Optional settings - Revision history

C schmitz: Marked this version for translation

2026-06-13T22:09:09Z

Marked this version for translation

← Older revision		Revision as of 00:09, 14 June 2026
Line 296:		Line 296:
	*'''twig_getConfig_extraallowlist:''' Allow to allow specific element for getConfig function in twig. LimeSurvey already allow most needed and used setting, but you can need more. If you want to allow 'securesetting' and 'anothersetting', set this to <code>['securesetting','anothersetting']</code> like this <code>'twig_getConfig_extraallowlist' => ['securesetting','anothersetting']</code>. This setting can be only set via config.php file.		*'''twig_getConfig_extraallowlist:''' Allow to allow specific element for getConfig function in twig. LimeSurvey already allow most needed and used setting, but you can need more. If you want to allow 'securesetting' and 'anothersetting', set this to <code>['securesetting','anothersetting']</code> like this <code>'twig_getConfig_extraallowlist' => ['securesetting','anothersetting']</code>. This setting can be only set via config.php file.

	== Cross-site scripting (XSS) protection ==		== Cross-site scripting (XSS) protection == <!--T:145-->

			<!--T:146-->
	LimeSurvey didn't allow any user script on the administration page. If you find a way to add an XSS script on the administration page by any user, please check our [https://github.com/LimeSurvey/LimeSurvey/blob/master/SECURITY.md Security Policy].		LimeSurvey didn't allow any user script on the administration page. If you find a way to add an XSS script on the administration page by any user, please check our [https://github.com/LimeSurvey/LimeSurvey/blob/master/SECURITY.md Security Policy].

			<!--T:147-->
	The public page scripts are managed by XSS filter settings.		The public page scripts are managed by XSS filter settings.

			<!--T:148-->
	*'''filterxsshtml:''' This setting enables the filtering of suspicious html tags located within surveys, groups, and questions and answer texts in the administration interface. Leave this to 'false' only if you absolutely trust the users you created for the administration of LimeSurvey and if you want to allow these users to be able to use Javascript, Flash Movies, etc.. <span class="warning">The super admins never have their HTML filtered</span>. The default value can be overridden in the [[Global settings\|global settings]] dialog.		*'''filterxsshtml:''' This setting enables the filtering of suspicious html tags located within surveys, groups, and questions and answer texts in the administration interface. Leave this to 'false' only if you absolutely trust the users you created for the administration of LimeSurvey and if you want to allow these users to be able to use Javascript, Flash Movies, etc.. <span class="warning">The super admins never have their HTML filtered</span>. The default value can be overridden in the [[Global settings\|global settings]] dialog.
	*'''filterxsshtml_forcedall:''' Force <code>filterxsshtml</code> to true for all users, disable updates in the admin GUI. Enables filtering of suspicious HTML tags for superadmin too.		*'''filterxsshtml_forcedall:''' Force <code>filterxsshtml</code> to true for all users, disable updates in the admin GUI. Enables filtering of suspicious HTML tags for superadmin too.
Line 331:		Line 334:
	*'''disablePluginUpload''' : When this setting is true, the "Plugin Upload" feature is disabled		*'''disablePluginUpload''' : When this setting is true, the "Plugin Upload" feature is disabled

			<!--T:149-->
	== Host control ==		== Host control ==
	*'''allowedHosts''' : to avoid Host Header Injection, you can set the allowed host for all action. If you use different host for public page and admin page : you need to set both as allwoed host.		*'''allowedHosts''' : to avoid Host Header Injection, you can set the allowed host for all action. If you use different host for public page and admin page : you need to set both as allwoed host.
Line 345:		Line 349:
	</syntaxhighlight>		</syntaxhighlight>

			<!--T:150-->
	= Resources=		= Resources=
	*'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings\|global settings]] dialog.		*'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings\|global settings]] dialog.

Denischenu: twig_getConfig_extraallowlist and allow_unserialize_attachments

2026-06-05T17:39:44Z

twig_getConfig_extraallowlist and allow_unserialize_attachments

← Older revision		Revision as of 19:39, 5 June 2026
Line 293:		Line 293:
	*'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl. This setting can be only set via config.php file.		*'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl. This setting can be only set via config.php file.
	*'''allow_unserialize_attributedescriptions:''' Allow unserializing (with PHP unserialize function) token attributes when importing or reading a survey object. Since LimeSurvey 3, token attributes data is saved as JSON. If you use an older survey file and need to get token attributes, you must enable this setting. Warning: Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this.. This setting can be only set via config.php file.		*'''allow_unserialize_attributedescriptions:''' Allow unserializing (with PHP unserialize function) token attributes when importing or reading a survey object. Since LimeSurvey 3, token attributes data is saved as JSON. If you use an older survey file and need to get token attributes, you must enable this setting. Warning: Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this.. This setting can be only set via config.php file.
			*'''allow_unserialize_attachments:''' Allow unserializing (with PHP unserialize function) attachments attributes when importing survey. In limesurvey 6.16.17: attachments attribute move from serialize to json_encode. If you need to keep attachment when import old LSS file, you have to allow it. Warning: Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. This setting can be only set via config.php file.
			*'''twig_getConfig_extraallowlist:''' Allow to allow specific element for getConfig function in twig. LimeSurvey already allow most needed and used setting, but you can need more. If you want to allow 'securesetting' and 'anothersetting', set this to <code>['securesetting','anothersetting']</code> like this <code>'twig_getConfig_extraallowlist' => ['securesetting','anothersetting']</code>. This setting can be only set via config.php file.

	== Cross-site scripting (XSS) protection ==		== Cross-site scripting (XSS) protection ==
Line 343:		Line 345:
	</syntaxhighlight>		</syntaxhighlight>

	~~<!--T:6-->~~
	= Resources=		= Resources=
	*'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings\|global settings]] dialog.		*'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings\|global settings]] dialog.

Denischenu: /* Cross-site scripting (XSS) protection */ fix code tag

2026-06-05T17:35:06Z

Cross-site scripting (XSS) protection: fix code tag

← Older revision		Revision as of 19:35, 5 June 2026
Line 304:		Line 304:
	*'''filterxsshtml_allowforcedsuperadmin:''' Only used if <code>filterxsshtml_forcedall</code> is true. Allow adding any script and HTML by <code>forcedsuperadmin</code> (by default admin user #1).		*'''filterxsshtml_allowforcedsuperadmin:''' Only used if <code>filterxsshtml_forcedall</code> is true. Allow adding any script and HTML by <code>forcedsuperadmin</code> (by default admin user #1).
	*'''disablescriptwithxss:''' Allow update of script in question : by default, true : follow XSS rules; set to false to allowed for all users. The default value can be overridden in the [[Global settings\|global settings]] dialog.		*'''disablescriptwithxss:''' Allow update of script in question : by default, true : follow XSS rules; set to false to allowed for all users. The default value can be overridden in the [[Global settings\|global settings]] dialog.
	*'''filterxsshtml_enablescript:''' Only used if filterxsshtml_forcedall is true. Enable question script for specific user : <code>gui</code>: allow update setting via GUI; <code>superadmin</code>: only super admin; <code>forcedsuperadmin<code>: only forced superadmin; by default : no user and do not allow update via GUI		*'''filterxsshtml_enablescript:''' Only used if filterxsshtml_forcedall is true. Enable question script for specific user : <code>gui</code>: allow update setting via GUI; <code>superadmin</code>: only super admin; <code>forcedsuperadmin</code>: only forced superadmin; by default : no user and do not allow update via GUI


	== Allowed file upload == <!--T:137-->		== Allowed file upload == <!--T:137-->

Denischenu: Create Cross-site scripting (XSS) protection with all XSS related settings

2026-06-05T17:33:32Z

Create Cross-site scripting (XSS) protection with all XSS related settings

@@ Line 282: / Line 282: @@
 * '''surveyPreview_require_Auth''': Set to true by default. If you set this to 'false', any person can test your survey using the survey URL, without logging in to the administration panel and without having to activate the survey first. This setting is a default value and can be overridden in the [[Global settings|global settings]] dialog or edited in config.php.
 * '''usercontrolSameGroupPolicy''': Set to true by default. By default, non-admin users defined in the LimeSurvey management interface will only be able to see users they create or users that belong to at least one same group. The default value can be overridden in the [[Global settings|global settings]] dialog or edited in config.php.
 *'''demoMode:''' If this option is set to 'true' in config.php, then LimeSurvey will go into demo mode. The demo mode changes the following things:
 ** Disables admin user's details and password changing;
@@ Line 294: / Line 293: @@
 *'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl.  This setting can be only set via config.php file.
 *'''allow_unserialize_attributedescriptions:''' Allow unserializing (with PHP unserialize function) token attributes when importing or reading a survey object. Since LimeSurvey 3, token attributes data is saved as JSON. If you use an older survey file and need to get token attributes, you must enable this setting. Warning: Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this..  This setting can be only set via config.php file.
 == Allowed file upload == <!--T:137-->

Denischenu: Add again at good position

2026-06-05T15:43:03Z

Add  again at good position

← Older revision		Revision as of 17:43, 5 June 2026
Line 332:		Line 332:
	</syntaxhighlight>		</syntaxhighlight>

			<!--T:6-->
	= Resources=		= Resources=
	*'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings\|global settings]] dialog.		*'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings\|global settings]] dialog.

Denischenu: allowedHosts

2026-06-05T15:41:56Z

allowedHosts

@@ Line 318: / Line 318: @@
 *'''disablePluginUpload''' :  When this setting is true, the "Plugin Upload" feature is disabled
-<!--T:6-->
+== Host control ==
 = Resources=
 *'''sessionlifetime:''' Defines the time in seconds after which a survey session expires. It applies only if you are using database sessions. If you do use database sessions, change the parameter in config.php or override the default value from the [[Global settings|global settings]] dialog.

Denischenu: Add allow_unserialize_attributedescriptions

2025-09-29T13:38:12Z

Add allow_unserialize_attributedescriptions

← Older revision		Revision as of 15:38, 29 September 2025
Line 293:		Line 293:
	*'''ssl_emergency_override:''' This setting forces SSL off. If You've turned HTTPS/SSL on in the global settings but your server doesn't have HTTPS enabled, the only way to turn it off is by changing a value in the database directly. This allows you to force HTTPS off while you change the global settings for Force Secure. This should always be false except in emergencies where you change it to true until you fix the problem. This setting can be only set via config.php file.		*'''ssl_emergency_override:''' This setting forces SSL off. If You've turned HTTPS/SSL on in the global settings but your server doesn't have HTTPS enabled, the only way to turn it off is by changing a value in the database directly. This allows you to force HTTPS off while you change the global settings for Force Secure. This should always be false except in emergencies where you change it to true until you fix the problem. This setting can be only set via config.php file.
	*'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl. This setting can be only set via config.php file.		*'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl. This setting can be only set via config.php file.
			*'''allow_unserialize_attributedescriptions:''' Allow unserializing (with PHP unserialize function) token attributes when importing or reading a survey object. Since LimeSurvey 3, token attributes data is saved as JSON. If you use an older survey file and need to get token attributes, you must enable this setting. Warning: Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this.. This setting can be only set via config.php file.

	== Allowed file upload == <!--T:137-->		== Allowed file upload == <!--T:137-->

Han: Marked this version for translation

2025-08-12T14:28:04Z

Marked this version for translation

Show changes

Denischenu: Tokens / allowedcharacters_pattern_token

2025-03-04T09:32:09Z

Tokens / allowedcharacters_pattern_token

← Older revision		Revision as of 11:32, 4 March 2025
Line 582:		Line 582:
	*'''updatable:''' This setting is in version.php. Can be true or false. If you set to true : when an super admin user log in : LimeSurvey checks if an update is available and show you a warning. If set to false : no check is done and you can't use ComfortUpdate.		*'''updatable:''' This setting is in version.php. Can be true or false. If you set to true : when an super admin user log in : LimeSurvey checks if an update is available and show you a warning. If set to false : no check is done and you can't use ComfortUpdate.

			== Tokens ==

			*'''allowedcharacters_pattern_token''' : These settings allow to set the regexp pattern when filtering token.
	</translate>		</translate>

Tassoman: /* Allowed file upload */

2025-01-14T16:28:23Z

Allowed file upload

← Older revision		Revision as of 18:28, 14 January 2025
Line 299:		Line 299:
	*'''allowedresourcesuploads''' : File types allowed to be uploaded in the resources sections, and with the HTML Editor		*'''allowedresourcesuploads''' : File types allowed to be uploaded in the resources sections, and with the HTML Editor
	*'''allowedpluginuploads''' : File type allowed when upload plugin zip file.		*'''allowedpluginuploads''' : File type allowed when upload plugin zip file.

			Just enter a string of comma separated extensions. For example: <pre>'allowedthemeimageformats' => 'jpg,jpeg,gif,png,webm,svg',</pre>

			Warning: Always be careful when allowing file uploads. Malicious activities could be expected.

	== Plugins ==		== Plugins ==