View Issue Details

This issue affects 1 person(s).
 2
IDProjectCategoryView StatusLast Update
20553Bug reportsSurvey takingpublic2026-06-06 19:07
ReporterMazi Assigned To 
PrioritynoneSeverityblock 
Status newResolutionopen 
Product Version6.17.x 
Summary20553: 500 server error when survey is accessed directly via movesubmit parameter under PHP 8.x
Description

When a survey is called directly with move=movesubmit in the URL (without going through the normal survey start flow), the session is never fully initialized. As a result, $_SESSION[$this->LEMsessid]['insertarray'] is null when setArgs() is called during the submit process.
Under PHP 7.4, in_array() accepted null as the second argument silently. Under PHP 8.x, this throws a fatal TypeError, causing a 500 Internal Server Error.
This affects installations where surveys are triggered externally via direct submit URLs, for example:
/index.php/survey/index?move=movesubmit&thisstep=0&sid=999991&token={TOKEN}&lang=en

This is a common use case in panel research workflows where respondents are redirected directly to a completion/screenout/quota-full survey without going through the normal survey navigation.

Root Cause:
In application/helpers/SurveyRuntimeHelper.php, line 692, $_SESSION[$this->LEMsessid]['insertarray'] is accessed without checking whether it is set:
php// Current code (line 692):
if ($this->LEMsessid && !in_array("refurl", $_SESSION[$this->LEMsessid]['insertarray'])) {
When the session has not been initialized through the normal survey flow, insertarray is null, causing the fatal error under PHP 8.x.

Proposed Fix:
Add an isset check before the in_array call:
phpif ($this->LEMsessid
&& isset($_SESSION[$this->LEMsessid]['insertarray'])
&& !in_array("refurl", $_SESSION[$this->LEMsessid]['insertarray'])) {
This is a minimal, non-breaking fix that makes the behavior consistent with how PHP 7.4 handled the same situation silently.

Steps To Reproduce

Steps to reproduce

Create a survey with "Save referrer URL" (refurl) set to Y in survey settings
Activate the survey and generate a token
Call the survey directly with move=movesubmit in the URL:
/index.php/survey/index?move=movesubmit&thisstep=0&sid={SID}&token={TOKEN}
Observe the 500 error under PHP 8.x

Expected result

Survey submit completes successfully, session missing keys are handled gracefully.

Actual result

500: Internal Server Error
in_array(): Argument #2 ($haystack) must be of type array, null given
/application/helpers/SurveyRuntimeHelper.php(692)

TagsNo tags attached.
Bug heat2
Complete LimeSurvey version number (& build)6.17.4
I will donate to the project if issue is resolvedNo
Browser
Database type & versionMySQL 5
Server OS (if known)
Webserver software & version (if known)
PHP VersionPHP 8.3

Users monitoring this issue

There are no users monitoring this issue.

Activities

Mazi

Mazi

2026-06-06 19:07

updater   ~85004

@DenisChenu, can you comment on this minor "adding isset() check" adjustment?!
@tibor.pacalat: It should do no harm so I'd appreciate if this could get added to the next release.

Issue History

Date Modified Username Field Change
2026-06-06 18:52 Mazi New Issue
2026-06-06 19:07 Mazi Note Added: 85004
2026-06-06 19:07 Mazi Bug heat 0 => 2