed in Version||=> 4.4.0-RC2|
|2021-01-12 17:35||ollehar||Note Added: 61503|
|2021-01-13 08:49||DenisChenu||Relationship added||related to 16971|