Released: July 10, 2024

SurveyJS v1.11.6 includes an important fix of a security vulnerability, changes the behavior of the "Add Question" button in Survey Creator, and features a couple enhancements in Survey Creator's Toolbox: support for subitems and an API to disable individual items.

In the previous releases of Survey Creator, text properties that can be edited on the design surface (for example, survey title and description) allowed executing JavaScript code. If a text property value had a script, this script was executed when users started in-place editing of this value on the design surface. This behavior occurred only if Survey Creator used a Markdown-to-HTML converter as follows:

import { SurveyCreatorModel } from "survey-creator-core";
const creatorOptions = { ... };
const creator = new SurveyCreatorModel(creatorOptions);

function processMarkdown (survey, options) {
  // ...
}

creator.onSurveyInstanceCreated.add((_, options) => {
  if (options.area = "designer-tab" || options.area === "preview-tab"){
    options.survey.onTextMarkdown.add(processMarkdown);
  }
})

This security vulnerability is a potential threat if both of the following conditions are met: you use a Markdown-to-HTML converter and one of the usage scenarios of Survey Creator in your application is modifying survey JSON schemas created by third parties. An attacker may inject malicious code into a survey JSON schema, and this code will be executed on a victim's device when the victim starts in-place editing on the design surface. SurveyJS v1.11.6 fixes this vulnerability. Please migrate to the latest SurveyJS version if you enable Markdown support and allow users to edit third-party survey JSON schemas in Survey Creator.

Survey Creator's Toolbox contains questions and panels that users can add to their survey. Some out-of-the-box question types have logical subtypes. For instance, a Rating Scale question has three different rate types. Similarly, a Single-Line Input question has many input types. To let users quickly create these questions with a specific rate or input type, we added subitems to the Toolbox. Users need to hover over a main toolbox item to view its subitems and click or drag a required subitem to the design surface to add the question to the survey.

View All-in-One Demo

This Survey Creator release adds an API that disables individual toolbox items. This capability is useful if you want to display a toolbox item but do not want users to interact with it. The following image illustrates a disabled Rating Scale item:

To disable a toolbox item, access it using the Toolbox's getItemByName(name) method and set the item's enabled property to false:

import { SurveyCreatorModel } from "survey-creator-core";
const creatorOptions = { ... };
const creator = new SurveyCreatorModel(creatorOptions);

creator.toolbox.getItemByName("rating").enabled = false;

In Survey Creator, the "Add Question" button is displayed on the design surface and allows users to add new questions to their survey or form. Each survey page has its own "Add Question" button. Previously, this button inserted new questions after the currently selected question. Starting with Survey Creator v1.11.6, the "Add Question" button adds new questions to the end of its survey page.

We believe that this change will help avoid unnecessary jumps and scrolls that occurred when questions was inserted far from the button that added them. However, if you want to revert to the previous behavior, you can set the addNewQuestionLast property to false:

import { SurveyCreatorModel } from "survey-creator-core";

const creatorOptions = {
  addNewQuestionLast: false
};

const creator = new SurveyCreatorModel(creatorOptions);

Form Library + Standalone Angular Components

Survey Creator + Standalone Angular Components

Form Library

• Add an API method that would return survey data with or without pages and panels (#8421)
• [Angular] Pattern input mask: An invalid value is not always cleared (#8508)
• A text field with a numeric input mask and min/max settings doesn't allow deleting the value (#8501)
• onChoicesLazyLoad isn't raised every time the search string changes if it happens rapidly (#8419)
• Single-Select Matrix ignores hideIfRowsEmpty: true if a visibleIf expression evaluates to true (#8495)
• A Ranking question value is reset if the questionsOnPageMode property is changed at runtime (#8500)
• Multi-Select Matrix opens a row expansion (detail) panel if any cell in this row has an error (#8517)
• Dynamic Panel calculates tab indices incorrectly when one or more tabs are hidden using the templateVisibleIf condition (#8430)

Survey Creator

• Multi-Select Matrix: Validation settings are unavailable for matrix columns (#5623)
• Rating Scale: The "Custom rating values" table activates another item's detail form when entering a duplicate value (#5636)
• Select-based questions: When choicesOrder is "random", choices appear randomized in pop-up dialogs (#5648)
• Multi-Select Matrix: The otherPlaceholder setting is unavailable for Dropdown/Checkboxes/Radio Button Group/Tag Box matrix columns (#5645)

npm i survey-core@1.11.6 survey-angular-ui@1.11.6 --save
npm i survey-creator-core@1.11.6 survey-creator-angular@1.11.6 --save
npm i survey-analytics@1.11.6 --save
npm i survey-pdf@1.11.6 --save

npm i survey-core@1.11.6 survey-react-ui@1.11.6 --save
npm i survey-creator-core@1.11.6 survey-creator-react@1.11.6 --save
npm i survey-analytics@1.11.6 --save
npm i survey-pdf@1.11.6 --save

npm i survey-core@1.11.6 survey-vue3-ui@1.11.6 --save
npm i survey-creator-core@1.11.6 survey-creator-vue@1.11.6 --save
npm i survey-analytics@1.11.6 --save
npm i survey-pdf@1.11.6 --save

npm i survey-core@1.11.6 survey-vue-ui@1.11.6 --save
npm i survey-creator-core@1.11.6 survey-creator-knockout@1.11.6 --save
npm i survey-analytics@1.11.6 --save
npm i survey-pdf@1.11.6 --save

<link href="https://unpkg.com/survey-core@1.11.6/defaultV2.min.css" type="text/css" rel="stylesheet">
<script type="text/javascript" src="https://unpkg.com/survey-core@1.11.6/survey.core.min.js"></script>
<script type="text/javascript" src="https://unpkg.com/survey-knockout-ui@1.11.6/survey-knockout-ui.min.js"></script>

<link href="https://unpkg.com/survey-creator-core@1.11.6/survey-creator-core.min.css" type="text/css" rel="stylesheet">
<script src="https://unpkg.com/survey-creator-core@1.11.6/survey-creator-core.min.js"></script>
<script src="https://unpkg.com/survey-creator-knockout@1.11.6/survey-creator-knockout.min.js"></script>

<link href="https://unpkg.com/survey-analytics@1.11.6/survey.analytics.min.css" rel="stylesheet">
<script src="https://unpkg.com/survey-analytics@1.11.6/survey.analytics.min.js"></script>

<script src="https://unpkg.com/survey-pdf@1.11.6/survey.pdf.min.js"></script>