Merge remote-tracking branch 'upstream/master' into feature-test-merge

.scrutinizer.yml

@@ -1,8 +1,11 @@
 filter:
-    paths: ["application/*"]
+    excluded_paths: [framework/*, locale/*, docs/*, fonts/*, third_party/*, application/third_party/*, images/*, styles/*, styles-public/*, templates/*, themes/*, tmp/*, upload/*]
+    paths: [application/*]
 tools:
     php_code_sniffer:
         config:
             standard: "PSR1"
     php_pdepend:
         command: pdepend
+    php_cs_fixer:
+        config: { level: psr1 }

application/commands/InstallCommand.php

@@ -43,9 +43,6 @@ public function run($sArgument)
                     $sql_file = 'mysql';
                     break;
                 case 'pgsql':
-                    if (version_compare($this->connection->getServerVersion(),'9','>=')) {
-                        $this->connection->createCommand("ALTER DATABASE ". $this->connection->quoteTableName($this->getDBConnectionStringProperty('dbname')) ." SET bytea_output='escape';")->execute();
-                    }
                     $sql_file = 'pgsql';
                     break;
                 case 'dblib': 

application/config/config-defaults.php

@@ -76,11 +76,11 @@
 $config['userideditable']     =  'N';               // Allow editing of user IDs
 $config['defaulttemplate']    =  'default';         // This setting specifys the default theme used for the 'public list' of surveys
 
-$config['allowedtemplateuploads'] = 'gif,ico,jpg,png,css,js';  // File types allowed to be uploaded in the templates section.
+$config['allowedtemplateuploads'] = 'gif,ico,jpg,png,css,js,map,json,eot,svg,ttf,woff,txt,md';  // File types allowed to be uploaded in the templates section.
 
 $config['allowedresourcesuploads'] = '7z,aiff,asf,avi,bmp,csv,doc,docx,fla,flv,gif,gz,gzip,ico,jpeg,jpg,mid,mov,mp3,mp4,mpc,mpeg,mpg,ods,odt,pdf,png,ppt,pxd,qt,ram,rar,rm,rmi,rmvb,rtf,sdc,sitd,swf,sxc,sxw,tar,tgz,tif,tiff,txt,vsd,wav,wma,wmv,xls,xlsx,xml,zip,pstpl,css,js';   // File types allowed to be uploaded in the resources sections, and with the HTML Editor
 
-$config['memory_limit']        =  '32';   // This sets how much memory LimeSurvey can access in megabytes. 32 mb is the minimum recommended - if you are using PDF functions up to 64 mb may be needed
+$config['memory_limit']        =  '128';   // This sets how much memory LimeSurvey can access in megabytes. 128 MB is the minimum recommended - if you are using PDF functions up to 256 MB may be needed
 
 $config['showpopups']         =   1;                // Show popup messages if mandatory or conditional questions have not been answered correctly.
 // 1=Show popup message, 0=Show message on page instead.
@@ -309,6 +309,13 @@
 */
 $config['showrelevance'] =  false;
 
+/**
+* To prevent brute force against forgotten password functionality, there is a random delay
+* that prevent attacker from knowing whether username and email address are valid or not.
+*/
+$config['minforgottenpasswordemaildelay'] =  500000;
+$config['maxforgottenpasswordemaildelay'] =  1500000;
+
 /**
 *  PDF Export Settings
 *  This feature configures PDF export for Export Answers
@@ -334,6 +341,7 @@
     'el'=>'dejavusans',
     'he'=>'freesans',
     'hi'=>'dejavusans',
+    'hr'=>'dejavusans',
     'hu'=>'dejavusans',
     'ja'=>'cid0jp',
     'ko'=>'cid0kr',
@@ -370,22 +378,8 @@
 // If used, the appearance (font size, justification, etc.) may be adjusted by editing td.questionHelpBefore and $helpBeforeBorderBottom of quexml.
 $config['quexmlshowprintablehelp'] = false;
 
-// CAS Settings
-/**
-* Please note that CAS functionality is very basic and you have to modify the client to your needs.
-* At least the hard work is done.
-* The Client is deployed in Limesurvey and a file login_check_cas.php does what login_check.php does in normal mode.
-*
-* $casEnabled determines if CAS should be used or not for Authentication.
-* $casAuthServer the servername of the cas Auth Server. Without http://
-* $casAuthPort CAS Server listening Port
-* $casAuthUri relative uri from $casAuthServer to cas workingdirectory
-*/
-$config['casEnabled'] = false;
-$config['casAuthServer'] = 'localhost';
-$config['casAuthPort'] = 8443;
-$config['casAuthUri'] = '/cas-server/';
-
+$config['minlengthshortimplode'] = 20; // Min length required to use short_implode instead of standard implode
+$config['maxstringlengthshortimplode'] = 100; // short_implode: Max length of returned string
 
 /**
 *  Statistics chart settings

application/config/internal.php

@@ -83,11 +83,11 @@
         'log' => array(
             'class' => 'CLogRouter',
             'routes' => array(
-                'CWebLogRoute' => array( // Use an associative array allow update in config
+                'vardump' => [
                     'class' => 'CWebLogRoute',
                     'levels'=>'error, warning, trace, info',
                     'enabled' => true
-                ),
+                ],
                 'trace' => array(
                     'class'                      => 'CWebLogRoute', // you can include more levels separated by commas... trace is shown on debug only
                     'levels'                     => 'trace',        // you can include more separated by commas
@@ -150,9 +150,11 @@
         'updateServer' => 'http://lsupdate.befound.nl/updates/',
         'bower-asset' => 'components'
     ]
+
 );
 
 
+
 $result = CMap::mergeArray($internalConfig, $userConfig);
 return $result;
 /* End of file internal.php */

application/controllers/InstallerController.php

@@ -231,6 +231,10 @@ public function actionOptional()
                     try {
                         // Save user
                         $user=new User;
+                        // Fix UserID to 1 for MySQL even if installed in master-master configuration scenario
+                        if (in_array($this->connection->getDriverName(), array('mysql', 'mysqli'))) {
+                            $user->uid=1;
+                        }
                         $user->users_name=$sAdminUserName;
                         $user->password=$sPasswordHash;
                         $user->full_name=$sAdminRealName;

application/controllers/OptinController.php

@@ -59,10 +59,11 @@ function actiontokens($surveyid, $token, $langcode = '')
 
         if ($aSurveyInfo == false || !tableExists("{{tokens_{$iSurveyID}}}"))
         {
-            $sMessage = gT('This survey does not seem to exist.');
+            throw new CHttpException(404, "This survey does not seem to exist. It may have been deleted or the link you were given is outdated or incorrect.");
         }
         else
         {
+            LimeExpressionManager::singleton()->loadTokenInformation($iSurveyID,$token,false);
             $oToken = Token::model($iSurveyID)->findByAttributes(array('token' => $token));
 
             if (!isset($oToken))

application/controllers/OptoutController.php

@@ -37,6 +37,7 @@ function actiontokens()
         $sToken=sanitize_token(Yii::app()->request->getQuery('token'));
         Yii::app()->loadHelper('database');
         Yii::app()->loadHelper('sanitize');
+
         if (!$iSurveyID) //IF there is no survey id, redirect back to the default public page
         {
             $this->redirect(array('/'));
@@ -58,15 +59,17 @@ function actiontokens()
         $aSurveyInfo=getSurveyInfo($iSurveyID,$sBaseLanguage);
 
         if ($aSurveyInfo==false || !tableExists("{{tokens_{$iSurveyID}}}")){
-            $sMessage = gT('This survey does not seem to exist.');
+            throw new CHttpException(404, "The survey in which you are trying to participate does not seem to exist. It may have been deleted or the link you were given is outdated or incorrect.");
         }
         else
         {
+            LimeExpressionManager::singleton()->loadTokenInformation($iSurveyID,$sToken,false);
             $oToken = Token::model($iSurveyID)->findByAttributes(array('token'=>$sToken));
 
             if (!isset($oToken))
             {
                 $sMessage = gT('You are not a participant in this survey.');
+                //throw new CHttpException(404, "You are not a participant in this survey.");
             }
             else
             {
@@ -127,11 +130,13 @@ function actionparticipants()
 
         $aSurveyInfo=getSurveyInfo($iSurveyID,$sBaseLanguage);
 
-        if ($aSurveyInfo==false || !tableExists("{{tokens_{$iSurveyID}}}")){
-            $sMessage = gT('This survey does not seem to exist.');
+        if ($aSurveyInfo==false || !tableExists("{{tokens_{$iSurveyID}}}"))
+        {
+            throw new CHttpException(404, "The survey in which you are trying to participate does not seem to exist. It may have been deleted or the link you were given is outdated or incorrect.");
         }
         else
         {
+            LimeExpressionManager::singleton()->loadTokenInformation($iSurveyID,$sToken,false);
             $oToken = Token::model($iSurveyID)->findByAttributes(array('token' => $sToken));
             if (!isset($oToken))
             {

application/controllers/PrintanswersController.php

@@ -117,6 +117,7 @@ function actionView($surveyid,$printableexport=FALSE)
                     if (substr($sFieldname,0,4) == 'gid_')
                     {
                             $sOutput .= "\t<tr class='printanswersgroup'><td colspan='2'>{$fname[0]}</td></tr>\n";
+                            $sOutput .= "\t<tr class='printanswersgroupdesc'><td colspan='2'>{$fname[1]}</td></tr>\n";
                     }
                     elseif ($sFieldname=='submitdate')
                     {
@@ -182,7 +183,7 @@ function actionView($surveyid,$printableexport=FALSE)
                 {
                     if (substr($sFieldname,0,4) == 'gid_')
                     {
-                        $oPDF->addGidAnswer($fname[0]);
+                        $oPDF->addGidAnswer($fname[0], $fname[1]);
                     }
                     elseif ($sFieldname=='submitdate')
                     {

application/controllers/RegisterController.php

@@ -284,7 +284,7 @@ public function sendRegistrationEmail($iSurveyId,$iTokenId){
         {
             $this->sMessage="<div id='wrapper' class='message tokenmessage'>"
                 . "<p>".gT("Thank you for registering to participate in this survey.")."</p>\n"
-                . "<p>".gT("You are registred but an error happen when trying to send the email, please contact the survey administrator.")."</p>\n"
+                . "<p>".gT("You are registered but an error happened when trying to send the email - please contact the survey administrator.")."</p>\n"
                 . "<p>".sprintf(gT("Survey administrator %s (%s)"),$aSurveyInfo['adminname'],$aSurveyInfo['adminemail'])."</p>"
                 . "</div>\n";
         }
@@ -312,11 +312,11 @@ public function getTokenId($iSurveyId)
          {
             if($oToken->usesleft<1 && $aSurveyInfo['alloweditaftercompletion']!='Y')
             {
-                $this->aRegisterErrors[]=gT("The mail address you have entered is already registered an the survey has been completed.");
+                $this->aRegisterErrors[]=gT("The email address you have entered is already registered and the survey has been completed.");
             }
             elseif(strtolower(substr(trim($oToken->emailstatus),0,6))==="optout")// And global blacklisting ?
             {
-                $this->aRegisterErrors[]=gT("This email address is already registered but someone ask to not receive new email again.");
+                $this->aRegisterErrors[]=gT("This email address cannot be used because it was opted out of this survey.");
             }
             elseif(!$oToken->emailstatus && $oToken->emailstatus!="OK")
             {

application/controllers/Statistics_userController.php

@@ -35,8 +35,9 @@ public function _remap($method, $params = array())
         return call_user_func_array(array($this, "action"), $params);
     }
 
-    function actionAction($surveyid,$language)
+    function actionAction($surveyid,$language=null)
     {
+        $sLanguage=$language;
         ob_start(function($buffer, $phase) {
             App()->getClientScript()->render($buffer);
             App()->getClientScript()->reset();
@@ -128,22 +129,23 @@ function actionAction($surveyid,$language)
                 $currentuser="standard";
             }
         }
-
-
         // Set language for questions and labels to base language of this survey
-        if (isset($postlang) && $postlang != null )
-            $language = $postlang;
+        if ($sLanguage== null || !in_array($sLanguage,Survey::model()->findByPk($iSurveyID)->getAllLanguages()))
+        {
+            $sLanguage = Survey::model()->findByPk($iSurveyID)->language;
+        }
         else
-            $language = Survey::model()->findByPk($iSurveyID)->language;
-
-
-        //Create header (fixes bug #3097)
-        $surveylanguage= $language;
+        {
+            $sLanguage=sanitize_languagecode($sLanguage);
+        }
+        //set survey language for translations
+        SetSurveyLanguage($iSurveyID, $sLanguage);
+        //Create header
         sendCacheHeaders();
         $condition = false;
         $sitename = Yii::app()->getConfig("sitename");
 
-        $data['surveylanguage'] = $surveylanguage;
+        $data['surveylanguage'] = $sLanguage;
         $data['sitename'] = $sitename;
         $data['condition'] = $condition;
         $data['thisSurveyCssPath'] = $thisSurveyCssPath;
@@ -165,7 +167,7 @@ function actionAction($surveyid,$language)
         }
 
         //execute query
-        $result = Yii::app()->db->createCommand($query)->bindParam(":lang1", $language, PDO::PARAM_STR)->bindParam(":lang2", $language, PDO::PARAM_STR)->bindParam(":surveyid", $iSurveyID, PDO::PARAM_INT)->queryAll();
+        $result = Yii::app()->db->createCommand($query)->bindParam(":lang1", $sLanguage, PDO::PARAM_STR)->bindParam(":lang2", $sLanguage, PDO::PARAM_STR)->bindParam(":surveyid", $iSurveyID, PDO::PARAM_INT)->queryAll();
 
         //store all the data in $rows
         $rows = $result;
@@ -240,7 +242,7 @@ function actionAction($surveyid,$language)
                 case "Q": // Multiple Short Text
                     //get answers
                     $query = "SELECT title as code, question as answer FROM {{questions}} WHERE parent_qid=:flt_0 AND language = :lang ORDER BY question_order";
-                    $result =  Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $language, PDO::PARAM_STR)->queryAll();
+                    $result =  Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $sLanguage, PDO::PARAM_STR)->queryAll();
 
                     //go through all the (multiple) answers
                     foreach($result as $row)
@@ -257,7 +259,7 @@ function actionAction($surveyid,$language)
                 case "H": // ARRAY (By Column)
                     //get answers
                     $query = "SELECT title as code, question as answer FROM {{questions}} WHERE parent_qid=:flt_0 AND language = :lang ORDER BY question_order";
-                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $language, PDO::PARAM_STR)->queryAll();
+                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $sLanguage, PDO::PARAM_STR)->queryAll();
 
                     //go through all the (multiple) answers
                     foreach($result as $row)
@@ -276,11 +278,11 @@ function actionAction($surveyid,$language)
                 case ";":  //ARRAY (Multi Flex) (Text)
                 case ":":  //ARRAY (Multi Flex) (Numbers)
                     $query = "SELECT title, question FROM {{questions}} WHERE parent_qid=:flt_0 AND language=:lang AND scale_id = 0 ORDER BY question_order";
-                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $language, PDO::PARAM_STR)->queryAll();
+                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $sLanguage, PDO::PARAM_STR)->queryAll();
                     foreach($result as $row)
                     {
                         $fquery = "SELECT * FROM {{questions}} WHERE parent_qid = :flt_0 AND language = :lang AND scale_id = 1 ORDER BY question_order, title";
-                        $fresult = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $language, PDO::PARAM_STR)->queryAll();
+                        $fresult = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $sLanguage, PDO::PARAM_STR)->queryAll();
                         foreach($fresult as $frow)
                         {
                             $myfield2 = $myfield . reset($row) . "_" . $frow['title'];
@@ -291,7 +293,7 @@ function actionAction($surveyid,$language)
                 case "R": //RANKING
                     //get some answers
                     $query = "SELECT code, answer FROM {{answers}} WHERE qid = :flt_0 AND language = :lang ORDER BY sortorder, answer";
-                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $language, PDO::PARAM_STR)->queryAll();
+                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $sLanguage, PDO::PARAM_STR)->queryAll();
 
                     //get number of answers
                     $count = count($result);
@@ -309,7 +311,7 @@ function actionAction($surveyid,$language)
                 case "1": // MULTI SCALE
                     //get answers
                     $query = "SELECT title, question FROM {{questions}} WHERE parent_qid = :flt_0 AND language = :lang ORDER BY question_order";
-                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $language, PDO::PARAM_STR)->queryAll();
+                    $result = Yii::app()->db->createCommand($query)->bindParam(":flt_0", $flt[0], PDO::PARAM_INT)->bindParam(":lang", $sLanguage, PDO::PARAM_STR)->queryAll();
 
                     //loop through answers
                     foreach($result as $row)
@@ -342,7 +344,7 @@ function actionAction($surveyid,$language)
 
 
         // Get the survey inforamtion
-        $thissurvey = getSurveyInfo($surveyid,$language);
+        $thissurvey = getSurveyInfo($surveyid,$sLanguage);
 
         //SET THE TEMPLATE DIRECTORY
         $data['sTemplatePath'] = $surveyinfo['template'];// surveyinfo=getSurveyInfo and if survey don't exist : stop before. 
@@ -414,7 +416,7 @@ function actionAction($surveyid,$language)
             }    // end foreach -> loop through all questions
 
             $helper = new statistics_helper();
-            $statisticsoutput .= $helper->generate_statistics($iSurveyID, $summary, $summary, $publicgraphs, 'html', null,$language,false);
+            $statisticsoutput .= $helper->generate_statistics($iSurveyID, $summary, $summary, $publicgraphs, 'html', null,$sLanguage,false);
 
         }    //end if -> show summary results
 

application/controllers/SurveysController.php

@@ -32,8 +32,12 @@ public function actionIndex() {
         $this->render('index', ['surveys' => new \CActiveDataProvider(Survey::model()->accessible())]);
     }
 
-    public function actionPublicList()
+    public function actionPublicList($sLanguage = null)
     {
+        if (isset($sLanguage))
+        {
+            App()->setLanguage($sLanguage);
+        }
         $this->render('publicSurveyList', array(
             'publicSurveys' => Survey::model()->active()->open()->public()->with('languagesettings')->findAll(),
             'futureSurveys' => Survey::model()->active()->registration()->public()->with('languagesettings')->findAll(),
@@ -264,5 +268,4 @@ public function actionAbort()
             'surveyId' => isset($surveyId) ? $surveyId : null
         ]);
     }
-}
-?>
+}