Optional settings/tr - Revision history

FuzzyBot: Updating to match new version of source page

2026-06-13T22:10:15Z

Updating to match new version of source page

FuzzyBot: Updating to match new version of source page

2025-10-20T14:01:22Z

Updating to match new version of source page

← Older revision		Revision as of 16:01, 20 October 2025
Line 254:		Line 254:
	*'''ssl_emergency_override:''' This setting forces SSL off. If You've turned HTTPS/SSL on in the global settings but your server doesn't have HTTPS enabled, the only way to turn it off is by changing a value in the database directly. This allows you to force HTTPS off while you change the global settings for Force Secure. This should always be false except in emergencies where you change it to true until you fix the problem. This setting can be only set via config.php file.		*'''ssl_emergency_override:''' This setting forces SSL off. If You've turned HTTPS/SSL on in the global settings but your server doesn't have HTTPS enabled, the only way to turn it off is by changing a value in the database directly. This allows you to force HTTPS off while you change the global settings for Force Secure. This should always be false except in emergencies where you change it to true until you fix the problem. This setting can be only set via config.php file.
	*'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl. This setting can be only set via config.php file.		*'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl. This setting can be only set via config.php file.
			*'''allow_unserialize_attributedescriptions:''' Allow unserializing (with PHP unserialize function) token attributes when importing or reading a survey object. Since LimeSurvey 3, token attributes data is saved as JSON. If you use an older survey file and need to get token attributes, you must enable this setting. Warning: Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this.. This setting can be only set via config.php file.

	== Allowed file upload ==		== Allowed file upload ==

FuzzyBot: Updating to match new version of source page

2025-08-12T14:28:17Z

Updating to match new version of source page

@@ Line 229: / Line 229: @@
 *'''sitename''': Gives your survey site a name. This name will appear in the survey list overview and in the administration header. The default value is 'LimeSurvey' and it can be overridden in the [[Global settings|global settings]] dialog or edited in config.php.
 *'''siteadminemail:''' This is the default email address of the site administrator and it is used for system messages and contact options. This setting is used only as default value and can be overridden in the [[Global settings|global settings]] dialog.
 *'''siteadminbounce:''' This is the email address where bounced emails will be sent to. This setting is used only as default value and can be  overridden by the [[Global settings|global settings]] dialog.
 *'''siteadminname:''' The real name of the site administrator. This setting is used only as default value and can be overridden in the [[Global settings|global settings]] dialog).
@@ Line 253: / Line 254: @@
 *'''ssl_emergency_override:''' This setting forces SSL off. If You've turned HTTPS/SSL on in the global settings but your server doesn't have HTTPS enabled, the only way to turn it off is by changing a value in the database directly. This allows you to force HTTPS off while you change the global settings for Force Secure. This should always be false except in emergencies where you change it to true until you fix the problem. This setting can be only set via config.php file.
 *'''ssl_disable_alert:''' Disable alert for super-admin about unforced SSL, if you really can not or don't want to force ssl.  This setting can be only set via config.php file.
 = Resources=
@@ Line 487: / Line 507: @@
 == Update ==
 *'''updatable:''' This setting is in version.php. Can be true or false. If you set to true : when an super admin user log in : LimeSurvey checks if an update is available and show you a warning. If set to false : no check is done and you can't use ComfortUpdate.

FuzzyBot: Updating to match new version of source page

2024-04-02T14:59:50Z

Updating to match new version of source page

← Older revision		Revision as of 16:59, 2 April 2024
Line 121:		Line 121:
	==Allow usage of session and Csrf Validation in iFrame {{NewIn\|v=3.24.3}}==		==Allow usage of session and Csrf Validation in iFrame {{NewIn\|v=3.24.3}}==

	After allow [[Global_settings#Security\|Iframe embedding]] you need to update some configuration part. Attention, even with all settings : allow form in iframe can broke on some browser. This settings was tested with Firefox 81.0.2 and Chromium 85.0.4183.121.		After allow [[Global_settings#Security\|Iframe embedding]] you need to update some configuration part.

			{{Alert\|Attention, even with all settings : allow form in iframe can broke on some browser or with user specific settings. This settings was tested with Firefox 81.0.2 to 115 and Chromium 85.0.4183.121 to 119, and119 Edge with default settings. '''No support on this feature, only community support'''.}}

	===Allow session start in iframe===		===Allow session start in iframe===
Line 144:		Line 146:
	===Allow csrf cookie in iframe===		===Allow csrf cookie in iframe===

	Same as session: must be secure and ~~samesite~~ set to None. The whole array must be added at the same level as session.		Same as session: must be secure and sameSite set to None. The whole array must be added at the same level as session.

	<syntaxhighlight lang="php" enclose="pre"> 'request' => array(		<syntaxhighlight lang="php" enclose="pre"> 'request' => array(

FuzzyBot: Updating to match new version of source page

2023-11-28T09:01:42Z

Updating to match new version of source page

@@ Line 119: / Line 119: @@
-==Allow usage of surveys in an iframe==
+==Allow usage of session and Csrf Validation in iFrame {{NewIn|v=3.24.3}}==
-After allowing [[Global_settings#Security|Iframe embedding]] a 100% reliable solution can only be guaranteed if the framing site uses the same root domain. If you use LimeSurvey Cloud this can be achieved by using [https://www.limesurvey.org/support/faq/37-limesurvey-cloud/499-what-is-domain-aliasing-and-why-do-i-need-it domain aliasing]
+After allow [[Global_settings#Security|Iframe embedding]] you need to update some configuration part. Attention, even with all settings : allow form in iframe can broke on some browser. This settings was tested with Firefox 81.0.2 and Chromium 85.0.4183.121.
 ==URL settings==

FuzzyBot: Updating to match new version of source page

2023-10-10T10:46:00Z

Updating to match new version of source page

@@ Line 119: / Line 119: @@
-==Allow usage of session and Csrf Validation in iFrame==
+==Allow usage of surveys in an iframe==
-After allowing [[Global_settings#Security|Iframe embedding]] you need to update some configuration parts.
+After allowing [[Global_settings#Security|Iframe embedding]] a 100% reliable solution can only be guaranteed if the framing site uses the same root domain. If you use LimeSurvey Cloud this can be achieved by using [https://www.limesurvey.org/support/faq/37-limesurvey-cloud/499-what-is-domain-aliasing-and-why-do-i-need-it domain aliasing]
 ==URL settings==

FuzzyBot: Updating to match new version of source page

2023-04-18T12:35:59Z

Updating to match new version of source page

← Older revision		Revision as of 14:35, 18 April 2023
Line 122:		Line 122:

	After allowing [[Global_settings#Security\|Iframe embedding]] you need to update some configuration parts.		After allowing [[Global_settings#Security\|Iframe embedding]] you need to update some configuration parts.

	'''Attention: This solution will not work reliable in all browsers, even with all the settings set.'''		'''Attention: This solution will not work reliable in all browsers, even with all the settings set.'''

	A better and 100% reliable solution can only be guaranteed if the framing site uses the same root domain.		A better and 100% reliable solution can only be guaranteed if the framing site uses the same root domain.

FuzzyBot: Updating to match new version of source page

2023-04-18T12:34:01Z

Updating to match new version of source page

← Older revision		Revision as of 14:34, 18 April 2023
Line 119:		Line 119:


	==Allow usage of session and Csrf Validation in iFrame ~~{{NewIn\|v=3.24.3}}~~==		==Allow usage of session and Csrf Validation in iFrame==

	After ~~allow~~ [[Global_settings#Security\|Iframe embedding]] you need to update some configuration ~~part~~. Attention, even with all settings ~~: allow form in iframe~~ can ~~broke on some browser~~. ~~This~~ settings ~~was~~ tested with Firefox 81.0.2 and Chromium 85.0.4183.121.		After allowing [[Global_settings#Security\|Iframe embedding]] you need to update some configuration parts.
			'''Attention: This solution will not work reliable in all browsers, even with all the settings set.'''
			A better and 100% reliable solution can only be guaranteed if the framing site uses the same root domain.

			These settings were tested with Firefox 81.0.2 and Chromium 85.0.4183.121.

	===Allow session start in iframe===		===Allow session start in iframe===

	The session ~~need~~ to be secure (valid https) , httponly and samesite to None. All settings must be ~~sent~~ all lowercase.		The session needs to be secure (valid https) , httponly and samesite to None. All settings must be set to all lowercase.

	<syntaxhighlight lang="php" enclose="pre"> 'session' => array (		<syntaxhighlight lang="php" enclose="pre"> 'session' => array (
Line 144:		Line 148:
	===Allow csrf cookie in iframe===		===Allow csrf cookie in iframe===

	Same ~~than~~ session: must be secure and samesite to None. ~~Whole~~ array must be added at same level ~~than~~ session		Same as session: must be secure and samesite set to None. The whole array must be added at the same level as session.

	<syntaxhighlight lang="php" enclose="pre"> 'request' => array(		<syntaxhighlight lang="php" enclose="pre"> 'request' => array(

FuzzyBot: Updating to match new version of source page

2022-11-27T12:55:14Z

Updating to match new version of source page

← Older revision		Revision as of 14:55, 27 November 2022
Line 236:		Line 236:
	* '''maxLoginAttempt''': This is the number of attempts a user has to enter the correct password before he or she gets her or his IP address blocked/locked out. The default value is 3 and it can be modified from config.php.		* '''maxLoginAttempt''': This is the number of attempts a user has to enter the correct password before he or she gets her or his IP address blocked/locked out. The default value is 3 and it can be modified from config.php.
	* '''timeOutTime''': If the user enters the password incorrectly for <maxLoginAttempt>, she or he gets locked out for <timeOutTime> seconds. The default value is 10 minutes and it can be modified from config.php.		* '''timeOutTime''': If the user enters the password incorrectly for <maxLoginAttempt>, she or he gets locked out for <timeOutTime> seconds. The default value is 10 minutes and it can be modified from config.php.
			* '''maxLoginAttemptParticipants''': This is the number of attempts a participant has to enter a valid token before he or she gets her or his IP address blocked/locked out. The default value is 3 and it can be modified from config.php.
			* '''timeOutParticipants''': If the participant enters the token incorrectly for <maxLoginAttemptParticipants>, she or he gets locked out for <timeOutParticipants> seconds. The default value is 10 minutes and it can be modified from config.php.
	* '''surveyPreview_require_Auth''': Set to true by default. If you set this to 'false', any person can test your survey using the survey URL, without logging in to the administration panel and without having to activate the survey first. This setting is a default value and can be overridden in the [[Global settings\|global settings]] dialog or edited in config.php.		* '''surveyPreview_require_Auth''': Set to true by default. If you set this to 'false', any person can test your survey using the survey URL, without logging in to the administration panel and without having to activate the survey first. This setting is a default value and can be overridden in the [[Global settings\|global settings]] dialog or edited in config.php.
	* '''usercontrolSameGroupPolicy''': Set to true by default. By default, non-admin users defined in the LimeSurvey management interface will only be able to see users they create or users that belong to at least one same group. The default value can be overridden in the [[Global settings\|global settings]] dialog or edited in config.php.		* '''usercontrolSameGroupPolicy''': Set to true by default. By default, non-admin users defined in the LimeSurvey management interface will only be able to see users they create or users that belong to at least one same group. The default value can be overridden in the [[Global settings\|global settings]] dialog or edited in config.php.

FuzzyBot: Updating to match new version of source page

2022-10-08T15:35:06Z

Updating to match new version of source page

← Older revision		Revision as of 17:35, 8 October 2022
Line 479:		Line 479:
	*'''allowedfileuploads''' {{NewIn\|4.0.0}} Global restriction on file type to be uploaded		*'''allowedfileuploads''' {{NewIn\|4.0.0}} Global restriction on file type to be uploaded
	*'''magic_database:''' {{NewIn\|3.17.17}} Allow to use a different MIME database for [https://www.php.net/manual/en/function.finfo-open.php finfo_open]. Can be updated only in config.php file. Example : <code>/usr/share/misc/magic.mgc</code> for redhat based linux.		*'''magic_database:''' {{NewIn\|3.17.17}} Allow to use a different MIME database for [https://www.php.net/manual/en/function.finfo-open.php finfo_open]. Can be updated only in config.php file. Example : <code>/usr/share/misc/magic.mgc</code> for redhat based linux.
	*'''magic_file:''' {{NewIn\|3.17.17}} Allow to use a different file to get the array of extension by mime type than the [https://github.com/LimeSurvey/LimeSurvey/blob/master/~~framework~~/utils/~~mimeTypes~~.php included one]. Must be a PHP file return an array. Can be updated only in config.php file.		*'''magic_file:''' {{NewIn\|3.17.17}} Allow to use a different file to get the array of extension by mime type than the [https://github.com/LimeSurvey/LimeSurvey/blob/master/application/core/utils/fileExtensions.php included one]. Must be a PHP file return an array. Can be updated only in config.php file.

	== Update ==		== Update ==

	*'''updatable:''' This setting is in version.php. Can be true or false. If you set to true : when an super admin user log in : LimeSurvey checks if an update is available and show you a warning. If set to false : no check is done and you can't use ComfortUpdate.		*'''updatable:''' This setting is in version.php. Can be true or false. If you set to true : when an super admin user log in : LimeSurvey checks if an update is available and show you a warning. If set to false : no check is done and you can't use ComfortUpdate.