-Fixed issue: [security] Privilege escalation vulnerability in the RemoteControl API. Severity: High (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An authenticated administrator with permission to edit the settings of a survey could make themselves its owner and so get all permissions on it, and an administrator with permission to edit a shared participant of the central participant database could take over its ownership. Affects versions 3.0.0 to 7.8.0. (Carsten Schmitz)
-Fixed issue: [security] Path traversal vulnerability in the RemoteControl API response file functions. Severity: Medium (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). An authenticated administrator with permission to add and read the responses of any one active survey with a file upload question could read any file the web server can read, including the configuration file with the database credentials. Affects versions 3.0.0 to 7.8.0. (Carsten Schmitz)
-Fixed issue: [security] Broken access control vulnerability in survey theme options. Severity: Medium (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). An authenticated administrator with permission to edit a single theme could change the theme options of all surveys and survey groups using it, an administrator with permission to edit the settings of a survey could change the theme options of other surveys, and any administrator could load the menus of any survey. Affects versions 3.0.0 to 7.8.0. (Carsten Schmitz)
-Fixed issue: With debug mode on, the SPSS (.sav) response export raised an "mb_strcut(): Passing null" deprecation. Dev SPSSWriter now passes an empty file label to the tiamo/spss header (Carsten Schmitz)
-Fixed issue: The {NUMBEROFQUESTIONS} placeholder counted questions that are always hidden (Carsten Schmitz)
-Fixed issue: The {NUMBEROFGROUPS} placeholder counted groups that contain only always hidden questions (Carsten Schmitz)
-Fixed issue: The user management list and the user group member list were shown in a changing order, and paging could show a user twice and skip another one (Carsten Schmitz)
-Fixed issue: On PostgreSQL and MSSQL the statCount() and statCountIf() expression functions showed nothing for numeric questions (Carsten Schmitz)
-Fixed issue: On MSSQL the {SUBMITDATE}, {STARTDATE} and {DATESTAMP} variables showed fractional seconds (2019-08-05 00:10:35.000) (Carsten Schmitz)
-Fixed issue: On MSSQL renaming a survey theme failed and the theme editor showed the default theme instead (Carsten Schmitz)
-Fixed issue: Deleting a question group left the texts of its questions, subquestions, answers and default values behind in the database (Carsten Schmitz)
-Fixed issue: Blocklisted participants were offered a link to leave the blocklist although this was disabled, and the link did nothing (Carsten Schmitz)
-Fixed issue: After updating from LimeSurvey 6 an active survey failed with "Attribute 'Q…_S…' not found in the model" when an array question had a subquestion coded "other", "comment" or "othercomment" (Carsten Schmitz)
-Fixed issue: "Hide blocklisted participants" showed only blocklisted participants in the central participant database (Carsten Schmitz)
-Fixed issue #AT-2264: Dropdown item styles (#5391) (Rami S. Zaki)
-Fixed issue #20814: [security] Broken access control vulnerability in survey content editing. Severity: High (CVSS 7.6, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). An authenticated administrator with permission to edit the content, quotas or translations of any one survey could change, move or delete questions, question groups and conditions of other surveys, overwrite their texts with texts that bypassed the XSS filter, and read texts of their questions, groups, conditions and quotas. Affects versions 3.0.0 to 7.8.0. (Carsten Schmitz)
-Fixed issue #20813: [security] Broken access control vulnerability in quota mass actions. Severity: High (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L). An authenticated administrator with permission to manage the quotas of any one survey could activate, deactivate or delete the quotas of all other surveys, and change their messages and redirect URLs. Affects versions 3.0.0 to 7.8.0. Reported by: Isaiah (GitHub: zaehuncho). (Carsten Schmitz)
-Fixed issue #20812: [security] Privilege escalation vulnerability in survey permissions. Severity: Medium (CVSS 6.8, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). An attacker with only the permission to add users to a survey's permissions could give any user of the installation, including themselves and users outside their user groups, any permission on that survey, and change or remove other users' permissions on it. Affects versions 5.5.0 to 7.9.0. Fixed issue #20812: [security] Information disclosure vulnerability in the RemoteControl API. Severity: Low (CVSS 3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). An attacker with any administration account that can use the RemoteControl API could find out which administration usernames exist by listing surveys for a given username. Affects versions 3.0.0 to 7.9.0. (#5502) (Carsten Schmitz)
-Fixed issue #20807: Answer options and subquestions listed in "Keep codes at original positions" were sorted along with the others when the order was alphabetical (Carsten Schmitz)
-Fixed issue #20785: In the popup HTML editor the OK and Cancel buttons of the image and table dialogs were hidden below the bottom of the window (Carsten Schmitz)
-Fixed issue #20761: MS-SQL survey activation can remove unique index (#5456) (Denis Chenu)
-Fixed issue #20722: Check data integrity showed a "table does not exist" error when deleting the old tables of a deleted survey (Carsten Schmitz)
-Fixed issue #20705: [security] Missing authorization vulnerability in the central participant database. Severity: Medium (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). An authenticated user with any central participant database permission, or with a single participant shared with them, could read the custom attribute values of any central participant by guessing its participant ID. Affects all versions up to 7.9.0. (Carsten Schmitz)
-Fixed issue #20638: Theme option dropdowns (theme color, fonts, check icon) showed no values in Firefox (Carsten Schmitz)
-Fixed issue #20525: After switching between surveys, question conditions in the question summary were sometimes shown as errors (undefined variable) (Carsten Schmitz)
-Fixed issue #20438: Survey settings pages, the survey overview, survey theme options and failed email notifications had no page heading (Carsten Schmitz)
-Fixed issue #20412: Answers to a subquestion that was deleted and re-created with the same code while the survey was inactive were not restored on reactivation (Carsten Schmitz)
-Fixed issue #20410: KCFinder not properly loading if baseUrl is set in config file (#5276) (Carsten Schmitz)
-Fixed issue #20408: Clicking the Upload button on the survey resources tab often did nothing (Carsten Schmitz)
-Fixed issue #20332: CSS from a <style> block in a question text was shown as text in the admin breadcrumb, the statistics and other places that show the question text without HTML (Carsten Schmitz)
-Fixed issue #20328: The active survey count in the admin menu was not updated after deleting surveys with the survey list mass action (Carsten Schmitz)
-Fixed issue #20327: Screen readers announced the error popup in surveys as a dialog without a name (Carsten Schmitz)
-Fixed issue #20326: In multilingual surveys custom timer messages were randomly replaced by the default text or shown in another language (Carsten Schmitz)
-Fixed issue #20318: Automatic redirect to the end URL did not work when it used a question coded URL (Carsten Schmitz)
-Fixed issue #20311: When creating a survey failed (e.g. because of a database error), the page just reloaded without showing any error (Carsten Schmitz)
-Fixed issue #20295: Row action menus ("...") were cut off and partly covered by the table when the grid had been empty on page load (e.g. URL parameters in panel integration) (Carsten Schmitz)
-Fixed issue #20272: Conditions did not work on survey pages where a question had a default answer containing an apostrophe (e.g. {date('Y')}) (Carsten Schmitz)
-Fixed issue #20265: All browser tabs of the same survey showed the same title, so open tabs could not be told apart (Carsten Schmitz)
-Fixed issue #20238: RemoteControl invite_participants and remind_participants sent no emails when the first participants of a batch were not valid yet or not valid anymore (Carsten Schmitz)
-Fixed issue #20202: Screen readers announced the search field and the status and group filters above the survey list as "All surveys" (Carsten Schmitz)
-Fixed issue #20201: Screen readers announced the row checkboxes in the survey list and other admin grids without a name (Carsten Schmitz)
-Fixed issue #20195: Participant attributes were shown as invalid in the survey logic file when the survey had no participant table, while the basic participant fields were shown as valid (Carsten Schmitz)
-Fixed issue #20141: Survey pages without a shown group name, the pages of a question-by-question survey, the admin dashboard and the survey theme options page had no distinct browser page title (Carsten Schmitz)
-Fixed issue #20028: A form with more fields than the PHP max_input_vars setting allows failed with a misleading "CSRF token could not be verified" error (Carsten Schmitz)
-Fixed issue #20027: With debug mode on, editing a response in data entry failed with "Trying to access array offset on value of type bool" when the last question of the survey was a Multiple choice or Array (5 point, 10 point, Increase/Same/Decrease) question (Carsten Schmitz)
-Fixed issue #19977: Keyboard and screen reader users had to go through the whole top menu on every page of a survey in the Vanilla, Bootswatch and Fruity themes before reaching the questions (Denis Chenu)
-Fixed issue #19951: Plugins were not notified when a question group was deleted, and could not see which questions were deleted with it (Carsten Schmitz)
-Fixed issue #19871: Users with survey content permissions could not add a question group with the RemoteControl function add_group (Carsten Schmitz)
-Fixed issue #19851: After being logged out (e.g. in another tab), saving a question and other admin actions silently did nothing instead of asking to log in again (Carsten Schmitz)
-Fixed issue #19792: The theme file upload dialogs offered all file types, including SVG files that were then rejected (Carsten Schmitz)
-Fixed issue #19741: Pasting or dropping an image into a text in the new survey editor embedded it as a huge base64 image, which could make the survey impossible to open (Carsten Schmitz)
-Fixed issue #19622: Mail not possible if name contains a "<" char (#5224) (Carsten Schmitz)
-Fixed issue #19385: The updatedb console command did not show why the update was refused and wrongly asked to restore a database backup (Carsten Schmitz)
-Fixed issue #19247: Date answers were lost and shown as invalid after changing the survey language (Carsten Schmitz)
-Fixed issue #19104: Exporting responses of a survey with many questions failed on PostgreSQL with a "Too many columns" error (Carsten Schmitz)
-Fixed issue #19058: Field captions of the core participant attributes looked editable but were never saved (Carsten Schmitz)
-Fixed issue #18754: A new answer option or subquestion row could be added out of sight below the visible part of the table (Carsten Schmitz)
-Fixed issue #18746: The create survey button in the top bar was announced as "plus" by screen readers and showed no tooltip (Carsten Schmitz)
-Fixed issue #18734: Question code and question type were hidden in the settings panel on the right of the question editor (Carsten Schmitz)
-Fixed issue #18716: On iPhones the survey page zoomed in when a text field got the focus (Carsten Schmitz)
-Fixed issue #18712: Importing an invalid question file showed an internal server error instead of an error message (Carsten Schmitz)
-Fixed issue #18598: The minimum and maximum date settings of a Date question were listed under Display instead of Logic (Carsten Schmitz)
-Fixed issue #18508: The description of the global Users permission did not say that editing and deleting a user only works for users you own (Carsten Schmitz)
-Fixed issue #18357: A new question could not be placed at a specific position in its group anymore (Carsten Schmitz)
-Fixed issue #18328: A question setting added by a plugin with a translated category was shown in a duplicate panel of the same name when the administration language was not English (Carsten Schmitz)
-Fixed issue #18313: Edit permissions for several selected users showed all permissions unchecked and saving removed every permission that was not ticked (Carsten Schmitz)
-Fixed issue #18272: When PHP's post_max_size or upload_max_filesize was set to 0 (no limit), every file upload was rejected as too large with a maximum of 0.00 MB (Carsten Schmitz)
-Fixed issue #18236: Links using a participant attribute or a subquestion code (e.g. {ATTRIBUTE_1}, {TOKEN:ATTRIBUTE_1}) in their URL were broken on save when XSS filtering was active (Carsten Schmitz)
-Fixed issue #18177: A RemoteControl login with the email address or through an auth plugin that changes the username returned a session key without any permissions (Carsten Schmitz)
-Fixed issue #18053: Array dual scale questions showed "No answer" ticked together with an answer on the first scale after returning to the page (Carsten Schmitz)
-Fixed issue #17924: queXML PDFs showed the logo of the default theme instead of the survey's theme (Carsten Schmitz)
-Fixed issue #17847: Theme permissions did not explain that users can always use the inherited/default theme (Carsten Schmitz)
-Fixed issue #17686: In the question editor the subquestion and answer option lists showed only a few rows and long subquestion relevance equations could not be read (Carsten Schmitz)
-Fixed issue #17604: Regenerating question codes from the survey tools menu happened immediately without asking for confirmation (Carsten Schmitz)
-Fixed issue #17556: Invitation, reminder and completion dates of participants were saved in the administrator's date format or as a wrong date (Carsten Schmitz)
-Fixed issue #17531: Saving the bounce settings always reported success, even when the settings were not saved (Carsten Schmitz)
-Fixed issue #17437: The prefix and suffix were missing from the total row of Multiple numerical input questions (Carsten Schmitz)
-Fixed issue #17411: The question theme list showed no type, and built-in question types could not be told apart from the question themes shipped with LimeSurvey (Carsten Schmitz)
-Fixed issue #16880: Survey error pages (e.g. survey expired, not yet started, session timeout) did not show the survey title (Carsten Schmitz)
-Fixed issue #16877: The API function get_question_properties returned answer options with the codes 0, 1, 2, ... as a plain list without their codes (Carsten Schmitz)
-Fixed issue #16458: In the theme editor file list, the Reset button stuck out of its box in some languages (e.g. French) (Carsten Schmitz)
-Fixed issue #16222: Expressions using a text answer with quotes or curly braces gave a different result on the same page than on later pages (#5486) (Carsten Schmitz)
-Fixed issue #16144: After choosing a question type, a new question with an invalid or duplicate code could still be submitted with "Enter" and all entered data was lost (Carsten Schmitz)
-Fixed issue #15802: The survey logic check always told to use sum() for the + operator, even when it joins texts (Carsten Schmitz)
-Fixed issue #15779: Array (Texts) questions with totals/grand total took several seconds to load (Carsten Schmitz)
-Fixed issue #15652: TOKEN:PARTICIPANT_ID and other participant table columns were shown as invalid in the question summary and survey logic file (Carsten Schmitz)
-Fixed issue #14999: Survey themes could not remove a script file with unregisterScriptFile (Carsten Schmitz)
#Updated translation: Polish by elissa, translations_bot
#Updated translation: Polish (Informal) by elissa
#Updated translation: Italian by lfanfoni, translations_bot
#Updated translation: Italian (Informal) by c_schmitz, lfanfoni, translations_bot
#Updated translation: French (France) by arnaud21, DenisChenu, fgervais, translations_bot, Xave
#Updated translation: Finnish by c_schmitz, Jmantysalo, translations_bot
#Updated translation: Dutch by c_schmitz, Han, Mazi, translations_bot
#Updated translation: Dutch (Informal) by Han, translations_bot
#Updated translation: Catalan by qualitatuvic, translations_bot