| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 19140 | Bug reports | Usability/user experience | public | 2023-09-29 21:07 | 2023-10-30 10:54 |
| Reporter | baltzis | Assigned To | mfavetti | ||
| Priority | none | Severity | partial_block | ||
| Status | closed | Resolution | fixed | ||
| Product Version | 6.2.x | ||||
| Summary | 19140: Problem with viewing LimeSurvey notifications | ||||
| Description | Strangely, LimeSurvey notifications, which can be accessed via the bell icon in the top right corner of the menu, work normally and appear in a form on the screen in one installation but not in another. On the other installation, I click on the notification to display it, but nothing happens (image 01), even though everything else seems to work fine. Also, in the problematic case, notifications are not deleted no matter how many times I press "Delete". They still show up as unread, but I cannot read them. Some info about these installations: B. The "problematic" one | ||||
| Steps To Reproduce | Steps to reproduce
Expected resultA form appears with the full text of the notification. Actual resultNothing happens. The user cannot see the full text of the notification | ||||
| Tags | No tags attached. | ||||
| Bug heat | 8 | ||||
| Complete LimeSurvey version number (& build) | Community Edition Version 6.2.9+230925 | ||||
| I will donate to the project if issue is resolved | No | ||||
| Browser | Chrome, Firefox, Microsoft Edge | ||||
| Database type & version | mysql, Database driver version: mysqlnd 8.1.2-1ubuntu2.14 | ||||
| Server OS (if known) | Linux 5.15.0-76-generic #83-Ubuntu SMP | ||||
| Webserver software & version (if known) | Apache/2.4.52 (Ubuntu) | ||||
| PHP Version | 8.1.2-1ubuntu2.14 | ||||
 |
Reproduced. This is also caused by the change in PHP 8.1 of returning int/float for numbers from database instead of string. In the permissions check, the application casts the user id to string (presumably to compare with the string returned from db) but now its comparing int to string instead of string to string and it uses a strict equality check. So even if the user id is correct, it will always raise the 403 exception. We don't want to break compat with 8.0 I imagine, so we can't just drop the cast to string. Could explicitly cast both to int. It seems like the codebase needs to be audited for effects of this change in PHP 8.1. Affects 5.x and 6.x on PHP >= 8.1 |
|
|
PR for 5: https://github.com/LimeSurvey/LimeSurvey/pull/3537 |
|
|
Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=35656 |
|
|
Fix committed to 5.x branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=35657 |
|
|
Fixed in Release 5.6.43+231030 |
