View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 20852 | Bug reports | Assets | public | 2026-11-11 19:02 | 2026-11-11 19:03 |
| Reporter | lenorcy | Assigned To | |||
| Priority | none | Severity | minor | ||
| Status | new | Resolution | open | ||
| Product Version | 7.9.x | ||||
| Summary | 20852: ColumnFilterWidget loads CSS and JS directly from protected application directory (Apache AH01797) | ||||
| Description | Environment: LimeSurvey Community Edition 7.10.0 Description: When accessing the survey administration list, Apache logs an access denied error: AH01797: client denied by server configuration: /var/www/limesurvey/application/extensions/admin/grid/ColumnFilterWidget/assets/columns_organize.js The same issue affects the corresponding CSS file. The application/ directory contains an .htaccess file explicitly denying direct HTTP access (Require all denied). This protection appears intentional and should not need to be removed. In application/extensions/admin/grid/ColumnFilterWidget/ColumnFilterWidget.php, the registerClientScript() method loads columns_organize.js and columns_organize.css directly using extensionsurl. However, columns_filter.js in the same widget is loaded using App()->getAssetManager()->publish(). Using AssetManager::publish() for both columns_organize.js and columns_organize.css resolves the Apache error. The published files are then correctly available under tmp/assets/. This suggests that the organization CSS and JS files should also be published through the asset manager instead of being served directly from the protected application/ directory. I would be happy to submit a pull request with this fix if the proposed solution is considered appropriate by the maintainers. | ||||
| Steps To Reproduce |
Actual result: Apache logs an AH01797 access denied error when the browser attempts to load:
Expected result: The CSS and JS assets should be published through the asset manager and served from the public assets directory, without requiring direct access to the protected Workaround: Replace the direct | ||||
| Tags | No tags attached. | ||||
| Attached Files | limesurvey-AH01797.txt (821 bytes)
timestamp=2026-11-11 18:01:37.114931Z host=vm-limesurvey-dev26.mondomaine.fr module=access_compat level=error log_id=x7rjJaPAhq0 process=24736 thread=- srcfile=mod_access_compat.c(350)client=WW.XX.YY.ZZ:33876 code=- application=limesurvey instance=dev26 message=AH01797: client denied by server configuration: /var/www/limesurvey/application/extensions/admin/grid/ColumnFilterWidget/assets/columns_organize.css timestamp=2026-11-11 18:01:37.124451Z host=vm-limesurvey-dev26.mondomaine.fr module=access_compat level=error log_id=4eLjJaPDhq0 process=24739 thread=- srcfile=mod_access_compat.c(350)client=WW.XX.YY.ZZ:33886 code=- application=limesurvey instance=dev26 message=AH01797: client denied by server configuration: /var/www/limesurvey/application/extensions/admin/grid/ColumnFilterWidget/assets/columns_organize.js | ||||
| Bug heat | 2 | ||||
| Complete LimeSurvey version number (& build) | 7.10.0 (also 7.9.0) | ||||
| I will donate to the project if issue is resolved | No | ||||
| Browser | |||||
| Database type & version | 11.8.6-MariaDB | ||||
| Server OS (if known) | Debian 13 | ||||
| Webserver software & version (if known) | Apache 2.4 | ||||
| PHP Version | 8.3 | ||||
| Git branch / Pull Request URL | |||||
