Merge branch 'master' into develop

application/config/version.php

@@ -16,5 +16,5 @@
 $config['buildnumber'] = '';
 $config['updatable'] = true;
 $config['templateapiversion']  = 3;
-$config['assetsversionnumber'] = '30339';
+$config['assetsversionnumber'] = '30340';
 return $config;

application/controllers/admin/CheckIntegrity.php

@@ -466,8 +466,15 @@ private function deleteQuotaMembers(array $aData)
     private function deleteQuotaLanguageSettings(array $aData)
     {
         $oCriteria = new CDbCriteria();
-        $oCriteria->join = 'LEFT JOIN {{quota}} q ON {{quota_languagesettings}}.quotals_quota_id=q.id';
-        $oCriteria->condition = '(q.id IS NULL)';
+
+        if (App()->db->driverName == 'pgsql') {
+            // This is much slower than the MySQL version, but it works
+            // PostgreSQL does not support DELETE with JOIN
+            $oCriteria->condition = '{{quota_languagesettings}}.quotals_quota_id not in (select id from {{quota}})';
+        } else {
+            $oCriteria->join = 'LEFT JOIN {{quota}} q ON {{quota_languagesettings}}.quotals_quota_id=q.id';
+            $oCriteria->condition = '(q.id IS NULL)';
+        }
         $count = QuotaLanguageSetting::model()->deleteAll($oCriteria);
         $aData['messages'][] = sprintf(gT('Deleting orphaned quota languages: %u quota languages deleted'), $count);
         return $aData;
@@ -481,8 +488,15 @@ private function deleteQuotaLanguageSettings(array $aData)
     private function deleteQuotas(array $aData)
     {
         $oCriteria = new CDbCriteria();
-        $oCriteria->join = 'LEFT JOIN {{surveys}} q ON {{quota}}.sid=q.sid';
-        $oCriteria->condition = '(q.sid IS NULL)';
+
+        if (App()->db->driverName == 'pgsql') {
+            // This is much slower than the MySQL version, but it works
+            // PostgreSQL does not support DELETE with JOIN
+            $oCriteria->condition = '{{quota}}.sid not in (select sid from {{surveys}})';
+        } else {
+            $oCriteria->join = 'LEFT JOIN {{surveys}} q ON {{quota}}.sid=q.sid';
+            $oCriteria->condition = '(q.sid IS NULL)';
+        }
         $count = Quota::model()->deleteAll($oCriteria);
         $aData['messages'][] = sprintf(gT('Deleting orphaned quotas: %u quotas deleted'), $count);
         return $aData;

application/helpers/SurveyRuntimeHelper.php

@@ -546,10 +546,6 @@ public function run($surveyid, $args)
             if (!empty($_SESSION[$this->LEMsessid]['token']) and $this->aSurveyInfo['anonymized'] != 'Y') {
                 $this->aSurveyInfo['hiddenInputs']     .= \CHtml::hiddenField('token', $_SESSION[$this->LEMsessid]['token'], array('id' => 'token'));
             }
-            /* Set sof man to true if it's already in POST */
-            if (App()->request->getPost('mandSoft')) {
-                $this->aSurveyInfo['hiddenInputs']     .= \CHtml::hiddenField('mandSoft', App()->request->getPost('mandSoft'), array('id' => 'mandSoft'));
-            }
         }
 
         // For "clear all" buttons

application/helpers/common_helper.php

@@ -1215,7 +1215,7 @@ function createCompleteSGQA($iSurveyID, $aFilters, $sLanguage)
 
                 //go through all the (multiple) answers
                 foreach ($result as $row) {
-                    $myfield2 = $myfield . reset($row);
+                    $myfield2 = $myfield . $row['title'];
                     $allfields[] = $myfield2;
                 }
                 break;

application/helpers/update/updates/Update_601.php

@@ -13,10 +13,11 @@ public function up()
     {
         // Add button text column to boxes table
         try {
-            $this->db->createCommand()
-            ->addColumn('{{boxes}}', 'buttontext', 'string(255)');
-        } catch (\Exception $e) {
+            setTransactionBookmark();
+            $this->db->createCommand()->addColumn('{{boxes}}', 'buttontext', 'string(255)');
+        } catch (Exception $e) {
             // Column already exists - ignore
+            rollBackToTransactionBookmark();
         }
 
         $this->updateCreateSurvey();

application/models/Survey.php

@@ -550,6 +550,11 @@ public function rules()
             array('startdate', 'date','format' => ['yyyy-M-d H:m:s.???','yyyy-M-d H:m:s','yyyy-M-d H:m'],'allowEmpty' => true),
             array('datecreated', 'date','format' => ['yyyy-M-d H:m:s.???','yyyy-M-d H:m:s','yyyy-M-d H:m'],'allowEmpty' => true),
             array('expires', 'checkExpireAfterStart'),
+            // The Google Analytics Tracking ID is inserted in a JS script. If the following rule is changed, make sure
+            // that it doesn't render it vulnerable to XSS attacks.
+            array('googleanalyticsapikey', 'match', 'pattern' => '/^[a-zA-Z\-\d]*$/',
+                'message' => gT('Google Analytics Tracking ID may only contain alphanumeric characters and hyphens.'),
+            ),
         );
     }
 
@@ -841,11 +846,13 @@ public function setGoogleanalyticsapikeysetting($value)
      */
     public function getGoogleanalyticsapikey()
     {
+        $key = null;
         if ($this->googleanalyticsapikey === "9999useGlobal9999") {
-            return trim((string) Yii::app()->getConfig('googleanalyticsapikey'));
+            $key = trim((string) Yii::app()->getConfig('googleanalyticsapikey'));
         } else {
-            return trim((string) $this->googleanalyticsapikey);
+            $key = trim((string) $this->googleanalyticsapikey);
         }
+        return sanitize_alphanumeric($key);
     }
 
     /**

application/views/survey/questions/answer/arrays/multiflexi/rows/cells/answer_td_checkboxes.twig

@@ -25,6 +25,6 @@
         'aria-labelledby' : "answertext" ~ basename ~ "_" ~ dataCode,
     }))
     }}
-    <label for="cbox{{ myfname2 }}" class="ls-label-xs-visibility" aria-hidden="true">{{ dataTitle }}</label>
+    <label for="cbox{{ myfname2 }}" class="ls-label-xs-visibility" aria-hidden="true">{{ processString(dataTitle) }}</label>
 </td>
 <!-- end of answer_td_checkboxes -->

application/views/survey/questions/answer/gender/buttons/answer.twig

@@ -22,7 +22,7 @@
     </label>
 
     <!-- Male -->
-    <input type="radio" class="btn-check ls-button-radio" name="{{ name }}" id="answer{{ name }}M" value="M" {{ fChecked }}>
+    <input type="radio" class="btn-check ls-button-radio" name="{{ name }}" id="answer{{ name }}M" value="M" {{ mChecked }}>
         <label class="btn btn-primary mb-3 answer-item ls-button-label" id="javatbd{{ name }}M" for="answer{{ name }}M">
         <span class="fa fa-mars ls-icon" aria-hidden="true"></span> {{ gT('Male') }}
     </label>

assets/packages/questions/5pointchoice/scripts/slider-rating.js

@@ -20,7 +20,8 @@ function getRatingSlider(qID){
       sliderLine              : $("<div id='slider_line_item_"+qID+"' class='slider-line'></div>"),                        //The colored baseline
       sliderHandle            : $("<div id='slider_handle_item_"+qID+"' class='slider-handle'></div>"),                    //the handle
       sliderLabelEmoji        : $("<div class='slider-label'><i class='emoji emoji-enormous'></i></div>"),
-      sliderLabelNoAnswer     : $("<div class='slider-label slider-label-6' data-position='6'><i class='fa fa-ban' style='font-size:28px;'></i></div>")
+      sliderLabelNoAnswer     : $("<div class='slider-label slider-label-6' data-position='6'><i class='fa fa-ban' style='font-size:28px;'></i></div>"),
+      sliderDummyEmoji        : $("<div class='dummy-emoji'><i class='emoji emoji-enormous emoji-color'></i></div>"),
     },
     mapEmojiToValue = function(position){
       var imageMap = {1: "emoji-sad",2: "emoji-mildlyunamused",3: "emoji-whatever",4: "emoji-smile",5: "emoji-grin-eyes",6: "emoji-grin",7: "emoji-bigsmile"};
@@ -149,6 +150,8 @@ function getRatingSlider(qID){
       for (i=1; i<=5; i++) {
         package.sliderLabelEmoji.clone().addClass("slider-label-"+i).data('position', i).find('i').addClass(mapEmojiToValue(i)).end().appendTo(package.sliderInnerHtmlElement);
       }
+      // Add dummy element with color emoji font to make the browser load the font and avoid flickering when an emoji is selected
+      package.sliderInnerHtmlElement.append(package.sliderDummyEmoji);
       //Add the "no answer" label, if the question need one, also add the mandatory class to the sliderline
       if(!checkHasNoAnswerOption()){
         package.sliderLine.addClass('mandatory');

docs/release_notes.txt

@@ -34,6 +34,22 @@ Thank you to everyone who helped with this new release!
 
 CHANGE LOG
 ------------------------------------------------------
+Changes from 6.1.2 (build 230606) to 6.1.3 (build 230612) June 12, 2023
+-Fixed issue #18833: Mobile phone issue with formulas on columns headings with array numbers on checkbox layout (#3207) (Denis Chenu)
+-Fixed issue #18814: Array question statistics fail for Remote Control (#3191) (Gabriel Jenik)
+-Fixed issue #18808: Mandatory soft only works once per survey if over multiple pages/groups (#3195) (Denis Chenu)
+-Fixed issue #18789: Database upgrade error when trying to update from 6.0.x to any later version and using Postgres (Carsten Schmitz)
+-Fixed issue #18669: XSS simple admin via Google key (#3004) (Gabriel Jenik)
+-Fixed issue #18615: Data integrity SQL syntax error on Postgres when trying to fix quotas (Carsten Schmitz)
+-Fixed issue #16409: Emoticon style is different if emoticon is chosen (#3152) (Gabriel Jenik)
+#Updated translation: Slovak by jelen1
+#Updated translation: Polish by elissa
+#Updated translation: Polish (Informal) by elissa
+#Updated translation: Hungarian by kkd
+#Updated translation: Czech by jelen1
+#Updated translation: Czech (Informal) by jelen1
+
+
 Changes from 6.1.1 (build 230530) to 6.1.2 (build 230606) June 5, 2023
 -Fixed issue #18823: STATA Export fails with certain question types (#3148) (Oz-men)
 -Fixed issue #18814: Array question statistics fail for Remote Control. (#3165) (Gabriel Jenik)