This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Evaluation release schedule.
Improvements
New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.
Downloadable reports should be removable - EV-431
Reports that are generated and appear as 'downloadable' reports in the report section (right bottom widget) could not be deleted. The button was shown, but the action was not always executed properly, causing a cluttered list with downloadable reports. The behaviour of the button is fixed, and reports no longer required to be downloaded can be removed again.
Next to this fix, a new option is added to support deletion of all downloadable reports. Especially handy for the users that have a cluttered list due to the bug and don't have the desire to delete the reports one-by-one.
Sorting order in period/year selector should show newest year on top - EV-458
A small fix has been made to the period/year selector. The standard order of the list was showing the 'oldest' year first. The order has been reversed, to show the latest year on top. Since the latest year is in most cases the active year, this will reduce navigating/scrolling through the historic years first.
A combined participant report should not lock the system - EV-455
An issue was found where a combined participant report with over 50 participants could lock the system. Investigation learned this was caused by partial recursive loop that caused the retrieval of data not to be 50 (number of participants), but 50*50. For smaller this will cause the report generated in the background to run a little longer, but with a large number this could lock all database session and causing the system to stop responding till sessions start being free again. This has been fixed, so in the example the call is executed the expected number of 50 times, one for each participant.
Accessibility improvements - EV-421, EV-423, EV-424
Several minor accessibility improvements have been made based on the WCAG usability and accessibility validation findings:
- Add alternative texts when icons are used (this will help screen readers)
- Make the survey full accessible by keyboard only. We found some items were not reachable using only keyboard, and fixed this incorrect behaviour
- Extend visual elements with no information for screen readers with ARIA information to make sure all visual information provides information for screen readers.
Security
An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.
Security improvements - EV-454, EV-453, EV-452, EV-435
AI can be a blessing. We read information about AI bots hacking their way into systems. This has bad things, but we decided to use this to our advantage and perform a indepth security audit using the power of AI. If they can hack the FBI, why not check if they can hack our software. We could have used a brute-force attack, but we decided to give the AI access to the code base, to provide as much information as possible enabling finding any security issues. It was also because we want to exploit the power and check if the AI would find issues that were not found by our regular security audits.
And it must be said, the AI found some issues. Luckily all identified as medium or minor, but still a good result to even improve our security further. The issues found and solved in this release are:
- The generated security-tokens should be more complexThe finding was that they could be determined using a brute-force attack, and change the length could prevent this
- Extend the SFTP connectivity with a host-key validationThis to extend the security from standard SFTP authentication with a check on the host accessing the SFTP server.
- Reports without a defined evaluation type could access all evaluationsA theoretical case, since reports require a type. But better safe than sorry, so we extended the check on evaluation type. If no type is specified the report will not show.
- The participate API endpoint exposes information not really neededThis conflicts with the Principle of Least Privilege (PoLP), and the not really necessary information is no longer exposed
- The mail logging logs the mail subject as 'INFO' and can expose recipient informationLogging uses the 'INFO' marked messages and could in this case cause that recipient info in the mail subject is visible in the logging. E.g. in case a recipient was used as a 'fill-in' field and while sending is replaced by the actual recipient information. This has be changed to only log the subject in 'DEBUG' to meet the Principle of Least Privilege (PoLP).
See the Evaluation manual for configuration guidance.