View Issue Details

Related ChangesetsJump to NotesJump to History
This issue affects 2 person(s).
 14
IDProjectCategoryView StatusDate SubmittedLast Update
19563Bug reportsSurvey editingpublic2024-05-13 15:482026-10-26 22:56
Reporterritapas Assigned Toc_schmitz  
PrioritynoneSeverityminor 
Status resolvedResolutionfixed 
Product Version6.5.x 
Summary19563: HTML entity & is shown as & in subquestions when XSS is enabled
Description

if you design a subquestion with entity & in subquestions when XSS is enabled, it is shown as &

Steps To Reproduce

Steps to reproduce

enable xss
create a survey with a question with subquestions e.g List(dropdown)
use the "&" character in the subquestions, either as:
& simply put
& in source code display
insert special character icon

Expected result

"&" is shown

Actual result

"&" is shown
(Write here what happened instead)

TagsNo tags attached.
Attached Files
0.edit1stSubq.PNG (7,292 bytes)   
0.edit1stSubq.PNG (7,292 bytes)   
1.edit3rdSubq.PNG (18,103 bytes)   
1.edit3rdSubq.PNG (18,103 bytes)   
2.allSubqst.PNG (21,057 bytes)   
2.allSubqst.PNG (21,057 bytes)   
3.preview.PNG (30,970 bytes)   
3.preview.PNG (30,970 bytes)   
Bug heat14
Complete LimeSurvey version number (& build)6.5.4 (build 240422)
I will donate to the project if issue is resolvedNo
Browser
Database type & versionDatabase driver pgsql Database driver version 13.5
Server OS (if known)
Webserver software & version (if known)
PHP VersionPHP version 7.4.33
Git branch / Pull Request URL

Users monitoring this issue

ritapas, seccanj

Activities

ritapas

ritapas

2024-05-14 10:58

reporter   ~80101

This also happens in LS5
c_schmitz

c_schmitz

2026-10-26 22:56

administrator   ~86886

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=41095

Related Changesets

LimeSurvey: master 64a502ad

2026-10-26 22:55

c_schmitz


Details Diff		 Fixed issue 19563: An "&" in dropdown answer options and in input placeholders was shown as "&" when entered with the HTML editor or with the XSS filter enabled
Dev flatString() no longer double-encodes existing HTML entities when encoding (list/array/dual-scale/list-with-comment dropdown options, placeholders)		 Affected Issues
19563
mod - application/core/LS_Twig_Extension.php Diff File
add - tests/unit/LSTwigExtensionFlatStringTest.php Diff File

Issue History

Date Modified Username Field Change
2024-05-13 15:48 ritapas New Issue
2024-05-13 15:48 ritapas File Added: 0.edit1stSubq.PNG
2024-05-13 15:48 ritapas File Added: 1.edit3rdSubq.PNG
2024-05-13 15:48 ritapas File Added: 2.allSubqst.PNG
2024-05-13 15:48 ritapas File Added: 3.preview.PNG
2024-05-14 10:38 ritapas Issue Monitored: ritapas
2024-05-14 10:38 ritapas Bug heat 0 => 2
2024-05-14 10:58 ritapas Note Added: 80101
2024-05-14 10:58 ritapas Bug heat 2 => 4
2024-05-14 11:00 seccanj Issue Monitored: seccanj
2024-05-14 11:00 seccanj Bug heat 4 => 12
2026-10-26 22:56 c_schmitz Changeset attached => LimeSurvey master 64a502ad
2026-10-26 22:56 c_schmitz Note Added: 86886
2026-10-26 22:56 c_schmitz Assigned To => c_schmitz
2026-10-26 22:56 c_schmitz Status new => resolved
2026-10-26 22:56 c_schmitz Resolution open => fixed
2026-10-26 22:56 c_schmitz Bug heat 12 => 14