View Issue Details

This issue affects 1 person(s).
 6
IDProjectCategoryView StatusLast Update
19851Bug reportsUsability/user experiencepublic2026-11-01 00:49
ReporterDenisChenu Assigned Toc_schmitz  
PrioritynoneSeverityminor 
Status resolvedResolutionfixed 
Product Version6.6.x 
Summary19851: When not loggued : update some form didn't show 401 or redirect to login
Description

When you submit some form you get an infinite loop … and you can wait until die ;)

Steps To Reproduce

Steps to reproduce

Login
Go to a question
Open a new tab
Un login in this new tab
Go back to question
Click edit
Click save

Expected result

Show a 401 : must be loggued error
OR
redirect to question view

Actual result

Infinite loop

TagsNo tags attached.
Attached Files
Bug heat6
Complete LimeSurvey version number (& build)6.8.1
I will donate to the project if issue is resolvedNo
Browserfirefox
Database type & versionnot relevant
Server OS (if known)not relevant
Webserver software & version (if known)not relevant
PHP Versionnot relevant
Git branch / Pull Request URLN/A

Users monitoring this issue

There are no users monitoring this issue.

Activities

DenisChenu

DenisChenu

2024-11-22 14:48

developer   ~81499

The response are a redirect

XHRGET
http://webdev.local/master/index.php?r=questionAdministration/checkQuestionValidateTitle&sid=435438&qid=2445&code=Q00Copy
[HTTP/1.1 302 Found 6ms]

GET
    http://webdev.local/master/index.php?r=questionAdministration/checkQuestionValidateTitle&sid=435438&qid=2445&code=Q00Copy
État
302
Found
VersionHTTP/1.1
Transfert7,29 Ko (taille 19,06 Ko)
Politique de référentstrict-origin-when-cross-origin
Priorité de la requêteHighest
Résolution DNSSystème

    HTTP/1.1 302 Found

    Server: nginx/1.22.1

    Date: Fri, 22 Nov 2024 13:47:22 GMT

    Content-Type: text/html; charset=UTF-8

    Transfer-Encoding: chunked

    Connection: keep-alive

    Expires: Thu, 19 Nov 1981 08:52:00 GMT

    Cache-Control: no-store, no-cache, must-revalidate

    Pragma: no-cache

    Location: http://webdev.local/master/index.php?r=admin/authentication/sa/login

    Accept
        */*
    Accept-Encoding
        gzip, deflate
    Accept-Language
        fr-FR,fr;q=0.8,en-US;q=0.5,en;q=0.3
    Cache-Control
        no-cache
    Connection
        keep-alive
    Cookie
        KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off; LS-QNDSYJGSASALCMYHZSKI=9qpskl98u8uiivaq5s5vfbp3sq; LS-NWVZOXQEDGKTPJFB=bmjck64jfav00skfg48o0mtg8q; YII_CSRF_TOKEN=eVBINk5zUVVubDdlSlZselk2ZHY0ZVVKSzRvTVNafmMRUzXi1FZGaXUkTe3r6g1CBANkAhIPX1zOlaYgQOGRpg%3D%3D
    DNT
        1
    Host
        webdev.local
    Pragma
        no-cache
    Priority
        u=0
    Referer
        http://webdev.local/master/index.php?r=questionAdministration/view&surveyid=435438&gid=265&qid=2445
    Sec-GPC
        1
    User-Agent
        Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
    X-Requested-With
        XMLHttpRequest
image.png (136,201 bytes)
Mazi

Mazi

2024-11-25 20:39

updater   ~81510

@DenisChenu, can you take this one?

DenisChenu

DenisChenu

2024-11-26 08:52

developer   ~81511

@tibor.pacalat , @c_schmitz : the solution : send a 400 error if it's a POST request is OK (and it's not a login request) ?

Mazi

Mazi

2025-01-06 12:49

updater   ~81737

@DenisChenu, if I get this right it is just a bad user experience (infinite loop) but nothing critical or security related?

DenisChenu

DenisChenu

2025-01-06 16:32

developer   ~81741

@Mazi : yes bad user experience. Nothing critical, no real issue.

DenisChenu

DenisChenu

2025-09-25 17:15

developer   ~83484

More complex to find where is done than I think here …

c_schmitz

c_schmitz

2026-11-01 00:49

administrator   ~87063

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=41212

Related Changesets

LimeSurvey: master cfd53ad3

2026-11-01 00:47

c_schmitz


Details Diff
Fixed issue 19851: After being logged out (e.g. in another tab), saving a question and other admin actions silently did nothing instead of asking to log in again
Dev LSBaseController now answers all XHR requests of a logged-out user (not only ?ajax=1) with HTTP 401 and the not-logged-in JSON, like AdminController already did
Dev New adminbasics ajaxError handler shows a "You have been logged out" modal with a "Log in" link that returns to the current page
Dev It replaces the old ajax login form modal, which never worked: Its import failed on case-sensitive file systems, and its login was rejected by the CSRF check
Dev CLSGridView and the question editor no longer show their raw error alerts on HTTP 401
Affected Issues
19851
mod - application/controllers/LSBaseController.php Diff File
mod - application/extensions/admin/grid/CLSGridView.php Diff File
mod - application/helpers/admin/ajax_helper.php Diff File
add - application/views/admin/authentication/ajaxLoggedOut.php Diff File
rm - application/views/admin/authentication/ajaxLogin.php Diff
mod - assets/packages/adminbasics/build/adminbasics.js Diff File
mod - assets/packages/adminbasics/build/adminbasics.min.js Diff File
mod - assets/packages/adminbasics/src/adminbasicsmain.js Diff File
mod - assets/packages/adminbasics/src/parts/ajaxHelper.js Diff File
mod - assets/scripts/admin/questionEditor.js Diff File

Issue History

Date Modified Username Field Change
2024-11-22 14:46 DenisChenu New Issue
2024-11-22 14:46 DenisChenu File Added: Capture vidéo du 2024-11-22 14-42-35.webm
2024-11-22 14:48 DenisChenu Note Added: 81499
2024-11-22 14:48 DenisChenu File Added: image.png
2024-11-22 14:48 DenisChenu Bug heat 0 => 2
2024-11-25 20:39 Mazi Note Added: 81510
2024-11-25 20:39 Mazi Bug heat 2 => 4
2024-11-26 08:52 DenisChenu Note Added: 81511
2025-01-06 12:49 Mazi Note Added: 81737
2025-01-06 16:32 DenisChenu Note Added: 81741
2025-01-06 16:32 DenisChenu Assigned To => DenisChenu
2025-01-06 16:32 DenisChenu Status new => assigned
2025-09-25 17:15 DenisChenu Note Added: 83484
2026-11-01 00:49 c_schmitz Changeset attached => LimeSurvey master cfd53ad3
2026-11-01 00:49 c_schmitz Note Added: 87063
2026-11-01 00:49 c_schmitz Assigned To DenisChenu => c_schmitz
2026-11-01 00:49 c_schmitz Status assigned => resolved
2026-11-01 00:49 c_schmitz Resolution open => fixed
2026-11-01 00:49 c_schmitz Bug heat 4 => 6