XSS is not activated. Did you look at my screenshots and what is happening there? There is definitely something wrong.
The > that I put is showing in the question, the "<" doesn't (but is in the text, thus hasn't been filtered, because the XSS is not on, I am also Superadmin)
Help us to help you!
Provide your LS version and where it is installed (own server, uni/employer, SaaS hosting, etc.).
Always provide a LSS file (not LSQ or LSG).
Note: I answer at this forum in my spare time, I'm not a LimeSurvey GmbH employee.
XSS is not activated. Did you look at my screenshots and what is happening there? There is definitely something wrong.
The > that I put is showing in the question, the "<" doesn't (but is in the text, thus hasn't been filtered, because the XSS is not on, I am also Superadmin)
yes : because XSS is not activated for you : < is not shown
The HTML are this one
<option>Choice 1 <</option>
I think you can play (as super admin) to put
Choice 1 </option> <option>Choice 2
in the same answer … and see something strange …
PS : i think we need XSS filtering for superadmin too … (by options)
Assistance on LimeSurvey forum and LimeSurvey core development are on my free time.
I'm not a LimeSurvey GmbH member. -
Professional support
-
Plugins, theme and development
. I don't answer to private message.
Hi. To help with your analysis: I just temp deactivated XSS and it did allow the greater than and less then symbols to display properly. However in our org we are required to keep it on.
Is it possible to update LS so it permits lone symbols such as greater than and less than when not in the context of an actual tag?
Also, early in this thread it was confirmed to be a bug. Do we still see it as a bug? If so, could someone continue to post that in the tracker? I know we were headed that direction but the conversation broke off into a secondary topic.
I'm asking so we know how to communicate to our client. If it's not considered a bug, we will have to have them find an alternative method to present the question. We currently have them doing the same while awaiting the previous bug fix for array type F questions. We just need to know what status to communicate to them and to know if alternative solutions need to be found for the two outstanding challenges (possibly bugs).
