can a limesurvey be embedded in a specified web page div? if so, how?

Hello,

The quickiest and easy way is to include it in an iframe.

Denis

thanks for the reponse.


is there an example or reference for the code that would be included in the iframe? more specifically would I use a link or need to look at code on the server and replicate what is needed in the iframe?

.... www.w3.org/TR/html4/present/frames.html

I don't believe this is possible anymore, as LimeSurvey has added CSRF tokens, which are blocked in more browsers now as "third party tokens" under an iFrame.

This post was never about surveys with tokens...

OK, so if you think I mean LimeSurvey tokens, then that's not the case.

To watch for cross site references, LimeSurvey creates CSRF tokens ( think cookie, not a token like you create in the admin page for a survey ). These tokens are used when you enter and start a survey to make sure you are who you say you are and someone isn't spoofing your browser with a hidden iframe type deal. Unfortunately, Safari and mobile apps block cookies in an iFrame, so limesurvey gives you this wonder 400 error and won't let you take the survey.

Does that explain better?

You checked the setting specifically for iframes, right?
www.limesurvey.org/manual/Global_settings

bshores wrote: LimeSurvey creates CSRF tokens

LimeSurvey uses Yii 1.1 framework, which is setting the CSRF cookies.
www.yiiframework.com/doc/guide/1.1/en/topics.security

Not many settings of the Yii framework are exposed to the GUI of LimeSurvey.
You might take a look at the config files and change the default behaviour of LS/Yii there.

www.limesurvey.org/manual/Optional_settings#Session_settings

bshores wrote: …Unfortunately, Safari and mobile apps block cookies in an iFrame, so limesurvey gives you this wonder 400 error and won't let you take the survey …

I think it's fortunately

But you can test with disabling CRSF, if i remind it work with survey in all in one page.

This is running on a customers instance, and they "for obvious reasons" don't want that setting turned off.

Fortunately might be the better word, though I don't see a malicious person wanting to fill out a survey for another user without their knowledge for any good reason. I guess maybe if it was something like Amazon feedback where you wanted to pump up your reputation for a product, but in my guess, there's no good reason to spoof data.

But yes, I've had to go off the iFrame route. Can't disable CRSF in the global limequery site, and the instance I'm running on from a customer also has it on.

in admin/globalsettings#security ; IFrame embedding allowed: Allow / Same Origin

this could help