View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 20553 | Bug reports | Survey taking | public | 2026-06-06 18:52 | 2026-06-10 18:41 |
| Reporter | Mazi | Assigned To | |||
| Priority | none | Severity | block | ||
| Status | new | Resolution | open | ||
| Product Version | 6.17.x | ||||
| Summary | 20553: 500 server error when survey is accessed directly via movesubmit parameter under PHP 8.x | ||||
| Description | When a survey is called directly with move=movesubmit in the URL (without going through the normal survey start flow), the session is never fully initialized. As a result, $_SESSION[$this->LEMsessid]['insertarray'] is null when setArgs() is called during the submit process. This is a common use case in panel research workflows where respondents are redirected directly to a completion/screenout/quota-full survey without going through the normal survey navigation. Root Cause: Proposed Fix: | ||||
| Steps To Reproduce | Steps to reproduceCreate a survey with "Save referrer URL" (refurl) set to Y in survey settings Expected resultSurvey submit completes successfully, session missing keys are handled gracefully. Actual result500: Internal Server Error | ||||
| Tags | No tags attached. | ||||
| Bug heat | 8 | ||||
| Complete LimeSurvey version number (& build) | 6.17.4 | ||||
| I will donate to the project if issue is resolved | No | ||||
| Browser | |||||
| Database type & version | MySQL 5 | ||||
| Server OS (if known) | |||||
| Webserver software & version (if known) | |||||
| PHP Version | PHP 8.3 | ||||
|
@DenisChenu, can you comment on this minor "adding isset() check" adjustment?! |
|
|
My opinion here: the move action must come only from the And a isset can always be cool.
|
|
|
@DenisChenu, currently the simple isset() fix will do the trick. |
|
|
Yes but a bug can hide other bug. With isset : you hide the error :) Maybe we need to fix why we came here before :) |
|
|
I agree that params should only be read from POST. The mentioned usage should not be allowed. |
|
|
@c_schmitz, changing that behavior will cause a regression for several users. |
|
|
Because it should never be possible to write/modify data by a simple GET. That is basic security. |
|
+1 have a step=3 if survey as full index can be great. But without updating anything in DB :) |
|
If I don't make an error, you can already do it without move=submit neither JS. |
|
|
@DenisChenu, how would you set this up instead? |
|
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-06-06 18:52 | Mazi | New Issue | |
| 2026-06-06 19:07 | Mazi | Note Added: 85004 | |
| 2026-06-06 19:07 | Mazi | Bug heat | 0 => 2 |
| 2026-06-08 08:59 | DenisChenu | Note Added: 85006 | |
| 2026-06-08 08:59 | DenisChenu | Bug heat | 2 => 4 |
| 2026-06-08 08:59 | DenisChenu | Issue Monitored: DenisChenu | |
| 2026-06-08 08:59 | DenisChenu | Bug heat | 4 => 6 |
| 2026-06-08 09:53 | Mazi | Note Added: 85008 | |
| 2026-06-08 09:56 | DenisChenu | Note Added: 85009 | |
| 2026-06-09 13:28 | c_schmitz | Note Added: 85014 | |
| 2026-06-09 13:28 | c_schmitz | Bug heat | 6 => 8 |
| 2026-06-09 14:21 | Mazi | Note Added: 85016 | |
| 2026-06-09 15:26 | c_schmitz | Note Added: 85017 | |
| 2026-06-09 17:04 | DenisChenu | Note Added: 85019 | |
| 2026-06-09 17:05 | DenisChenu | Note Added: 85020 | |
| 2026-06-10 18:41 | Mazi | Note Added: 85025 |