Version 8.10.20 - (released 6/27/2019)
BUG FIXES & OTHER CHANGES:•

Medium security fixes: Cross-Site Scripting (XSS) vulnerabilities were discovered on
several pages, in which a malicious user could potentially exploit them by manipulating user
inputs in various locations throughout the application.

•

Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on the Data
Import Tool page, in which a malicious user could potentially exploit it by manipulating the
CSV data import file in a very specific way and then uploading it on the page.

•

Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on the pagethat displays the error message whenever any REDCap page fails the Cross-Site Request
Forgery (CSRF) check, in which a malicious user could potentially exploit it by manipulating
the HTTP referrer being sent to the webpage.

•Bug fix: When using the Survey Queue in a project that has multiple arms, the queue might
mistakenly display the surveys for a survey participant in an incorrect order. (Ticket #64506)•

Bug fix: For certain projects, enabling an instrument as a survey in the Online Designer
might display the error message "An error occurred. Please try again.", but if the page isreloaded, it will show that the survey was actually created successfully.

•

Bug fix: When a survey participant is completing a survey with the e-Consent Framework
enabled, in which the participant is using a mobile device (iOS or specific Android
software/hardware), the last survey page would mistakenly only display the first page of theinline PDF (if more than one page) when it should instead display all pages of the PDF.
(Ticket #46978)•

Bug fix: When logic with fields from repeating instruments is used for a custom Record
Status Dashboard filter, in specific complex cases the dashboard might mistakenly notdisplay all the records that match that filter logic. (Ticket #65198)•

Bug fix: Some field labels, section headers, or custom event labels that contain certain
number patterns, such as a number followed by a colon, might not get displayed correctly,
in which odd characters and semi-colons might get mistakenly inserted before or after themin the block of text. (Ticket #64880)•

Bug fix: If a user uploads a file for a File Upload field or a Signature field on a data entry
form, and the user then leaves the page without clicking the Save button, it would correctly
upload the file but would mistakenly not trigger any Automated Survey Invitations that have
logic that references that field.

•Bug fix: When choosing to "Copy" an instrument via the "Choose action" drop-down on theOnline Designer, if the instrument was enabled as a survey and contained any stop actions,those stop actions would mistakenly not get copied to the new instrument. (Ticket #62275)•

Bug fix: When using the @DEFAULT action tag on a multi-page survey, in which a survey
field's value is being set using a field value from a previous page in the survey, then theaction tag would mistakenly not function at all if the "Require a Reason" feature had beenenabled for the project. (Ticket #54083)•

Bug fix: In the Online Designer, when creating a new matrix of fields immediately above a
section header, it would mistakenly delete that section header below when saving the new
matrix. (Ticket #62559)•

Bug fix: When viewing the Stats & Charts page for a project with repeating instruments or
repeating events, in which the report being viewed has filter logic containing fields from a
repeating instrument/event, it might mistakenly include non-relevant data in some bar charts
or scatter plots on the page. (Ticket #60147)•

Bug fix: When clicking the "Survey Queue" option at the top right of a survey page, thesurvey queue would be displayed as too wide and would be off the page and not viewable if
the respondent was viewing the survey on a mobile device. (Ticket #62318)

Version 8.10.19 - (released 6/21/2019)
BUG FIXES & OTHER CHANGES:•

Medium security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on many
pages, in which a malicious user could potentially exploit it by manipulating the query stringof an HTTP request.

•

Minor security fix: Updated the Bootstrap and jQuery libraries, which were outdated andcontained minor security vulnerabilities.

•

Bug fix: If an Automated Survey Invitation has a large lapse of time set for the units of days,
hours, or minutes in Step 3 of the ASI setup, it could mistakenly cause survey invitations not
to be scheduled appropriately (Ticket #65074)•

Bug fix: In the API Playground, the dynamically-generated code at the bottom of the pagemight mistakenly not escape apostrophes that are used in an API parameter value, thus
outputting code that would cause an error rather than running successfully for the given
programming language.

•Bug fix: If a report has a report filter than references a field in a repeating event or repeating
instrument, on certain occasions it might mistakenly not filter correctly and thus not returnthe correct results in the report. (Ticket #65481)•

Bug fix: When testing the validity of an external URL for REDCap to make requests to (e.g.,when adding a Data Entry Trigger), the test might mistakenly not be accurate with regard towhether the URL is valid. (Ticket #65521)•

Bug fix: The table of logged events on the project Logging page might mistakenly cause theusername to overflow in the table row if the username is long.

•

Bug fix: When a user is typing text into a biomedical ontology auto-search field on a survey
or data entry form, it would mistakenly log each keystroke for the field in REDCap's
redcap_log_view database table, which could cause the user's IP address to get banned in
REDCap, thus locking them out temporarily. (Ticket #42552)•

Bug fix: In certain cases, calc fields on multi-page surveys might inadvertently get skipped
and thus not calculated if all questions on that page are being hidden by either branching
logic or by the @HIDDEN or @HIDDEN-SURVEY action tag. This might cause data entry
workflow issues (e.g., fields being skipped mistakenly) if some fields on that page havebranching logic that is triggered by a hidden calc field on that page.

•Bug fix: When clicking the Records or Fields table header on the My Projects page's list of
projects, it would mistakenly not sort the column correctly if any numbers contained a nonnumeric character, such as a comma or decimal. (Ticket #64861)•

Bug fix: If a user does not have Edit Access privileges for a specific report, then it would
mistakenly display the Edit Report button at the top of the report and also the report's "Stats& Charts" page. However, if they clicked the button, it would not let them edit the report but
would merely take them back to the "My Reports & Exports" page. (Ticket #65724)•

Bug fix: When clicking an option in the "Copy existing choices" popup in the Online
Designer, it might mistakenly replace the ">" and "<" signs with their HTML character codewhen copying the choices into the Choices textbox inside the Edit Field popup. (Ticket#64268)

Version 8.10.18 - (released 5/30/2019)
BUG FIXES & OTHER CHANGES:•

Bug fix: When creating a Custom Record Status Dashboard that has filter logic, in which thelogic contains Smart Variables and also the logic references fields in repeating instruments

or repeating events, the dashboard might mistakenly not display the correct records. (Ticket#64045)•

Bug fix: Some text strings, especially URLs that get cleaned for security purposes, might get
mistakenly broken and might cause some pages not to load. (Ticket #64433)•

Bug fix: If data values are being piped onto a form/survey (into field labels, etc.) in alongitudinal project, in which the values are being piped from another event (e.g.,[other_event][field:checked]) and also the piping fields have colons in them (e.g.,[field:value], [field:checked]), it might mistakenly cause the data not to get piped but would
stay blank on the page.

•

Fixes and updates for the External Module framework, including a fix for module icons not
displaying correctly on the left-hand project menu.

•

Bug fix: When using the PDF Auto-Archive for a survey in a project that has the project-levelsetting "Character encoding for exported files" set to "Chinese (UTF-8)" on the "Edit a
Project's Settings" page in the Control Center, the Auto-Archive version of the PDF will
mistakenly have unusually wide spacing for some text in the PDF, whereas PDFs of thesurvey downloaded from the data entry form will have typical spacing.

Version 8.10.17 - (released 5/24/2019)
BUG FIXES & OTHER CHANGES:•

Medium security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on many
pages, in which a malicious user could potentially exploit it by adding specific user-definedHTML that gets displayed on certain webpages throughout the application (e.g., in fieldlabels on instruments; in survey instructions).

•

Bug fix: The field mapping page for Clinical Data Pull (CDP) and Dynamical Data Pull (DDP)
Custom would mistakenly not load the field table correctly if attempting to map new source
fields for the project.

•

Bug fix: When suspending or unsuspending a user on the Browse Users page in the Control
Center, the user search feature above will mistakenly no longer perform auto-complete
functionality when typing in that text box (unless the page is refreshed). (Ticket #64071)•

Bug fix: When running a Data Quality rule or performing a data import of fields used in a
calculation, the resulting calculations that get saved might be incorrect if the project islongitudinal and if Smart Variables are used in the rule's logic. (Ticket #63606)

•Bug fix: When running Data Quality rule H or performing a data import of fields used in a
calculation, the resulting calculations that get saved might be incorrect if the project islongitudinal and if Smart Variables are used in the calculation. (Ticket #63156)•

Bug fix: When an Automated Survey Invitation has conditional logic that references fields on
multiple events, including an event that does not yet have any data saved for it, then the
ASI might mistakenly not get triggered appropriately if the project is both longitudinal andalso has either repeating events or repeating instruments. (Ticket #59942)•

Bug fix: If an MDY- or DMY-formatted date/datetime field is piped into the choice label of adrop-down field, then the date value might get scrambled and not formatted correctly whendisplaying the date inside the drop-down label on a form or survey. (Ticket #64223)•

Bug fix: If users are not allowed to create/copy projects but must request them becreated/copied, then when an administrator is approving a "Copy Project" request in whichsome users are in user roles in the project but the requester has chosen not to copy theuser roles into the new project, then it could cause the newly created project to have a"ghost" role (with no apparent name) that is still attached (in certain regards) to the oldproject. For example, if a user in the "ghost" role had an API token in both the new andoriginal project, then when using the token to make API requests in the new project, it might
mistakenly think that the token belongs to the old project instead. (Ticket #63667)•

Bug fix: An example link on the "Help & FAQ" page was mistakenly linking to the wrong
example website.

Version 8.10.16 - (released 5/17/2019)
BUG FIXES & OTHER CHANGES:•

Bug fix: The Clinical Data Pull (CDP) would not function successfully on Cerner systems
because part of REDCap’s OAuth2 authorization process for FHIR only worked for Epic.

•

Bug fix: If using MySQL 8 for the REDCap database, the Calendar page in a project might
mistakenly not display any calendar events on the page. (Ticket #63434)•

Bug fix: In certain situations, the External Module framework might mistakenly call afunction twice on the Data Comparison Tool page, thus causing the page to crash fatallyand preventing it from loading in certain projects.

•

Bug fix: The Clinical Data Pull (CDP) would not function successfully on Cerner systems
because FHIR requests for pulling labs and vitals were mistakenly not utilizing the correct
format for LOINC codes passed in the request's query string.

•Bug fix: If a survey has the PDF Auto-Archiver enabled (with or without the e-Consent
Framework enabled), when the survey is completed, it would mistakenly log the action as a
Data Export action as if a user has manually downloaded the PDF. It should not log thisevent and is confusing to users.

•

Bug fix: When using the Twilio telephony services for surveys, in which a telephone/number
field has been designated as the "phone number field for survey invitations", it would
mistakenly not display the record name on the Survey Invitation Log to prevent users fromviewing it *unless* the Designated Email Field was enabled for the project or if a Participant
Identifier had been entered in the Participant List. (Ticket #49955)•

Bug fix: When viewing a non-saved instance of a repeating event on a data entry form, theform status icons on the left-hand menu might mistakenly show the cumulative status of all
the existing saved instances of the repeating event when instead it should display a graystack icon since the current form-event-instance has not yet been saved. (Ticket #63956)•

Bug fix: When opening the "Set up Survey Queue" popup in the Online Designer, if the
project contained many records (e.g., 1000+) and also many surveys, then the popup might
not be able to open at all.

•Bug fix: When a survey participant partially completes a public survey and then returns tothe survey to complete it later, it would mistakenly say "Response is only partial and is notcomplete" in the PDF if a user downloads the response as a PDF from the data entry form.
(Ticket #62831)

Version 8.10.15 - (released 5/10/2019)
BUG FIXES & OTHER CHANGES:•

Bug fix: When enabling the Clinical Data Pull (CDP) module in a project, it would mistakenly
say "Enable DDP on FHIR" in the Logging. It should instead say "Enable the Clinical Data
Pull (CDP) module" in the Logging since that module was renamed and is no longer called"DDP on FHIR".

•

Bug fix: The FHIR web service requests made by the Clinical Data Pull module would
mistakenly make calls to the FHIR "Observation" endpoint using a format that was notcompatible with some Epic installations. This was modified to a slightly more compatible
format. (Ticket #63080)•

Bug fix: When clicking the form status stack icon on the Record Home Page or Record
Status Dashboard for a repeating instrument/event, the popup displaying all the repeatinginstances would sometimes not be positioned correctly on the page and might be too
narrow.
•

Bug fix: When using the @DEFAULT action tag in a repeating survey, it might mistakenly
think that the current survey has data and thus would prevent the action tag from operating,even when no data exists for that survey on that repeating instance.

•

Bug fix: When importing data (via the Data Import Tool or API import) for a repeating event,if the field "redcap_repeat_instance" is not included as a field in the imported data set,instead of returning an error message, it would mistakenly allow the data to get imported.
While this causes no problems for the first imported batch of data, any subsequent imports
would mistakenly get piled on top of the existing data in the database (rather than updating
the existing values), thus causing duplicate/multiple rows of data to pile up in the databasefor a given record/event/field, which could have various negative consequences, such as
making some project pages very slow. Now it will instead return an error message if data for
a repeating event is being imported in which the field "redcap_repeat_instance" is notincluded as a field in the imported data set. (Ticket #63128)

Version 8.10.14 - (released 5/3/2019)
BUG FIXES & OTHER CHANGES:•

Bug fix: Certain types of HTML tags in a field label might cause parsing issues whenexporting to stats packages, especially SAS. To prevent this, all HTML tags will now be
removed from field labels as they are included in the stats package syntax files. (Ticket#57751)•

Bug fix: When calling the "Export Records" API method, if any invalid values were passed in
the API request parameters "events", "fields", or "forms", it would often ignore the incorrect
value and would mistakenly not return an error. Additionally, in this scenario it might
mistakenly return all events, all fields, or all forms, respectively, rather than limiting the data
returned to only the valid values in those filter parameters. (Ticket #54273)•

Bug fix: If a production project is in Draft Mode, and a matrix field's label has been modified*and* the field has data saved for one or more records, this is now considered a criticalissue during the production change approval process because of specific cases wherechanging a matrix field's label can change its meaning and thus negate the existing data much more so than with regular non-matrix fields. (Ticket #60834)•

Bug fix: If a repeating instrument is enabled as a repeating survey, and then later the
instrument is set to no longer be repeating via the "repeatable instruments" dialog on theProject Setup page, it would mistakenly still display the repeating survey icon (i.e., green
circle arrow) next to the instrument in the Online Designer. (Ticket #60869)•

Bug fix: If running a REDCap server with PHP 7.3, then the PDF Auto-Archiver would fail,as well as attempts to add PDF attachments to confirmation emails when surveys arecompleted. In all cases, it would crash with an HTTP 500 sever error. (Ticket #55868)•

Bug fix: Some Smart Variables, especially those related to repeating instance, would
mistakenly not pipe correctly inside survey instruction text and survey completion text.

Version 8.10.13 - (released 4/26/2019)
BUG FIXES & OTHER CHANGES:•

Bug fixes and updates for External Module framework•

Bug fix: If hyperlinks exist inside multiple choice labels on a survey that has Enhanced
Choices enabled, the hyperlinks might mistakenly not be displayed in the correct color(depending on the survey design settings) and thus might not be readable.

•

Bug fix: For multi-page surveys having fields with branching logic, in very specific situations
some pages of the survey might mistakenly get skipped over. (Ticket #62299)•

Bug fix: When a hook or External Module is using REDCap::saveData() on a project pageand importing data into another project, it may mistakenly change the global variable $Proj
to point to the other project, thus causing possible issues on the page after the
REDCap::saveData() method has been called.

•

Bug fix: When importing data for a repeating instrument or event (via API or Data Imort
Tool), it would mistakenly be possible to import a non-integer number value (e.g., 2.1, 5.44)
for the redcap_repeat_instance field.

•

Bug fix: The Action Tag @NONEOFTHEABOVE fails to work if it references a choice notwrapped in quotes and is also followed by other text in the Field Annotation - e.g.,""@NONEOFTHEABOVE=0 @INSTANCETABLE_HIDE". (Ticket #61939)•

Bug fix: When using the Twilio telephony services for surveys, in which a telephone/number
field has been designated as the "phone number field for survey invitations", it would
mistakenly not display the record name on the Survey Invitation Log to prevent users fromviewing it. Since a field's value is being used, the response is already de-anonymized (i.e., auser can connect the participant in the Participant List to a specific record), thus it should
not hide the record name in the Survey Invitation Log. (Ticket #49955)

Version 8.10.12 - (released 4/19/2019)

BUG FIXES & OTHER CHANGES:•

Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on the Data
Import Tool page, in which a malicious user could potentially exploit it by manipulating data
values for a specific field being imported in the CSV data file.

•

Bug fixes and updates for the External Module framework•

Bug fix: On the Online Designer, when using the "Test logic with a record" feature for the
Advanced Branching Logic Syntax in the "Add/Edit Branching Logic" popup or the "Testcalculation with a record" for a Calculation in the "Add/Edit New Field" popup, it would
mistakenly say that there was an error in the syntax every time if the project is longitudinal.
(Ticket #54822)•

Bug fix: On the Survey Settings page, if a survey has the e-Consent Framework enabled,
and then an administrator disables the e-Consent Framework for all projects in the system(via the Modules/Services Configuration page in the Control Center), then the Survey
Settings page would mistakenly still display the e-Consent Framework options. (Ticket#62075)•

Bug fix: When the Double Data Entry module is enabled in a project, and the current user is
DDE person #1 or #2, it would not display the form status icons with the correct color on the
Record Status Dashboard but would instead mistakenly always display them as gray status
icons. This bug emerged in the previous version. (Ticket #62212)•

Bug fix: The Clinical Data Pull (CDP) would not function successfully on Cerner systems
because part of REDCap’s OAuth2 authorization process for FHIR only worked for Epic.

Version 8.10.11 - (released 4/12/2019)
BUG FIXES & OTHER CHANGES:•

Major bug fix: The DateDiff+Today/Now cron job would sometimes crash due to a fatal
PHP error caused when processing the [survey-link] Smart Variable in the message of an
Automated Survey Invitation. This would occur only under very specific conditions, and it
would result in many projects/records not having their ASI datediff logic being processed,
thus the ASI's survey invitations would not get successfully scheduled in these cases andmight cause invitations from other unrelated projects not to get scheduled either. (Ticket#61346, #61213)•

Major bug fix: When a project is using a public survey that has "Save & Return Later"
enabled with "Allow respondents to return without needing a return code" enabled, then if aparticipant clicks the "Save & Return Later" button on the public survey and leaves thesurvey open on the "Your survey responses were saved!" page while another participant
partially or fully completes the survey, and then if the original participant clicks the "Continue
Survey Now" button on the "Your survey responses were saved!" page, then the original
participant will mistakenly create a brand new record/response whenever they submit
survey page again after returning. (Ticket #61764)•

Bug fix: When viewing the Field Comment Log popup on a data entry form, if the username
in the User column is very long, it would mistakenly not wrap in the table but instead would
overflow into the next column. Note: This was only partially fixed in a previous version.
(Ticket #60923)•

Bug fix: In a project that has sent many survey invitations (e.g., >50,000), it could cause
both the Public Survey Link page and the Participant List page to load very slowly and insome cases never fully load at all.

•Bug fix: When using the Clinical Data Pull, it would mistakenly make a POST request(instead of a GET request) to the Conformance Statement (metadata) endpoint. This would
only cause issues with certain EHRs/configurations. (Ticket #61549)•

Bug fix: For some pages in REDCap, the PHP constant "PAGE" might mistakenly get set as"/index.php" rather than "index.php", which could cause problems for existing External
Modules or hooks that must utilize the value of PAGE to determine the current location. This
has now been changed so that any slashes at the beginning of PAGE will be trimmed off
before it gets defined. (Ticket #61776)•

Bug fix: When exporting data in CSV Labels format for projects whose language is set to alanguage other than the default English, it would mistakenly always display *all* the choicelabels for checkbox fields in the export file, rather than outputting the choice labels for only
the checkbox options that had been selected for that field. (Ticket #60620)•

Bug fix: When the Double Data Entry module is enabled in a project, and the current user is
DDE person #1 or #2, it would not display the form status icons with the correct color on theleft-hand menu when viewing a record but would instead mistakenly always display them asgray status icons. (Ticket #57484)•

Bug fix: The DateDiff+Today/Now cron job would mistakenly get run for projects that had
been deleted in the past 30 days. It now ignores any projects that have been deleted by a
user.

•

Bug fix: When using the e-Consent Framework for a survey, the resulting PDF of theconsent survey would mistakenly not obey the project-level PDF Customization setting toshow or hide the REDCap logo/URL under specific conditions. This would vary depending

on if certain settings were set for the e-Consent Framework, such as having first/last namefields defined or consent version. (Ticket #58221)•

Bug fix: When using the e-Consent Framework for a survey, if custom PDF header text is
set under the project-level PDF Customization settings, it would mistakenly not get
displayed on the resulting PDF of the consent survey.

Version 8.10.10 - (released 4/4/2019)
BUG FIXES & OTHER CHANGES:•

Minor security fix: If a malicious user is able to find the URL endpoint at which REDCap
Messenger's message history can be downloaded as a CSV file for a given conservation,
they could potentially exploit it by manipulating the query string of the HTTP request, whichmight allow them to download other users' conversations to which they do not have access.

•Minor security fix: If the hook functions file (as defined on the General Configuration pagein the Control Center) begins with "http" or "ftp", then REDCap will not attempt tocall/include that path.

•

Major bug fix: When using Smart Variables in the conditional logic of an Automated Survey
Invitation, in which the logic also contains a datediff function using "today" or "now" as aparameter in the function, it would often cause the ASI cron job to not correctly parse thelogic and thus not schedule the invitations at the correct time, or it might mistakenly cause
the cron job to crash unexpectedly without finishing scheduling all other ASIs for othersurveys.

•Bug fix: When using branching logic or a calculation that contains a X-event-name or Xinstance Smart Variable connected, in which it references an event or instance that does
not exist (e.g., [previous-event-name] while on the first event), it would not fail gracefully but
would mistakenly display an error message saying that the logic/calculation is incorrect.

•

Bug fix: When completing an Adaptive survey or Auto Scoring survey from the REDCap
Shared Library, the "redcap_survey_complete" hook would mistakenly not pass a value forthe "record" and "response_id" parameters in the hook. (Ticket #60668)•

Bug fix: If the Clinical Data Pull feature is enabled for a project, it would still mistakenly
display "DDP" (instead of "CDP") in a couple places in the project (Record Status
Dashboard, Logging page).

•

Bug fixes and updates for External Modules framework•

Bug fix: A single LOINC lab was mistakenly missing from the field mapping page for Clinical
Data Pull.

•

Bug fix: If a multi-page survey contains a page in which every field on the page is a
Descriptive field and also has branching logic, it would mistakenly always skip the pageregardless of whether all the fields were hidden by branching logic.

•

Bug fix: When the redcap_survey_identifier field is displayed in a report or data export, it
would mistakenly only display the participant identifier value on the first event of a given
record and would not display it if the first instrument was a repeating instrument. It now
always displays the participant identifier value in the redcap_survey_identifier column of areport/export for every row/item for a given record. (Ticket #59811)•

Bug fix: The FHIR web service requests made by the Clinical Data Pull module would
mistakenly make calls to the FHIR "Observation" endpoint using a slightly incorrect format
according to HL7's FHIR standards. This does not appear to affect CDP when interfacingwith Epic but when interfacing with other EHR vendors (notably Cerner). (Ticket #61150)•

Bug fix: The code for generating the Survey Queue setup table was mistakenly referencing
variables that had not been defined. However, this did not affect anything. (Ticket #61030)•

Bug fix: If the setting "Auto-suspend users after period of inactivity" is enabled, and someusers who are suspended have not had any activity within the designated period ofinactivity, then if the user has a sponsor and the user's sponsor puts in a request to havethem unsuspended, the user would mistakenly get re-suspended within a day. (Ticket#58909)•Bug fix: If a normal user is copying a project and is also in a User Role, it would mistakenly
not give them their current role's privileges in the new project but instead would give them
the privileges that they had before being put into a role in the copied project. (Note: Theuser will always be removed from the user role in the new project and will always be given
User Rights and Project Setup/Design Privileges.) (Ticket #55767)•

Bug fix: If an administrator is viewing the table of users on the Browse Users page, if they
check the checkbox next to a user and then click the "Fetch for selected" link (under "Timeof latest password reset"), it would display an erroneous error message about no users
being selected if all the selected users are suspended. It should instead work for all tablebased users regardless of whether the users are suspended or not. (Ticket #60625)•

Bug fix: When exporting an Project XML file containing data from a project, if any multiple
choice option labels contain ASCII control codes, it would mistakenly prevent the data frombeing restored completely in the new REDCap project being created. (Ticket #34968)•

Bug fix: The plugin/module method named "REDCap::evaluateLogic" might mistakenly notinterpret logic correctly it it contains checkbox fields and if the project is classic/nonlongitudinal. (Ticket #60998)

Version 8.10.9 - (released 3/24/2019)
BUG FIXES & OTHER CHANGES:•

Medium security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on many
pages, in which a malicious user could potentially exploit it by manipulating the query stringof an HTTP request.

•

Major bug fix: When the Clinical Data Pull (CDP) is enabled on a project, if extra data isimported from the EHR for several patients at one time via the cron job (after a user has
already pulled some patient data from the EHR for those patients), in certain cases it might
mistakenly not clear out data from another patient whose data is being fetched and thus
inadvertently add one patient’s data to another patient.

•Bug fix: Some data exports were not getting correctly logged as "Data Export" on the project
logging page, specifically when downloading PDFs with data and downloading an "exported
data file" or an "exported syntax file". It now lists "Data Export" as the proper Action forthese events and also displays them when filtering the logging page by event="Data
Export". (Ticket #59278)•

Bug fix: When updating the value of the Secondary Unique Field or the designated survey
email field for a project that is either longitudinal or has repeating events/forms, it would
mistakenly not log the value change across all events/instances as it should since a newvalue for those fields gets propagated to every event/instance in the project to keep them allin sync. They now all get logged as separate logged events, which allows the value toalways appear in the Data History widget on the data entry page. (Ticket #59586)•

Bug fix: When performing piping of a field with the Smart Variable [X-instance] appended to
the field variable, it would sometimes mistakenly not perform the piping at all. (Ticket#59671)•

Bug fix: When performing piping of the Smart Variable survey-time-completed or surveydate-completed with the parameter ":value" appended to the end of it, it would mistakenly
throw an error on a survey or data entry form if it was being used in branching logic or in a
calculated field. (Ticket #59885)

Version 8.10.8 - (released 3/15/2019)
BUG FIXES & OTHER CHANGES:•Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on certain
pages, in which a malicious user could potentially exploit it by manipulating the query stringof an HTTP request.

•

Bug fix: Incorrect text was displayed in the Edit User popup on the User Rights page that
mistakenly referenced "Clinical Data Pull" instead of "DDP" in projects with DDP Custom
enabled.

•Bug fix: If the REDCap web server is running on PHP 5.3 or 5.4, it would cause the Create
Project page to not fully be displayed and would prevent users from creating new projects.
(Ticket #57121)•

Bug fix: If a survey that has Survey Auto-Continue enabled is a repeating instrument and isthen followed by another survey that is a repeating instrument, then if respondent completes
the first survey, it will mistakenly take them to repeating instance #2 of the following survey,
thus skipping over instance #1.

•

Bug fix: Fixed typo in Clinical Data Pull error message. (Ticket #59005)•

Bug fix: When launching patients in the EHR embedded window for the Clinical Data Pull, in
certain situations, especially if the user does not have access to all the FHIR end-points(often due to a limitation in their EHR privileges), it might mistakenly cause the FHIR accesstoken in the database to get removed for that user for that patient, thus resulting in an error
message to the user stating that there are no available access tokens that can be used.

•

Bug fix: When using the Data Resolution Workflow, the Resolve Issues page might
mistakenly display negative counts for certain data query statuses.

•

Bug fix: When importing data where the field "redcap_repeat_instance" has a numericalvalue but the current event/form in the data (i.e., CSV row) does not exist on a repeating
instrument or repeating event, it would mistakenly allow the data to be imported, but theimported data would immediately be orphaned since that data would not be accessible in
the user interface. It now gives an error for this situation. This issue was supposedly fixed in
the previous version (and the version before that), but mistakenly it would sometimes
display a false positive for this issue and return the error under legitimate circumstances,
specifically when only checkbox fields were being imported (not including the record ID
field, event name, or repeat fields). (Ticket #57699)•

Fixes and updates for the External Module Framework•

Bug fix: When viewing the REDCap login page on a mobile device (device width <575pixels), it would mistakenly display a "Go to My Projects" button on the page. (Ticket#59494)•

Bug fix: When using the Data Resolution Workflow in a project and opening a data query ona field on a data entry form, the floating Save button that appears next to the field when thefield is selected was mistakenly not being displayed in the correct location on the page if the
field, specifically when navigating from a link on the Resolve Issues page for a radio button
field. (Ticket #59373)•

Bug fix: When using the "Test logic with a record" feature when setting up an AutomatedSurvey Invitation, on certain occasions it might return an incorrect response. (Ticket#59030).

•Bug fix: The HTML character code " " might mistakenly get displayed in the text of PDFs
downloaded for an instrument but only if downloading the blank PDF (without data). (Ticket#58790)•Bug fix: When using the Randomization module with strata fields, in which one or morestrata fields exist as part of a matrix of fields, it would mistakenly cause a JavaScript error to
occur on the data entry form where the strata fields are located, thus preventing the form
from being saved successfully. (Ticket #59639)•

Bug fix: The field count for projects on the My Projects page was mistakenly not including
Descriptive fields. This could be confusing for users. It now includes all fields in the fieldcount now. (Ticket #60004)•

Bug fix: When performing piping of a field with the Smart Variable [next-event-name],[previous-event-name], or [event-name] prepended to the field variable, it would sometimes
mistakenly not perform the piping at all. (Ticket #44559)

Version 8.10.7 - (released 2/21/2019)
BUG FIXES & OTHER CHANGES:•

Bug fix: When importing data where the field "redcap_repeat_instance" has a numericalvalue but the current event/form in the data (i.e., CSV row) does not exist on a repeating
instrument or repeating event, it would mistakenly allow the data to be imported, but theimported data would immediately be orphaned since that data would not be accessible in
the user interface. It now gives an error for this situation. This issue was supposedly fixed in
the previous version, but mistakenly in the previous version it would sometimes display afalse positive for this issue and return the error under legitimate circumstances. (Ticket#57699)•Bug fix: The example Java code generated by the API Playground for the "Export Records"
API method contained an error. (Ticket #58488)•

Bug fix: Some specific PROMIS assessments that are downloading from the REDCap
Shared Library as part of a battery might be mistakenly labeled as "Auto-scoring" or"Adaptive" in the Online Designer after being downloaded when such instruments are
actually neither "Auto-scoring" nor "Adaptive". (Ticket #58488)•

Bug fix: If using the Survey Auto-Continue feature to continue to a survey that is a repeating
survey instrument, if any repeating instances have already been created for that repeating
survey, then after completing the first survey, it would mistakenly say that the repeating
survey has already been completed. It should instead advance the respondent to the next
available repeating instance of the repeating survey so that a new repeating instance canbe added via survey. (Ticket #58624)•

Bug fix: When exporting an Project XML file containing data from a project, if any text fieldvalues contain ASCII control codes, it would mistakenly prevent the data from being
restored completely in the new REDCap project being created. (Ticket #34968)•

Bug fix: Fixed a typo in the Twilio configuration instructions. (Ticket #58731)•

Bug fix: When downloading the Project XML file (metadata only) for a project, it might
mistakenly begin and end the XML filename with an apostrophe.

Version 8.10.6 - (released 2/15/2019)
BUG FIXES & OTHER CHANGES:•

Text changes: The “DDP on FHIR” feature was renamed “Clinical Data Interoperability
Services”. The main (and currently only) feature under the “Clinical Data Interoperability
Services” umbrella of services is the “Clinical Data Pull” (CDP). Other services will be addedin future versions of REDCap, such as “Clinical Data Mart”.

•

Bug fix: After the initial schedule is generated for a record on the Scheduling page, if theuser modifies one of the dates in the schedule so that it is the same as the maximum dateor minimum date (if a min/max is set for an event), then on certain occasions it would
mistakenly display a popup saying that the new date is out of range when in fact it is not.

•Bug fix: Several project pages might appear too narrow for specific screen sizes. Bug
emerged in REDCap 8.10.4.

•

Bug fix: Updated an outdated item on the Help & FAQ page regarding how often the ASI
cron job runs (Ticket #58205).

•

Bug fix: When using the @DEFAULT action tag to have a date/datetime field reference itself
from a previous repeating instance on a repeating instrument, it would mistakenly not pipein the value correctly on the first instance of that instrument, thus mangling it with a value of"[]" or "00-00-0000" or other non-sensical value. (Ticket #17157)

•Bug fix: When using the Data Resolution Workflow in a project and opening a data query ona field on a data entry form, the floating Save button that appears next to the field when thefield is selected was mistakenly not being displayed in the correct location on the page.
(Ticket #57905)•

Bug fix: For specific server configurations and project sizes, the project Logging page mighttake an exorbitant amount of time to load when initially loading the page. (Ticket #58251)•

Bug fix: When importing data where the field "redcap_repeat_instance" has a numericalvalue but the current event/form in the data (i.e., CSV row) does not exist on a repeating
instrument or repeating event, it would mistakenly allow the data to be imported, but theimported data would immediately be orphaned since that data would not be accessible in
the user interface. It now gives an error for this situation. (Ticket #57699)•

Bug fix: If REDCap's "Easy Upgrade" functionality is enabled and the REDCap web serveris running PHP 5.3 or 5.4, it would mistakenly allow administrators to use Easy Upgrade to
upgrade to REDCap 8.11.0 (Standard) or higher. It should not allow this upgrade path since
REDCap 8.11.0+ requires PHP 5.5.0 or higher.

•

Bug fix: When calling the API method "Export Survey Participants" while utilizing thedesignated survey email field in the project, it would mistakenly omit the values for theparticipant's email address or record name in the API response. (Ticket #58349)•

Bug fix: When calling the API Method "Export Records" with the "format" parameter set to"odm", it would mistakenly not include all files from File Upload and Signature fields, which
are expected to be base64-encoded inside the ItemDataBase64Binary tags in the resulting
XML. (Ticket #54301)•

Bug fix: On the To-Do List page in the Control Center, if an administrator clicks the icon to
add a comment to a To-Do List item, the "Submit" button in the resulting popup displayed
would not be sized or positioned correctly. (Ticket #54301)

Version 8.10.5 - (released 1/31/2019)
BUG FIXES & OTHER CHANGES:•

Bug fix: If an individual project was set to "Offline" status by an administrator, any survey
invitations in that project that had been scheduled to send would mistakenly still send.
Invitations should not be sent out unless the project is in "Online" status. (Ticket #57045)•

Bug fix: Many API requests would mistakenly return a "503" HTTP status code error on
certain errors when it should instead return a "400" error.

•Bug fix: When downloading a PROMIS Battery from the REDCap Shared Library, it would
mistakenly not display the battery survey pages according to the PROMIS guidelines, inwhich the battery title should be displayed on every page (not the title of each individual
assessment) and that the survey instructions are only seen on the first assessment of thebattery. This will only affect batteries that will be downloaded in the future from the Shared
Library. Also, although these particular title and instructions settings will be set when abattery is downloaded, it will always be possible for a user to modify the title and/or
instructions afterward, if they wish (though it is not preferred).

•

Bug fix: When a participant completes a PROMIS adaptive survey or PROMIS auto-scoring
survey that finishes after only one question, it might mistakenly not save the survey
completion time of the survey response.

•

Bug fix: The last column in the Participant List table might not be displayed fully. (Ticket#57184)•

Bug fix: Under certain conditions, REDCap Messenger's "System Notifications" section
would mistakenly not display the messages for that section in the Messenger panel. (Ticket#57247)•

Bug fix: When selecting to view Report B on the "Data Exports, Reports, and Stats" page fora longitudinal project, if the report is displayed as a multi-page report and specific events
have been selected as a filter by the user, then if the user selects another report page toview using the page drop-down selector, it would mistakenly lose the event filter for thereport (because the "events" parameter would not get included in the URL) and thus would
display rows from every event on the page. (Ticket #57254)•

Bug fix: For certain server configurations, when REDCap is creating a cache of a project's
record list in a database table (as an invisible, back-end process to the user), it might
mistakenly doubly UTF8-encode some record names, resulting in a database query error,
thus causing the record list caching process to constantly fail and possibly display an
outdated list of records in the user interface (e.g., Record Status Dashboard). (Ticket#56523)•

Bug fix: If a Custom Record Status Dashboard has filter logic that references fields from a
repeating instrument, it might mistakenly return an empty set, thus resulting in a dashboard
with no records displayed, when it is known that some records should be displayed. Bug
emerged in REDCap 8.10.4 (LTS). (Ticket #57234)•

Bug fix: The lab field "Ketones Ur-mCnc" (LOINC 49779-2) was mistakenly missing from the
DDP on FHIR list of mappable fields.

•Bug fix: The cron job "AutomatedSurveyInvitationsDatediffChecker2" might mistakenly
crash if SQL fields are piped into the email subject or email message of Automated Survey
Invitations that contain datediff + today or now in the ASI conditional logic. (Ticket #57356)•

Bug fix: When editing the project title, purpose, etc. in the Modify Project Settings popup on
a project's Project Setup page, if Research is selected for Purpose, then the fields forentering the Name of the P.I. would mistakenly not wrap together, thus leaving the last
name field on a row by itself. (Ticket #57417)•

Bug fix: When exporting Report B (i.e., without creating a new report from the selections ofReport B) on the "Data Exports, Reports, and Stats" page, if a specific instrument is notselected but "All instruments" are left selected, it might mistakenly not list any fields in the
resulting stats package syntax file (for R, SAS, Stata, SPSS), thus preventing the exported
data from loading properly in the stats package.

•Bug fix: On the Cron Jobs page in the Control Center, the suggested command to set up
the REDCap cron job on a Windows server was mistakenly not escaping paths that
contained a space in them. This has been fixed to present the correct command. (Ticket#57426)

Version 8.10.4 - (released 1/24/2019)
BUG FIXES & OTHER CHANGES:•

Major bug fix: When a project is using a public survey that has "Save & Return Later"
enabled with "Allow respondents to return without needing a return code" enabled, then if aparticipant clicks the "Save & Return Later" button on the public survey and leaves thesurvey open on the "Your survey responses were saved!" page while another participant
partially or fully completes the survey, and then if the original participant clicks the "Continue
Survey Now" button on the "Your survey responses were saved!" page, then the original
participant will mistakenly have the other participant's response loaded for them on thesurvey page.

•Bug fix: When using REDCap::getData() in a module, plugin, or hook, in which some filter
logic is passed as a parameter and is expected to return an empty result set (because there
are no matches for the filter logic), it might instead mistakenly return results with blankvalues for all fields being returned (with the exception of the record ID field and pseudofields, such as redcap_event_name), even though those fields might actually have nonblank values. (Ticket #56806)

•

Bug fix: When a user selects to display "ALL" records on the Record Status Dashboard in a
project containing a large amount of records, if the page ends up crashing due to too manyrecords being displayed, then the user would mistakenly never be able to view the Record
Status Dashboard again without it crashing (because it remembers to show all records thenext time the page is visited). (Ticket #56662)•

Bug fix: If a calc field utilizes Smart Variables in its calculation, and a user performs a data
import or executes Data Quality rule H, then other calculated fields in the project might havetheir value mistakenly set as the calculated result of the other calc field, thus overwriting thecorrect value of that other calc field. This is rare but can occur in specific situations
depending on the structure of the project and the order of the calc fields involved. (Ticket#56731)•

Bug fix: If the Data Resolution Workflow is enabled in a project, then incorrect language isdisplayed inside the "Data Quality rules were violated!" popup on a data entry form
whenever a Data Quality rule has "real time execution" enabled.

•

Bug fix: When viewing the Field Comment Log popup on a data entry form, if the username
in the User column is very long, it would mistakenly not wrap in the table but instead would
overflow into the next column.

•

Bug fix: When a user attempts to access a REDCap project that has been set to "Offline" on
the "Edit a Project's Settings" page by an administrator, it would mistakenly display thedefault system-offline message rather than the project-offline message. (Ticket #56938)•

Bug fix: Certain project pages might not display correctly on tablets (causing the main righthand window to display below the left-hand menu), especially if the project's language is set
to a non-English language. (Ticket #56872)

Version 8.10.3 - (released 1/22/2019)
BUG FIXES & OTHER CHANGES:•

Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on certain
pages, in which a malicious user could potentially exploit it by manipulating the query stringof an HTTP request.

•

Bug fix: In server environments with PHP error reporting enabled, it would display adeprecation notice regarding the constructor of several PHP classes. (Ticket #55557)•

Bug fix: When viewing an individual user on the Browse Users page in the Control Center, if
the user is a Table-based authentication user and their secondary or tertiary email address
has not yet been verified, then it would mistakenly not display the buttons to auto-verify theaddress or re-send the verification email to the user. This only occurs if the user is a Tablebased user.
•

Bug fix: When a form or survey is submitted, in which there do not exist any fields on the
instrument that are used in a calculated field anywhere in the project, then it would
mistakenly trigger the calculation of all calc fields in the project. It should instead only trigger
calculations if a field being submitted is used in a calculation. (Ticket #55192)•

Bug fix: The "Export Survey Participants" API method would mistakenly not include someparticipants in the resulting API response if those participants had not first been viewed by auser either on the Participant List page or on the data entry form for the survey instrumentthat was passed as a parameter in the API request. Once a user had viewed the data entry
form or Participant List for that instrument, the participants would then appear in the API
export. (Ticket #55517)•

Bug fix: When creating a project and selecting the option to upload a REDCap Project XML
file, if the user fails to upload an XML file and then clicks the "Create Project" button, it
would mistakenly create an empty project. It should instead give a warning to the user to
upload an XML file and prevent the user from submitting the page. (Ticket #55731)•

Bug fix: When a user makes a request to an administrator that a project be copied, it would
mistakenly not check off some of the checkboxes on the Copy Project page when theadministrator loads the page via the link in the email or via the To-Do List. This includes thefollowing options: All report folders, All data quality rules, All project bookmarks, and All
custom record status dashboards. (Ticket #55751)•

Bug fix: When attempting to rename a record to "0" on the Record Home Page, it would failand return an error message to a user. (Ticket #55723)•

Bug fix: When using the Smart Variables form-link, form-url, survey-link, or survey-url tocreate links/URLs either to or from a repeating instrument or repeating event, it might
mistakenly add the instance number of the current context to the URL when instead it
should evaluate whether or not the instance number makes sense to be added to the target
URL. (Ticket #54776)•

Bug fix: When using Twilio telephony services for surveys, U.S. phone numbers having thearea code "463" would mistakenly not work for SMS or voice calls unless the number has a"1" prepended to it. (Ticket #55668)•

Bug fix: When adding/editing/deleting a Report Folder or assigning/unassigning a report to aReport Folder and then closing and re-opening the Report Folder popup, the user would
mistakenly no longer be able to perform any actions inside that popup (as if its elements
were locked). (Ticket #55878)

•Bug fix: When a user enters an incorrect password on the login page, it might mistakenly
cause some of the custom login text (if any) to become disproportionally enlarged. (Ticket#55945)•

Bug fix: When creating/editing a record on a data entry form, in which the record namecontains a forward slash or back slash, it may cause a Data Quality rule with Real Time
Execution not to get triggered correctly or cause the Required Field popup alert not todisplay correctly. (Ticket #56093)•

Bug fix: If a participant partially completes a survey using the "Save & Return Later" feature,in which there is no email address associated with that participant (either via the participantlist or via the designated survey email invitation field), then the page that gets displayed
immediately after clicking the "Save & Return Later" button might mistakenly display the text
"You have just been sent an email containing a link for continuing the survey" for a moment
and then suddenly disappear, which could be confusing.

•Bug fix: When inline images are used for Descriptive fields on a survey or form, then if theuser is viewing the page on a mobile device and the image's native width is smaller than thewidth of the page, it would mistakenly not resize it correctly and would make it too small on
the page. It now makes the image wider on the page for better viewing of it.

•

Bug fix: When printing a page in the Control Center, the left-hand menu would mistakenly
not be removed from the print-out when using Firefox. (Ticket #56340)•

Bug fix: The "Announcement text to display at top of Home page and My Projects page"would mistakenly not get displayed at the top on the REDCap Home Page if the"Additionally display text on login page?" option is set to "No". (Ticket #56618)•

Bug fix: If the biomedical ontology auto-suggest functionality is disabled as the system level,
it would mistakenly prevent users on the Online Designer from setting a min or max limit fora Text field in the "Add Field"/"Edit Field" popup. (Ticket #56499)•

Bug fix: When entering a number- or integer-validated text field on a form or survey on an
Android device, it would mistakenly open the full keyboard when typing in the field rather
than displaying a more appropriate number-centric keyboard. (Ticket #56447)•

Bug fix: When entering a number-validated text field on a form or survey on an iOS device,
it would mistakenly open the full keyboard when typing in the field rather than displaying amore appropriate number-centric keyboard.

•

Bug fix: "event_id" was mistakenly not listed as a reserved field name to prevent users fromusing it as a field's variable name. (Ticket #56627)•

Bug fix: When an administrator is approving a "Move project to production" request on the
To-Do List page, the To-Do List popup would mistakenly not automatically close after therequest was approved or if the admin clicked Cancel to close the request. (Ticket #56457)

•Bug fix: When using the @MAXCHECKED action tag for a checkbox field, if a user clickedon the checkbox’s label (rather than on the checkbox itself), it would appear to keep thecheckbox unchecked if the @MAXCHECKED limit has been reached, but it would
mistakenly save the checkbox as checked. (Ticket #56658)•

Bug fix: For specific screen widths, the nav items at the top of the page on the Home page,
My Projects page, etc. would mistakenly not be visible.

•

Bug fix: When performing a data import in projects with repeating instruments or repeating
events, the "redcap_repeat_instance" field could mistakenly be imported with a value of "0",which should never be allowed because it must always be an integer larger than "0". (Ticket#28842)•

Bug fix: If a required field is changed to be a Descriptive field, it would still mistakenly
display the "must provide value" text below the Descriptive field's label on a survey page ordata entry form. (Ticket #56719)•

Bug fix: After selecting the "Export Reports" API method in the API Playground, the "Report
ID" drop-down list would mistakenly not get rendered correctly, thus preventing users fromutilizing it on that page. (Ticket #56707)•

Bug fix: When using the survey-link or survey-url Smart Variable in the email message for
an Automated Survey Invitation, in which the instrument name is appended to the Smart
Variable (e.g. [survey-link:survey_2]), then if the appended instrument name is different
from the survey instrument for the current ASI, it would mistakenly replace the Smart
Variable with the link to the current ASI survey rather than with the explictly specified one.
(Ticket #55400)•

Bug fix: When using the first-event-name or last-event-name Smart Variable in branching
logic or in a calculated field, in certain cases it might not get interpreted correctly, thus
mistakenly resulting in a branching logic error message on a survey page or data entry
form. (Ticket #56583)•

Bug fix: When setting the conditional logic for an Automated Survey Invitation in alongitudinal project, if any fields are prepended with the Smart Variable [event-name], it
would cause the ASI not to send the invitation if step 2 had the "Ensure logic is still true
before sending invitation?" option selected while Step 3 was set to "Send immediately".
(Ticket #55919)•

Bug fix: When setting the conditional logic for an Automated Survey Invitation in alongitudinal project, if any fields are prepended with the Smart Variable [event-name] andthe user selected a record from the "Test logic with a record" drop-down, it would
mistakenly return "False" even when the condition is actually True.

•

Bug fix: When setting the branching logic for a field in the "Add/Edit Branching Logic" popup
on the Online Designer, if a user selected a record from the "Test logic with a record" dropdown, it would mistakenly return "False" even when the condition is actually True. (Ticket#56623)•

Bug fix: When a repeating instrument is being used as a survey and is being displayed in
the Survey Queue, then it may mistakenly display the text "All surveys in your queue havebeen completed" on the Survey Queue if only 6 surveys have been completed in the queue(including all instances of the repeating survey), which could be confusing to respondents
who might want to keep taking the repeating survey. Since a repeating survey is bydefinition open-ended and can be taken over and over again without end, the Survey Queueshould never state "All surveys in your queue have been completed" if the queue contains
at least one repeating survey. (Ticket #56540)

Version 8.10.2 - (released 12/28/2018)•

New LTS branch based on REDCap 8.10.1 (Standard)

Version 8.5.27 - (released 12/28/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When entering choices for a multiple choice field in the "Add Field"/"Edit Field"
popup in the Online Designer, in which a dash/hyphen exists in the raw coded value of achoice, it would mistakenly recode the value rather than allowing the dash/hyphen, which isan acceptable character in the coded value.

Version 8.5.26 - (released 12/21/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: The upgrade module for version 8.5.25 was crashing and thus not allowing
administrators to complete the upgrade to 8.5.25 or higher. (Ticket #55324)

Version 8.5.25 - (released 12/20/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: The "Test URL" buttons have been removed from the "DDP on FHIR" page in theControl Center because they did not work most of the time, thus giving administrators theimpression that the URL entered was incorrect.

•

Bug fix: When accessing REDCap using DDP on FHIR while in an EHR-embedded window,
if the session ended and the user logged back in, it would mistakenly not remember that theuser is inside the embedded window and would thus not hide all appropriate elements fromthe user interface that it should.

•

Bug fix: For DDP on FHIR, the coded multiple choice options for sex, race, and ethnicity
were not complete and, in some cases, incorrect for certain EHR configurations. During the
upgrade process, these choice options for existing DDP on FHIR projects will have boththeir data and metadata translated into the new options. The field sex will now have options
M, F, and UNK, while ethnicity and race will be replaced by a long list of LOINC codes torepresent them properly.

•

Bug fix: When an administrator is viewing the "API Tokens" page in the Control Center orthe "Manage All Project Tokens" tab on a project's API page, the "Last Used" column for agiven user might mistakenly display "Never" instead of the last time the user made an API
request for the project. This appears to occur due to a case sensitivity issue with theusername, in which the case of the user seen on the Browse Users page in the Control
center does not exactly match the case of the username with which the user logged in orwith which the user is listed on the project's User Rights page. (Ticket #54748)•

Bug fix: When using the "Preview" and "Test email" functionality when composing a survey
invitation in a multi-arm project, if any fields are being piped into the email, in which the field
being piped is prepended with the unique event name of an event from an arm other thanspecifically Arm 1, then it mistakenly would not replace the field with the text "PIPED DATA"
as expected but would instead replace it with "______". (Ticket #54559)•

Bug fix: When creating a new record in a non-longitudinal/classic project that only contains
one data collection instrument, if the user clicks the Cancel button on the data entry form
before saving/creating the record, it would mistakenly just reload that form rather thanredirecting the user back to the "Add/Edit Records" page. (Ticket #54752)•

Bug fix: When calling the API Method "Export Project XML", it might mistakenly not include
all files from File Upload and Signature fields even though the exportFiles parameter had
been set to TRUE (assuming that returnMetadataOnly=FALSE). (Ticket #54301)•

Bug fix: When viewing a record on a data entry form in a project that contains one or more
repeating instruments, it would mistakenly only display the number of repeating instances ofa form on the left-hand instrument menu if the user was currently viewing any form that had
been set as a repeating instrument. It should always display the number of repeatinginstances next to each repeating instrument on the left-hand menu for a given record.
(Ticket #54846)•

Bug fix: When viewing a record on a data entry form in a project that contains one or more
repeating instruments, for all repeating instruments displayed on the left-hand instrument
menu, it would mistakenly display the form status stack icon representing the status color of
the first instance of the repeating instrument rather than displaying an icon representing all
the instances (e.g., red stack icon representing all instances having "complete" status, blue
stack icon representing mixed status types). This excludes the icon displayed for thecurrently selected form/instance, which was correctly displaying the form status icon of thecurrently viewed repeating instance. (Ticket #54846)•

Bug fix: When using the data search feature on the "Add/Edit Records" page in a project, inwhich no results are returned from a given search, in some cases the "Searching..." text
might mistakenly still be displayed afterward (instead of the text being hidden), thus
incorrectly implying that the search has not yet finished. This could be confusing andmislead the user. (Ticket #54818)•

Bug fix: When using an SQL field that contains a comma in the results for the data values
that are returned from the SQL query, after selecting and saving an option with a data valuethat contains a comma, it will save the value correctly but in certain cases may mistakenly
cause the value to not get pre-selected when a user returns later to the form, which could
cause a blank value to mistakenly overwrite the saved value unbeknownst to the user if theform is saved again. (Ticket #54988)•

Bug fix: If a project's metadata is exported via the Project XML file, in which a multiple
choice field contains an HTML break tag (<br>) in its choice option label, then if a new
project is created from the XML file, it might mistakenly add extra choices to that field if any
text exists after the HTML break tag for a given choice. (Ticket #55122)

Version 8.5.24 - (released 12/7/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: The "Export Records" API method mistakenly fails and will never completedue to a fatal PHP error. Bug emerged in REDCap 8.5.23. (Ticket #54340)•

Bug fix: When clicking the "Close Survey" button after completing a survey, in certain cases
REDCap will not be able to close the tab, and certain browsers might mistakenly redirect
the user to the page where survey access codes are typically entered. (Ticket #54305)

Version 8.5.23 - (released 12/6/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: For certain server configurations related to PHP’s decoding of HTML entities, theSurvey Settings page might not be able to properly store or display the survey instructions
text or the survey completion text if they contain certain non-Latin characters.

•

Bug fix: Users would mistakenly be allowed to use the @DEFAULT action tag for Signaturefields and File Upload fields. This can cause synchronicity issues of a single file being
associated with multiple fields, and thus should not be allowed. It will now ignore the@DEFAULT action tag if used for such fields.

•

Bug fix: When viewing the Draft Mode production changes page in a project, if the project
had been initialized in the REDCap Mobile App, then it would mistakenly give the warning"Please note that they *may* be affected by these changes and may not be able tosuccessfully imported their data from the app afterward..." even though no current users
have Mobile App user privileges anymore. It should only be displaying the warning if at least
one person in the project still has Mobile App privileges and has initialized the project in theapp at some point in the past.

•

Bug fix: When exporting data via the "Export Records" API method with type="eav" andproviding Filter Logic as a parameter in the API request in which no records should be
returned based on that filter logic, it would mistakenly return all records instead.

Version 8.5.22 - (released 11/28/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: If a user is viewing a project's Record Status Dashboard in which some records has
been assigned to Data Access Groups, then under certain rare conditions (e.g., users
bookmarking a link to the RSD after a DAG has been deleted in the project) users might not
see all the records on the RSD anymore, which could be confusing. (Ticket #53335)

Version 8.5.21 - (released 11/21/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: If a slider field on a data entry form has a value set, and then the user clicks
the balloon icon next to any field to open the Field Comment Log popup, it would mistakenly
set the slider value to 50, sometimes unbeknownst to the user. This does not occur on
survey pages but only data entry forms. (Ticket #53371)•

Major bug fix: If a multi-arm longitudinal project has Automated Survey Invitations and an
ASI's conditional logic becomes true for a given record, it might mistakenly not schedule thesurvey invitation. (Ticket #53427)

Version 8.5.20 - (released 11/16/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: Certain web browsers (e.g., Chrome) would mistakenly be allowed to pre-fill Notes
fields on a survey page or data entry form, which might also cause other fields on the page
(such as Text fields or Radio button fields) to have values inserted into them as well.

•

Bug fix: Under certain conditions when a field on a survey/form is using the @DEFAULT
action tag, and the survey/form has already been saved at least once (i.e., does not havegray form status icon), it might mistakenly display the red bar on the right side of the field as
if the value has changed even though it has not.

•Bug fix: When downloading certain PROMIS Adaptive or Auto-Scoring instruments from the
REDCap Shared Library, viewing a completed survey response on its data entry form might
mistakenly display a popup error due to malformed branching logic, specifically for the TScore field.

•

Bug fix: If a user has "De-Identified" or "Remove all tagged Identifier fields" privileges andthen exports a PDF of a form with saved data, then any multiple choice fields that are
tagged as an Identifier field would still have all their choices displayed, although it would notdisplay which choice was selected, which is confusing because it appears as if the field has
a blank value rather than having its value redacted due to user privileges. In this situation, it
now no longer displays the field choices but instead says "[*DATA REMOVED*] so that theuser understands that the saved value was removed from the PDF.

•

Bug fix: The FHIR scope "patient/Patient.read" was missing when "DDP on FHIR" makes
calls to the EHR. This caused "DDP on FHIR" not to function for some EHRs, such as
Cerner. (Ticket #53285)•

Bug fix: When using "DDP Custom" or "DDP on FHIR" in which a value already exists in
REDCap for a mapped DDP field but a blank value exists (i.e., is missing) for the field in the
EHR/source system, it would mistakenly prompt the user to overwrite the existing value withthe blank/missing value. Missing values from the EHR/source system should instead just be
ignored. (Ticket #53258)•

Bug fix: When exporting the PDF of saved data (all records) on the Other Export Options
tab on the "Data Exports, Reports, and Stats", if any data is being piped into a field note,
field label, etc., it would mistakenly pipe the values from the first record into the text of all
the subsequent records in the PDF.

Version 8.5.19 - (released 11/9/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: Only for certain versions of Internet Explorer, if a user with lock/unlock
privileges enters a data entry form that is already locked, then clicks the Unlock button at
the bottom of the form, enters some data, and then clicks the Lock checkbox to lock theform again, it would submit the form immediately after checking the Lock checkbox, thus
locking the form again, but it would mistakenly not save any of the data that had beenentered on the form prior to being locked again.

•

Bug fix: When downloading multiple Adaptive or Auto-Scoring instruments from the
REDCap Shared Library into the same project, the T-Score field and Std Error field would
conflict and thus cause those fields on the subsequent instruments to be renamed, in which
it would append random alphanumeric characters to the variable names. This would make it
difficult to have the same variable names consistently if all the same instruments were
downloaded in different projects.

•

Bug fix: If a user enters a value for a datetime field on a form or survey and then
immediately removes the value, they would mistakenly be presented with a validation error
message, which should not occur. This could cause the user to be stuck in an infinite loopon the page, in which the prompt keeps appearing, thus causing the user to have to reload
the page and possibly lose any data entered. (Ticket #52024)

•Bug fix: If using the Data Resolution Workflow in a project, and a user views an open query,it would mistakenly display data values for all fields in the query, even if the user has "No
Access" user privileges to that field's data entry form. In this case, it now redacts the data
value and instead displays a message stating that the field's value cannot be displayed
because the user does not have view access. (Ticket #49956)•

Bug fix: If the REDCap installation has the "Survey Base URL" set on the "General
Configuration" page in the Control Center, then if a survey participant is viewing a Survey
Queue for a record and then clicks the "Begin Survey" button for a given survey, it would
mistakenly send the participant to the the wrong URL, in which it would be using the default"REDCap Base URL" instead of the "Survey Base URL". (Ticket #52502)•

Bug fix: If viewing the Record Status Dashboard in a project where only one arm exists, but
the arm is not arm "1" but another number, then clicking the record name link in thedashboard table will mistakenly take the user to the first arm, where the record does notexist. (Ticket #52575)•

Bug fix: If a multi-arm longitudinal project has surveys using Automated Survey Invitations
on multiple arms, in which at least one of the ASI's condition logic references a field/eventon another arm, then if that ASI condition becomes true for a given record, it would
mistakenly schedule the survey invitation even if the record does not exist on that arm. The
record must exist on a given arm before a survey invitation can be scheduled for that arm
for that record. (Ticket #52174)•

Bug fix: On the Control Center's System Statistics page, the "Data values pulled fromsource system via DDP" count for both DDP Custom and DDP on FHIR would mistakenly
inflate the true count. This was caused by mistakenly counting temporal values multiple
times in longitudinal projects or in projects with repeating instruments/events if the samevalue was imported into multiple events/instances for a given record. This often depends on
the window of time (i.e., day offset) being used, in which a larger day offset value would pullin more duplicate values.

•

Bug fix: When using "DDP on FHIR" in a project that does not have any demographics
fields mapped on the DDP Field Mapping page, then if a patient is launched inside the
REDCap window from within the EHR user interface, and the user chooses to add thepatient to a project, then it would return a strange JSON-encoded message and would

mistakenly take the user to the wrong page if they clicked "View patient in project"
immediately after creating the record.
•

Bug fix: When using "DDP on FHIR" with the setting "Convert source system timestamps
from GMT to local server time?" set to "Yes" on the "DDP on FHIR" setup page in theControl Center, it might sometimes mistakenly not pull in some temporal data (e.g., labs,
vitals) when the data value's date of service is close to the edge of the window of time inwhich REDCap is querying from the EHR. For example, if a lab field's associated date field
has a value of 2018-11-06, and the DDP Adjudication window has a +-3 day offset valueset, which should search for all values from 2018-11-03 to 2018-11-09 (including thosedays), then some values saved on 2018-11-03 or on 2018-11-09 might not get returned
from the EHR. This bug is the result of the data being stored in GMT/UTC time in the EHR
while REDCap is querying the EHR using the local time.

•

Bug fix: When using Google Authenticator as a Two-Factor Authentication option, and an
Account Manager (as opposed to an Administrator) clicks the "Send Google Authenticator
instructions via email" button for a user on the Browse Users page in the Control Center, it
would mistakenly fail and give an error message. This only occurs if the user clicking the
button is an Account Manager. (Ticket #52597)•

Bug fix: If a user clicks the "Show plots only" or "Show plots & stats" button on the "Stats &Charts" page in a project, it will mistakenly display the "Download image" button for fields on
the page that do not have a graph displayed, in which clicking the button for such fields
would cause it to download an unopenable/unviewable PNG file. (Ticket #51565)•

Bug fix: If a field on a repeating event or repeating instrument has branching logic, in which
fields in the logic exist on that same repeating event/instrument, then the field might
mistakenly not get displayed in the PDF export with saved data.

•

Bug fix: If REDCap is set up to connect to the MySQL database via SSL, it would
mistakenly not display the "REDCap server is offline!" message to users if the databaseconnection failed. Additionally, for installations not using an SSL database connection, the"REDCap server is offline!" message would be inconsistent in its text being displayed
depending on whether the user was on the REDCap Home Page/My Projects page as
opposed to accessing a page in which "/redcap_vX.X.X/" appears in the URL (where X.X.X
is your current version). (Ticket #51758)

•Bug fix: If a user's account was suspended due to inactivity and afterward an administrator
unsuspended the user using the green "Unsuspend User" button on the Browse Users pageunder the "View User List By Criteria" tab (as opposed to unsuspending a single user whenviewing the user account under the "User Search" tab on that page), then if the cron job thatsuspends users due to activity gets run before the user logs in to REDCap the next time,
the cron job would mistakenly suspend them again. (Ticket #52768)•

Bug fix: If a participant is returning to a multi-page survey that has the "Save & Return
Later" option enabled, and the survey exists on a repeating event or is a repeating
instrument, then if the current survey page being opened by the participant is not the first
repeating instance of the survey but is a later repeating instance, then it might mistakenly
start the participant on the wrong page of the survey to which they are returning. It normallyshould take them to the page containing the last question having data. (Ticket #50898)

Version 8.5.18 - (released 11/2/2018)
BUG FIXES & OTHER CHANGES:•

Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on certain
pages, in which a malicious user could potentially exploit it by manipulating the query stringof an HTTP request.

•

Minor security fix: An SQL Injection vulnerability was found on surveys pages and data
entry pages in which a malicious user could potentially exploit it by manipulating the query
string of an HTTP request.

•

Major bug fix: If a user has "De-identified" or "Remove all tagged Identifier fields" data
export user privileges in a project, and then the user downloads a PDF of a data entry form
with saved data, in which the form is a repeating instrument or repeating event, it would
mistakenly not remove the appropriate data from the PDF as required according to theiruser privileges. (Ticket #52190)•

Bug fix: When performing a data import (either via API or via Data Import Tool) in which thefirst instrument of a record is locked, it would mistakenly prevent the data import fromcompleting, thus resulting in an error, even if the user is not attempting to update values on
the first instrument.

•

Bug fix: The data dictionary import process would fail if any calculated fields in the data
dictionary contained Smart Variables in their calculation. (Ticket #51346)•

Bug fix: If using a custom record label in a longitudinal project, in which the custom recordlabel references a field that exists on an event that is not the first event of the current arm,
then it might not display the custom record label at all. (Ticket #50733)•

Bug fix: Some cron jobs were mistakenly shifting by a minute or two each day with regard to
the time they should be run by the system. They will now be run at the exact minute they
are expected to based on their previous run time + their defined frequency to run.

•Bug fix: When using DDP on FHIR to add a patient to a project from inside the EHR
interface, in certain cases the add-patient process would fail and simply return a dialog
saying "ERROR".

•

Bug fix: If a report in a project is created, copied, reordered, or deleted, then on occasion it
may mistakenly cause many (or all) of the existing reports to be reordered in a seemingly
random fashion. (Ticket #42809)•

Bug fix: When using the Publication Matching module, if REDCap is upgraded to a newer
version after an email has been sent to a PI regarding a possible publication match, thenthe link in the email would not redirect to the correct webpage properly. (Ticket #52023)•

Bug fix: If custom Homepage Announcement text is set for the system and the current user
is sponsor of a user, then the custom text would mistakenly not stretch as wide as the My
Projects table. (Ticket #51782)•

Bug fix: If a field on a repeating event/form has a specific repeating instance number that isreferenced in a calc field or branching logic (e.g., [weight][2] > 150), then even if the specificrepeating instance of the event/form exists, it will throw an error on the data entry form or
survey page if the field itself does not have a value saved for the repeating instance that is
explicitly referenced.

•

Bug fix: When using certain non-English languages for the translated text in a project, thetitle/hover-over text for the repeating survey icon in the Online Designer would mistakenly
get truncated. (Ticket #52126)

•Bug fix: When piping data from a repeating event/instrument onto another instrument or
event, especially a non-repeating instrument/event, then the PDF download of that
instrument with saved data might mistakenly not pipe the data into the labels in the PDF.

•

Bug fix: In a multi-arm project using the Scheduling module, opening a record from the
Calendar page and then clicking "view schedule" from the calendar popup would load the"View or Edit Schedule" page but might mistakenly not pre-select the record in the record
drop-down list on that page.

•Bug fix: The plugin/hook/module method REDCap::getReport now more strictly checks thevalue of the third parameter ($exportAsLabels) to ensure it is a boolean. (Ticket #52382)•

Bug fix: When using a bookmarked link of a page in the Plugins, Hooks, and External
Modules documentation after REDCap is upgraded to a newer version, then the bookmark
would not redirect to the correct webpage properly. (Ticket #51824)•

Bug fix: If a conversation in Messenger is attached to a project, it would mistakenly display
the HTML <br> tag when hovering over the conversation title. (Ticket #52308)•

Bug fix: If certain Smart Variables (e.g., [survey-queue-link]) are used in the email text of an
Automated Survey Invitation, which also uses datediff with "today" or "now" as a datediff
parameter, then it would prevent the ASI+datediff cron job from fully running. Note: This
would only affect a small percentage of the total invitations being sent out. (Ticket #51081)

Version 8.5.17 - (released 10/17/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When using the Twilio Telephony Services for surveys and setting up an AutomatedSurvey Invitation in which the Invitation Type is "SMS Invitation (contains survey link)", itwould mistakenly add the survey link twice to the SMS message. And in the version of
REDCap just prior to this one, it was mistakenly adding the survey link if it was not includedin the SMS message for the ASI, which should not occur because the instructions state thatthe survey link will not be automatically added to the SMS when using the "SMS Invitation(contains survey link)" invitation type. So if using "SMS Invitation (contains survey link)"
invitation type, it will not add the survey link unless the [survey-url] Smart Variable is used in
the SMS message for the ASI. (Ticket #50596)

•

Bug fix: If a field exists on a repeating instrument, and a value is being imported for that field(via Data Import Tool or API) in which no value is provided for the
redcap_repeat_instrument field for that row of data, it would mistakenly allow the data to beimported without errors, and that data might become orphaned and be inaccessible on
certain pages (e.g., Record Home Page, Record Status Dashboard) after the import hascompleted.

•

Bug fix: In certain cases, the left-hand project menu might display the link "View/Edit
Records" when instead it should always display the "Add/Edit Records" unless the user
does not have "Create Record" privileges.

Version 8.5.16 - (released 10/5/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: If a user attempts to create a new record on the Add/Edit Records page, in which
the record contains a tab character (via copy-and-pasting the record name from elsewhere),
it would mistakenly not inform the user that tab characters are not permitted in record
names and would simply remove them when loading the Record Home Page for that newrecord. (Ticket #50347)•

Bug fix: If a user adds Custom Event Labels for a longitudinal project, and then converts the
project to classic/non-longitudinal format, the Custom Event Label for the first event would
mistakenly still appear on the Record Home Page. Custom Event Labels should only
appear when a project is longitudinal. (Ticket #49885)•

Bug fix: The notification in the Control Center that informs REDCap admins that a newExternal Module update is available would mistakenly display versions of modules that were
not compatible with the current REDCap version. However, if the admin clicked the blue
button to visit the REDCap Repo and then returned back to REDCap afterward, it would
temporarily resolve this issue. (Ticket #49957)•

Bug fix: If a user creates a thread in REDCap Messenger that is connected to a project, andthen navigates into a different project, in which the Messenger panel is initially closed whilein that project, then when the background AJAX call for Messenger runs after being on a
page for 60 seconds, it would mistakenly cause a JavaScript error and might cause somefunctionality of Messenger not to work correctly. (Ticket #24930)

•Bug fix: The plugin/hook/module method named REDCap::evaluateLogic might not interpretthe event context correctly depending on the value passed as the $event parameter. (Ticket#49420)•Bug fix: In a longitudinal project that is in production, if a user attempts to un-designate an
instrument for an event on the "Designate Instruments for My Events" page, specificallyusing the CSV file upload option, it would mistakenly allow the user to do so, even though
only REDCap admins should be able to un-designate instruments for events while inproduction. (Ticket #48290)•

Bug fix: When using a date or datetime field with DMY or MDY format as the record ID field,
it would mistakenly not save the record name correctly when trying to create the record, butinstead it would mangle the date format. (Ticket #49373)•

Bug fix: If branching logic or a calculation on a repeating instrument or repeating event
utilizes the Smart Variable "current-instance" (e.g., [yesno_var][current-instance]*1), thenwhen viewing the first repeating instance of that instrument/event, it would mistakenly not
perform the branching logic or calculation correctly if the value for that field in the logic/calcchanges while on that page. (Ticket #50094)•

Bug fix: When using the Twilio Telephony Services for surveys and setting up an AutomatedSurvey Invitation in which the Invitation Type is "SMS Invitation (contains survey link)", itwould mistakenly add the survey link twice to the SMS message. (Ticket #50596)•

Bug fix: When running Data Quality rule F, in which some fields being evaluated exist on arepeating instrument, it might mistakenly display them in the list of discrepancies when infact it is a false positive. (Ticket #49640)•

Bug fix: Calculated fields would sometimes hit a precision limit in JavaScript and mistakenly
return a blank value for the calc field rather than the correct numerical result, which mightneed to be displayed in scientific (exponential) notation. (Ticket #50578)•

Bug fix: When using LDAP or LDAP & Table-based authentication, it was mistakenly notallowing users to be assigned to a user role in a project if the username contained a space.
(Ticket #50791)

Version 8.5.15 - (released 9/30/2018)

BUG FIXES & OTHER CHANGES:•

Bug fix: When hitting the Enter button while inside a date or datetime field that triggers
calculations or branching logic on the same page of a form or survey, it might mistakenly
display erroneous error prompts stating that something is syntactically incorrect with thecalculation or branching logic, which is not the case.

•

Bug fix: When piping a value from a date or datetime field into the @DEFAULT action tag ofanother date/datetime field that has either MDY or DMY date format, the value would
mistakenly get mangled and thus be incorrect when the page initially loads. (Ticket #17157)•

Bug fix: When uploading a file for a File Upload field, under certain conditions it might
mistakenly cause multiple rows to be added to the redcap_data database table for thatrecord. (Ticket #50178)•

Bug fix: When using DDP on FHIR and opening a record on the Record Home Page while
viewing it inside the EHR, a JavaScript error might mistakenly occur, thus sometimes
preventing the DDP adjudication dialog from opening.

•

Bug fix: When creating a new Table-based user in the Control Center, in which the user's
attributes contain special/non-Latin characters, then depending on the server's MySQL
collation_connection, it might not save the user's attributes correctly in the database but
may instead mistakenly garble them. This bug was supposedly fixed in REDCap 8.5.13 but
was mistakenly not. (Ticket #48983)•

Bug fix: When mapping an EHR field on the DDP mapping page in a longitudinal projectusing DDP on FHIR, and clicking the "Copy mapping to other event" for a given field, it
might mistakenly also copy the category header that immediately follows that field, whichmakes the page look confusing to the user.

Version 8.5.14 - (released 9/20/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: If a user has data export privileges of "De-identified" or "Remove all tagged
Identifier fields", and then the user exports a report in which every field in the report getsremoved due to their export privileges, then it would mistakenly export data for *all* thefields in the entire project. (Ticket #48976)

•

Major bug fix: If a user attempted to put a production project into Draft Mode on the Online
Designer page, it would fail and merely reload the page. (Ticket #49866)•

Bug fix: If a field was using @DEFAULT, @NOW, or @TODAY action tags, and that field
was also being piped into text somewhere on that same page, then the field values would
mistakenly not get piped when the page initially loads. (Ticket #49839)

Version 8.5.13 - (released 9/19/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When viewing the To-Do List in the Control Center, some requests might
mistakenly still show up in the request counts even though the requester's account has
been deleted from the REDCap system. (Ticket #48846)•

Bug fix: Certain database queries that check to make sure that a project's reports are in thecorrect order were getting run more than necessary, which would sometimes cause certain
pages in a project to run slowly.

•

Bug fix: After editing the branching logic of a field in the Online Designer, it would
mistakenly chop off the first character in the branching logic when displaying it in red text on
the page for the field. (Ticket #49098)•

Bug fix: When using DDP on FHIR to add a patient to a project, in some cases it would
navigate to an incorrect non-existing record named "Undefined" in the REDCap project after
clicking "View patient in project" button after creating the record via DDP on FHIR.

•

Bug fix: When using DDP on FHIR, some LOINC codes related to Multiple Sclerosis were
mistakenly missing from the DDP field mapping page.

•Bug fix: When creating a new Table-based user in the Control Center, in which the user's
attributes contain special/non-Latin characters, then depending on the server's MySQL
collation_connection, it might not save the user's attributes correctly in the database but
may instead mistakenly garble them. (Ticket #48983)•

Bug fix: The To-Do List page in the Control Center would mistakenly display with the action
buttons overlapping the previous column in the table. (Ticket #49096)

•Bug fix: When using DDP on FHIR, the information page/popup that describes how to use
DDP to users was mistakenly missing the specific codings required for the threedemography fields "sex", "race", and "ethnicity". The required multiple choice codings for
those fields are now listed in the DDP on FHIR informational page that is accessible on the
DDP on FHIR Control Center page and via the popup on a project's Project Setup page.

•Bug fix: When launching multiple patients using DDP on FHIR inside the EHR interface (i.e.,
multiple tabs during same session), if the user returned to an older tab/patient during thesame session, it might mistakenly confuse it with the latest patient that was loaded, thus
losing that tab's proper context for the patient and causing confusion for the user.

•

Bug fix: If using MySQL 8.0 as the database, in certain cases the Control Control mighterroneously display the "Database structure is incorrect" warning even though nothing iswrong with the database tables. (Ticket #49580)•

Bug fix: When exporting a project's Project XML file, for certain server configurations, itwould cause the XML file to have all linefeeds removed from Section Headers and Field
Labels. Note: This fix will not fix any Project XML files that have already been generated but
will fix this issue for any XML files generated in the future. (Ticket #48719)•

Bug fix: If there exists piping, calculations, or conditional logic using the Smart Variables
first-event-name or last-event-name that happens to be prepended to a checkbox field, inwhich a checkbox choice is explicitly specified inside parentheses, it would mistakenly
return a list of all the checked-off checkbox labels instead of the checked-off status for the
specified choice. (Ticket #49378)•

Bug fix: When a user attempts to place a production project into draft mode, it might
mistakenly just reload the same page with no changes, thus preventing the project frombeing put in draft mode. (Ticket #6346)•

Fixes and updates for External Modules Framework•

Bug fix: If an External Module was using the API endpoint for assets (non-PHP pages), it
would mistakenly enforce authentication on those assets, which would cause issues forcertain authentication types, such as Shibboleth.

Version 8.5.12 - (released 9/7/2018)

BUG FIXES & OTHER CHANGES:•

Bug fix: When setting the value of the Rate Limiter on the General Configuration page in theControl Center, it would display a soft validation error if a value was entered that was lessthan 60. It should instead allow all integers to be entered with a minimum possible value of"0".

•

Bug fix: If a POST request to REDCap exceeds the maximum number of POST parameters
according to the max_input_vars setting in the PHP.INI configuration file, it might truncate
the parameters sent and mistakenly not display an error message, thus only saving part ofthe data submitted without informing the user of such. It now properly returns an error
message to let the user knows if this ever occurs. This includes API requests. (Ticket#47117)•

Bug fix: Updated some outdated text on the "Administrators & Acct Managers" page in theControl Center. (Ticket #47531)•

Bug fix: If a record in a project has some survey invitations scheduled, and then the record
is renamed, its associated invitations would mistakenly get disassociated from the record,thus causing the invitations not to get delivered. (Ticket #47887)•

Bug fix: If a user placed their cursor into any text input field and clicked their Backspacebutton on their keyboard, it would cause a JavaScript error. In most cases, this would go
unnoticed; however, some browsers might display a popup alerting the user of this error,
which could confuse the user.

•

Bug fix: The REDCap cron job was mistakenly being counted toward "Page Hits" as
displayed on the Control Center's Activity Graphs page. (Ticket #46074)•

Bug fix: When using the e-Consent Framework in a project, in which a record has an eConsent PDF file associated with it and a user deletes the record, it would mistakenly notdelete the record's e-Consent entry. This would cause problems if another record wascreated later using the same record name, in which it would prevent the saving of that newrecord's e-Consent file. (Ticket #38660)•

Bug fix: When using "Japanese (Shift JIS)" for a project's "character encoding for exported
files" setting, and the project's PDF Customization setting has the PDF header text (e.g.,Confidential) in Kanji/Japanese, then the PDF header text would mistakenly not display
correctly in the PDF. (Ticket #48035)•

Bug fix: LDAP allows for spaces to be used in usernames, and even though REDCap users
could successfully log into REDCap while having a space in their username, REDCap
would not allow such users to be added to projects, in which it would display an error
message stating "User names can only contain letters, numbers, underscores hyphens andperiods". If using "LDAP or "LDAP & Table" authentication, it will now allow users to be
added to a project via the User Rights page even if their username contains a space.
(Ticket #48169)•

Bug fix: When using literal date or datetime values inside a datediff() function in the"Add/Edit Branching Logic" popup in the Online Designer and testing the logic against a
record, it might mistakenly state the field should be hidden when instead it should be shown(or vice versa). Related, if using literal dates inside a datediff() function in the branching
logic of a field, and a user goes to export a PDF with saved data of that field's instrument foran existing record, the field might mistakenly be hidden in the PDF when instead it should
be shown (or vice versa). (Ticket #47717)•

Bug fix: When using "Japanese (Shift JIS)" for a project's "character encoding for exported
files" setting, the Kanji text might not display correctly if the PDF is opened on certain
devices. The remedy this, the internal font in the PDF has been changed from Gothic to
Kozmin. (Ticket #48035)•

Bug fix: When using a Stop Action on a checkbox on a survey, in which the "Enhanced
checkbox and radio button" option is enabled for the survey, then if a participant triggers theStop Action but chooses to "Continue survey" (rather than ending the survey), it would
mistakenly not uncheck the checkbox choice they had selected. (Ticket #48273)•

Bug fix: Using an X-instance Smart Variable that is appended to a variable or Smart
Variable containing a parameter with a colon (e.g., [mycheckbox:checked][last-instance])might mistakenly not be parsed correctly, thus possibly returning an incorrect value. (Ticket#48251)•

Bug fix: When the record ID field in a project has field validation, and the Scheduling page isbeing used in a longitudinal project to create a new record (assuming record autonumbering is not enabled), the Scheduling page would mistakenly not employ the fieldvalidation if a record name was entered in an incorrect format. This only occurs for certain
field validation types. (Ticket #46643)•

Bug fix: When using the Smart Variables "previous-event-name" or "next-event-name" in a
calculated field while viewing the first or last event, respectively, it would mistakenly display
the error prompt stating that there was an error in the calculation. Instead, it now silently
replaces those with a blank value (wrapped in quotes) in the equation to prevent an error
from occurring in order to force a blank value to be returned. (Ticket #48631, 48669)•

Bug fix: When using the X-event-name Smart Variables as prepended to a field variable, inwhich the variable name contains a number, it might not parse the Smart Variable correctly,
thus causing it to replace it with a blank value or the value from the wrong event. (Ticket#48576)•

Bug fix: If PHP's Multi-Byte String extension is not enabled on the web server, then
REDCap might throw a fatal PHP error when attempting to send an email. (Ticket #48757)•

Bug fix: Some data entry forms, especially for records that have repeating instruments withmany repeating instances saved (i.e., hundreds or more), would load very slowly,
sometimes causing the page to time out and never fully load. They should now load much
faster. (Ticket #40634)•

Bug fix: When calling the method REDCap::getPDF inside a hook in a project, in which thecurrent user does not have full data export privileges, the method would mistakenly fail to
output the PDF. The method should work regardless of the user's project-level rights.
(Ticket #48756)

Version 8.5.11 - (released 8/15/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When cross-event branching logic is used on a field in a longitudinal project, inwhich some events being referenced in the logic do not contain any data for a given record,in some cases the PDF export of an instrument would mistakenly not correctly determine if
the field should be hidden or not in the PDF, and thus it might hide the field when it should
display it (or vice versa). This bug only affects the PDF. (Ticket #42206)

•Bug fix: The action of creating or modifying a Custom Record Status Dashboard was
mistakenly not getting logged on the project Logging page.

•Bug fix: The default browser behavior of navigating back to the previous page after a user
clicks their keyboard's Backspace button was mistakenly occurring in "search" input typefields, which are predominate in External Modules and their configuration pages.

•

Bug fix: An error message on the Data Import Tool had incorrect text. (Ticket #47040)•

Bug fix: In longitudinal projects in production, the "select all" and "deselect all" links on the"Designate Instruments for My Events" page would mistakenly allow the user toselect/deselect already-designated instruments. Instead it should only allow the user toselect/deselect instruments that are not yet designated. (Ticket #47020)•

Bug fix: Small SQL issue caused if upgrading to 8.5.10 from an earlier version. (Ticket#47020)•Bug fix: In a longitudinal project that has multiple arms and is also using the Double Data
Entry module, the Record Status Dashboard would mistakenly not display any form status
icons on the page for a user that is Double Data Entry person 1 or 2.

•

Bug fix: When viewing non-project pages (e.g., My Projects, Control Center) in a mobile
browser (small device/screen), the "Help & FAQ" and "Training Videos" options would
mistakenly not appear in the top menu. (Ticket #47237)•

Various fixes and updates for the External Modules framework

Version 8.5.10 - (released 8/9/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: If any projects used Twilio telephony services for surveys and had an AutomatedSurvey Invitation set to use the "Participant's Preference" as the delivery method, then new
invitations scheduled by the ASI might mistakenly not include a survey link if an individual
participant's preference is "Email Invitation". (Ticket #42868)

•Bug fix: When executing a custom Data Quality rule that contains a single variable in the
logic, extra discrepancies might mistakenly be returned in some cases, especially if the
project is longitudinal and/or contains repeating instruments/events. (Ticket #45695)•

Bug fix: When piping the Smart Variable [previous-event-name] or [next-event-name] when
it is prepended to a variable name, it might mistakenly replace it incorrectly by replacing justthe Smart Variable (but not the field variable) with six underscore characters or with nothing(depending on the context). (Ticket #46001)•

Various fixes and updates for the External Modules framework•

Bug fix: The PHP LogicTester class mistakenly contained some debugging code that prints
SQL out on the page. (Ticket #46864)

Version 8.5.9 - (released 8/3/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: When upgrading from a REDCap version lower than 8.4.0 to version 8.4.0 or
higher, if any projects used Twilio telephony services for surveys and had an AutomatedSurvey Invitation set to use the "Participant's Preference" for the delivery method, then new
invitations scheduled by the ASI might not include a survey link (when needed) upon beingscheduled. (Ticket #42868)•

Bug fix: When using the E-signature feature at the bottom of a data entry form, if theusername is in an incorrect case or has trailing spaces, it would mistakenly fail during theinitial E-signature login. It should instead be trimming the username of any whitespace atthe beginning or end, and should be evaluating the username as case insensitive since thisis how the regular login behaves.

•

Bug fix: If an external module has its configuration permissions set to "Require modulespecific user privilege" on the External Modules page in the Control Center, and a user has
been given the rights to configure the module in a project, then if a REDCap administrator
opened the User Rights page in the project to edit that user's module rights and unchecked
every module and saved it, the user would mistakenly still have access to the modules towhich they previously had access. This only occurs when all modules are unchecked on theUser Rights page. (Ticket #44112)

•Bug fix: When using a logo on a survey and also using the "Save & Return Later" feature, if
a respondent chose to return to a survey, then upon loading the survey page to enter theirreturn code, a JavaScript error would occur on the page. (Ticket #46143)•

Bug fix: When using Twilio telephony services for surveys and having it make voice calls toparticipants, each voice call would mistakenly have an unnecessarily long pause at the
beginning of the call.

•

Bug fix: When importing data values for a repeating event via Data Import Tool or via API
but not including the form status field in the imported data set for any of the instruments on
which the imported fields are located, those repeating instances on the repeating event
might get orphaned in some user interfaces, such as in the Record Status Dashboard, andthus do not become visible until the user attempts to create a new instance through the userinterface and then saves the form. (Ticket #46285)•

Bug fix: AAF Authentication was mistakenly being excluded during CSRF token check.

•Bug fix: When piping the Smart Variable [event-name] when it is prepended to a variable
name, it might mistakenly replace it incorrectly by replacing it with the current event namewithout square brackets around it. (Ticket #46001)•

Bug fix: In certain cases Smart Variables were not getting evaluated correctly when used
inside the conditional logic of Automated Survey Invitations, thus causing invitations not to
get scheduled appropriately. (Ticket #44104)•

Bug fix: On the Project Modifications page, when clicking the Compare button to view thedifferences between old and new choices of a multiple choice field, it would mistakenly
always display "0" for the record count for every choice, even if some records do have thatchoice saved. This issue appears to only occur in specific versions of PHP. (Ticket #25851)•

Bug fix: In a report or via the API, if the user is requesting specific records and also specific
events to be returned, if there is no data for those events for those records, then it would
mistakenly return empty "ghost" rows as if data does exist on those events, which is
confusing. (Ticket #46342)

Version 8.5.8 - (released 7/30/2018)
BUG FIXES & OTHER CHANGES:•

Critical security fix: An SQL Injection vulnerability was found on several pages that could
be potentially exploited by manipulating the URL query string of an HTTP request by amalicious user, including non-REDCap users through publicly available URL end-points that
do not enforce authentication. It appears very unlikely that this vulnerability could be used to
extract information from a REDCap database. But if enough knowledge is known about
REDCap internally, it might be possible for an outsider to upload files into random projects
in REDCap; however, there is no evidence that those same files could be executed or
downloaded, and thus the files would essentially be orphaned (would not be accessible
through the user interface in any way) and would simply take up unnecessary space on thefile server. This bug appears to exist in every version of REDCap since version 4.0.0.

•

Major bug fix: On survey pages, data entry forms, and other pages where conditional logic
and calcs are evaluated, those pages may take an exorbitant amount of time to load (and insome cases may never successfully load at all). This appears to only affect certain
Windows server environments.

Version 8.1.20 - (released 7/30/2018)
BUG FIXES & OTHER CHANGES:•

Critical security fix: An SQL Injection vulnerability was found on several pages that could be
potentially exploited by manipulating the URL query string of an HTTP request by amalicious user, including non-REDCap users through publicly available URL end-points that
do not enforce authentication. It appears very unlikely that this vulnerability could be used to
extract information from a REDCap database. But if enough knowledge is known about
REDCap internally, it might be possible for an outsider to upload files into random projects
in REDCap; however, there is no evidence that those same files could be executed or
downloaded, and thus the files would essentially be orphaned (would not be accessible
through the user interface in any way) and would simply take up unnecessary space on thefile server. This bug appears to exist in every version of REDCap since version 4.0.0.

•

Major bug fix: On survey pages, data entry forms, and other pages where conditional logic
and calcs are evaluated, those pages may take an exorbitant amount of time to load (and insome cases may never successfully load at all). This appears to only affect certain
Windows server environments.

Version 8.5.7 - (released 7/18/2018)

BUG FIXES & OTHER CHANGES:•

Major bug fix: On some occasions, DDP on FHIR was mistakenly not parsing all the data
being received from the EHR, thus some clinical data values from the EHR were not being
stored in REDCap.

•

Bug fix: When using the biomedical ontology search for a text field on a form or survey, it
was mistakenly including Semantic Types Ontology (STY). It now excludes Semantic Types
Ontology from biomedical ontology search unless field validation is STY. (Ticket #44910)•

Bug fix: In REDCap Messenger, it might display that there are unread messages for theuser to read even though there are none.

•

Bug fix: When a survey has "Save & Return Later" enabled, and a respondent clicks the"Start Over" button upon returning to the survey, the survey page mistakenly does not
display the survey instructions at the beginning of the survey. (Ticket #44838)•

Bug fix: The record drop-down list displayed in the Online Designer both in the "Add/Edit
Branching Logic" popup and also in the "Add/Edit Field" popup for calc fields would
mistakenly not display the Custom Record Label and Secondary Unique Field labels.

•

Bug fix: The record drop-down list displayed in the Online Designer both in the "Add/Edit
Branching Logic" popup and also in the "Add/Edit Field" popup for calc fields would be toolong for projects with large amounts of records, which could cause the page to load very
slowly or not load at all. To remedy this, the record drop-down list now only displays the first
200 records.

•

Bug fix: The rendering of the Participant List was unnecessarily slow due to some incorrect
queries that were pulling information not needed. This fix should make the Participant List
load much faster, especially for larger projects with thousands of records.

•

Bug fix: In the "Compose Survey Invitations" popup on the Participant List page, the"Previously Sent Email" drop-down list displayed under "Load message box with text from aprevious email?" would mistakenly load email text containing static, unique survey links
from previously sent invitations (which could cause major issues if used verbatim for new
invitations) when instead it should have been loading the invitation text containing the Smart
Variable [survey-url] in place of the static survey link.

Version 8.5.6 - (released 7/11/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: The cron job that checks for updates for External Modules would mistakenly only
run if REDCap stats reporting had been set to "auto". (Ticket #44324)•

Bug fix: When creating/editing an Automated Survey Invitation and in Step 3 setting theoption "Send after lapse of time" that would result in a send time occurring in the year 2038
or afterward, it would mistakenly set the send time to be 1/1/1970 or 12/31/1969 instead.
(Ticket #44459)•

Bug fix: When using the Smart Variables [form-link] and [record-name] inside the email
subject or email message of an Automated Survey Invitation, it would mistakenly not pipe
the record name into the form link URL for [form-link] and would mistakenly replace [recordname] with "______" instead of the real record name. (Ticket #44549, #44550)•

Bug fix: The "DDP on FHIR" page that gets displayed inside the EHR user interface was
mistakenly missing a link to the "DDP on FHIR" information page that provides all theinformation about that module.

•

Bug fix: If a slider field exists on an instrument that is currently locked, the user would
mistakenly still be able to modify the slider position and value. Note: This would not affectthe slider's value at all since the instrument could not be saved until it was unlocked. So at
most, this could cause confusion. (Ticket #44608)•

Updates and fixes for the External Module Framework•

Bug fix: In a calculated field or in branching logic that has cross-event logic whilereferencing a field that exists on a repeating instrument from another event, it would
mistakenly assume instance #1's value to always be blank/null for that field and thus cause
the logic or calculation to come to an incorrect result. (Ticket #44474)•

Bug fix: If a suspended user gets unsuspended by an administrator either via the Browser
Users page in the Control Center or via a Sponsor Dashboard request, the user would
mistakenly get suspended again within the next day if they did not log into REDCap soonafter being unsuspended.

•Bug fix: If a sponsor had made a request to an administrator via an action in the Sponsor
Dashboard, if the administrator was using a link in the email to process requests (asopposed to using the To-Do List), the administrator might mistakenly try to process thesame request twice, which could cause issues. Now if an administrator attempts to process
an already-processed request, it will display an error message letting them know that it has
already been processed and therefore cannot be processed again.

•

Bug fix: Users might mistakenly receive a notification email stating that they have an unread
message in a conversation in REDCap Messenger, even though the conversation has been
deleted.

Version 8.5.5 - (released 7/2/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When using the [survey-queue-link] Smart Variable with custom text to display, incertain situations it may mistakenly cut off the first word of the custom text or not display thecustom text at all. (Ticket #44224)•

Bug fix: When setting an account expiration time for a user on the Browse Users page (via
"View User List By Criteria"), if the administrator's date format preference is set to Y-M-D on
their My Profile page, then the pre-filled expiration time in the Set Account Expiration popup
might mistakenly be in Y-M-D H:M:S format when instead it should only be in Y-M-D H:M
format, thus throwing a date-formatting error when submitting the action. (Ticket #44228)•

Bug fix: If using MySQL 8.0 or later for REDCap's database, it would erroneously display
the "database structure is incorrect" error in the Control Center when nothing is reallyincorrect about the database tables. (Ticket #42594)•

Bug fix: Minor changes to some database tables, which were mistakenly created with
BTREE indexes, which is a type of index that is not compatible with some versions of
MySQL or MariaDB.

Version 8.5.4 - (released 6/29/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: If an Automated Survey Invitation has conditional logic containing a
datediff() function that is explicitly using "now" as a parameter, the cron job that runs several
times a day to trigger any datediff+now ASIs would mistakenly fail to schedule invitations forthis ASI. Note: The issue does not exist for datediff+today ASIs but only for datediff+now
ASIs. (Ticket #43783)•

Bug fix: When clicking the +- options at the top of a survey page to increase or decrease thefont size of the survey text, in some cases with particular nested HTML tags, it would
mistakenly compound the size changes unnecessarily, thus causing the font size to be toolarge or too small for some blocks of text.

•

Bug fix: When downloading a "compact" PDF containing data, if a multiple choice fieldcontains many choices (e.g., >20) it might mistakenly display only that field on a page byitself.

•

Bug fix: When downloading the CSV file of users on the Browse Users page in the Control
Center, it would mistakenly have the resulting filename ending with ".csv.csv" instead of just".csv". (Ticket #43774)•

Bug fix: When referencing a repeating instance number in the conditional logic of an
Automated Survey Invitation and then selecting a record using the "Test logic with a record"
option, it would mistakenly cause a PHP fatal error. (Ticket #44104)•

Bug fix: When a user has De-identified data export privileges in a project and attempts toexport a PDF containing data, in which MDY- or DMY-formatted date/datetime fields arebeing piped into labels in that PDF, then instead of the piped values being replaced with"[*DATA REMOVED*]" as expected, they would mistakenly be replaced with "00.00.0000
REMOVED*]". (Ticket #44123)•

Bug fix: If an external module has its configuration permissions set to "Require modulespecific user privilege" on the External Modules page in the Control Center, then if a user ina project gives another user the rights to configure that module, it would save that setting
correctly. However, if the user reloaded the User Rights page to edit that same user's rights
again, it would mistakenly appear that the user no longer has config permissions for thatmodule (i.e., the module's checkbox would be unchecked), even though they were justgiven such rights. (Ticket #44112)

Version 8.5.3 - (released 6/22/2018)•

New LTS branch based on REDCap 8.5.2 (Standard)

Version 8.1.19 - (released 6/22/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When clicking the "Download upgrade script" button in the REDCap Upgrade
Module (as opposed to copy-and-pasting the contents of the textarea box on thatpage), the upgrade script would mistakenly be missing the SQL query "REPLACE
INTO redcap_history_version...". This would not have any adverse effects on thesystems though. (Ticket #43372)•

Bug fix: When clicking the "Fix calcs now" button when viewing the results of Data
Quality rule H, if the first instrument of an event is locked for a given record, then any
calc fields existing on that same event (even on other instruments) would mistakenly
not have their values fixed by DQ rule H. (Ticket #23433)•

Bug fix: Fixed incorrect instructions in an error on the Configuration Check page in theControl Center. (Ticket #43672)•

Bug fix: When exporting a Project XML file that contains multiple choice fields that havechoice labels containing a "less than" sign followed immediately by a number or letter, it
would mistakenly truncate that choice label in the XML file. (Ticket #43675)

Version 8.1.18 - (released 6/14/2018)
BUG FIXES & OTHER CHANGES:•

Medium security fix: A user access vulnerability was found in External Modules thathave plugin pages that require authentication, in which a malicious user could
potentially gain access to a module's plugin pages without having first logged in to
REDCap (assuming the module installed in REDCap has plugin pages associated withit - many modules do not). This means that information displayed on that module pagemight be publicly accessible (able to be viewed without logging in) if a malicious userknows how to navigate to a particular External Module's plugin page and manipulate
the query string URL in a very specific way. Note: This would not grant anyone accessto other pages in the REDCap project but only to that particular module's plugin page towhich they are manipulating the URL (i.e., standard REDCap pages are not affected by
this; only module pages are vulnerable).
•

Minor security fix: When using the Double Data Entry module and merging two
records into a new third record, if a File Upload field has a file that has been uploaded
for either record, then the merge process would mistakenly display a text box to allow
the user to enter a value (such as a different Doc ID) for the File Upload field, which
does not make sense to allow during the merge process. However, this could allow theuser to inadvertently enter the Doc ID of a file to which they do not have access (in thecurrent project or in another project to which they have access), thus allowing them tohave unauthorized access to a file if they have some special knowledge regarding how
REDCap stores documents. From now on, users are no longer given the option to entera value for a File Upload field on the merge page, and thus they can only choose oneof the two existing options. (Ticket #42221)•

Bug fix: Many project pages would not function at all if using MySQL version 8.0 or
higher. (Ticket #42264)•

The outdated training video on Instrument Development was updated.

•

Bug fix: When using WebDAV for file storage and uploading files larger than 2 GB in
size, they would mistakenly fail to upload successfully. (Ticket #42416)•

Bug fix: When enabling the aggregate survey results display on a survey, if
respondents are allowed to return to the survey without needing a return code, it would
mistakenly still ask the respondent for a return code if returning directly to theaggregate survey results page. (Ticket #42568)•

Bug fix: When using the Dynamic Data Pull module (either DDP on FHIR or DDP
Custom), the date comparison function for evaluating timestamps for temporal mappedfields might exclude some values if their timestamps fall right on the edge of the date
range. This means that some values might mistakenly not appear in the list of DDP
values to adjudicate from the EHR/source system. For this to occur would likely berare. (Ticket #42444)

•Bug fix: When a field's value is being piped into the field label of a required field, inwhich that required field is submitted on a survey or form without a value, the resulting
popup error "Some fields are required!" would mistakenly display the pre-piped versionof the field labels in the popup rather than performing the piping before displaying thelabels. (Ticket #42577)•

Bug fix: When using the Data Search feature on the "Add/Edit Records" page in alongitudinal project, if a value is entered that has a match inside a record name (record
ID field), then some of the options returned in the search would often not navigate theuser to a data entry page when clicked but would instead mistakenly just reload the"Add/Edit Records" page. (Ticket #42965)•

Bug fix: Retroactively added usleep(1) to LogicQuoteProtector because in some rarecases uniqid() would return the same value in several successive calls, thus mangling
branching and calcs. (Ticket #42427)•

Bug fix: When using AWS S3 or WebDAV for file storage, some uploaded files (eventhose imported via the API or Mobile App) might have a copy mistakenly left in the/redcap/temp/ directory on the web server under a random name, in which the temp
files never get deleted. (Ticket #43127)•

Bug fix: For certain server configurations or directory structures, the Cron Jobs page in
the Control Center might go into an infinite loop and never fully load the page. (Ticket#43144)•

Bug fix: If branching logic or calculations are used for a field on a survey page, in which
the logic/calc references the current survey's Form Status field, it would mistakenly
assume the Form Status value to always be "" (blank) rather than the true status valueof 0, 1, or 2. This does not affect data entry forms but only survey pages.

Version 8.1.17 - (released 5/29/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: If using MariaDB 10.2 (or higher) for the REDCap database, the REDCap
Control Center would display the erroneous error message "Your REDCap databasestructure is incorrect!". (Ticket #28083, #32131, #41911)•Bug fix: When performing a data import of radio buttons in a matrix that has ranking
enabled, it would sometimes display an erroneous error message if two or morematrixes of questions are being imported at one time, thus preventing the import fromcompleting. (Ticket #39804)•

Bug fix: When using Dynamic Data Pull (either DDP Custom or DDP on FHIR) and the
MRN field is being used as the Secondary Unique Field in the project, then if an MRN
is entered on a form and the "Duplicate value!" error message popup is displayed, itwould mistakenly not be possible to close the popup, thus causing the user to have toreload the page. (Ticket #41879)

Version 8.1.16 - (released 5/22/2018)•

Fixes for External Module framework (https://github.com/vanderbilt/redcap-externalmodules/releases/tag/8.4.5a)Version 8.1.15 - (released 5/17/2018)•

Bug fix: When calling the API method "Export Project XML" and setting the parameter"returnMetadataOnly" as FALSE, it would mistakenly not return data but would only
ever return just the metadata.

•

Bug fix: The Smart Variables [survey-queue-link] and [survey-queue-url] were
mistakenly not working when used inside the email subject or email message for an
Automated Survey Invitation.

•

Bug fix: When downloading a PDF of an instrument that contains a matrix of fields, thematrix headers might mistakenly overlap the radio buttons or checkboxes of the first
field in the matrix under specific circumstances. (Ticket #40969)•

Bug fix: When using record auto-numbering for a data import (via Data Import Tool,
API, or Mobile App) that contains data for a repeating instrument or repeating event,then all the data for a given record in the import might be reduced from multiple
instances/events of data to a single event/instance of data, thus causing much of thedata to mistakenly not get imported. (Ticket #41283)

•Bug fix: When viewing the "Stats & Charts" page, if a field has some missing values,
and the user clicks the link to view the record names that have missing values, it might
mistakenly return incorrect records-instances. This only occurs in projects having
repeating instruments or repeating events. (Ticket #37674)•

Bug fix: When importing data (via Data Import Tool or API) into a longitudinal projectand setting true/"yes" for the import option "Allow blank values to overwrite existing
saved values?" when importing blank values for checkbox fields into a longitudinal
event for which the checkbox's instrument is not designated, it would display theerroneous error that the checkbox field "exists on an instrument that is not designatedfor the event". (Ticket #37627)•

Bug fix: When adding a new field to an instrument on the Online Designer while in Draft
Mode, if the field is being added between a section header and another field, in which
the instrument begins with that section header, then the new field would get
successfully created but would mistakenly not be visible in the Online Designer on that
instrument, thus leaving it in a quasi-orphaned state. (Ticket #41359)•

Fixes and updates for External Module framework(https://github.com/vanderbilt/redcap-external-modules/releases/tag/8.4.4)

Version 8.1.14 - (released 5/11/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When a record is selected on a project's Logging page, under certain specificconditions it might mistakenly display "Perform instrument-event mappings" logged
events.

•Updates and fixes for External Modules framework•

Bug fix: When viewing the Participant List for a project using the Twilio telephonymodule for surveys, if a user attempts to change the invitation preference for aparticipant in the participant list, then the popup window might mistakenly get obscuredby the page footer. (Ticket #40150)•

Bug fix: When opening the Data History popup for a given field on a data entry form, in
certain cases it might mistakenly display the logged events for another field (for thesame record) if the other field's variable name exists as the last portion of the current
field's variable name (e.g., the field "his_field" would return logged events for the field"this_field" for the same record-event).
•

Bug fix: There was mistakenly no way to force REDCap to verify the SSL certificate if
using SSL/TLS for the database connection, thus it assumed that it should never needto verify it. Since some institutions require SSL certificate verification when using an
encrypted database connection, the line "$db_ssl_verify_server_cert = true;" should be
added to the database.php file in order to force SSL certificate verification for the
database connection. Note: The line of code below was added to the database.php filein the REDCap downloadable install zip file. $db_ssl_verify_server_cert = false; // Set
to TRUE to force the database connection to verify the SSL certificate•

Bug fix: When viewing a record on the Record Home Page, on certain occasions if auser clicks on a repeating instrument that has a gray status icon, it might mistakenly
create instance 2 as the first instance of that repeating instrument, rather than creating
instance 1. This appears to affect only repeating instruments, not repeating events.

•

Bug fix: When using the randomization module in a project, in which one of therandomization strata fields has a choice that is hidden using the action tag@HIDECHOICE, then when randomizing a record on a data entry form, it would
mistakenly display the choices in the randomization popup that should be hidden forthe strata field. (Ticket #38987)•

Bug fix: When a calc field exists on a repeating instrument or repeating event, and afield on another form/event triggers that calc field, then if no data had ever beenentered into the calc field's form, it would mistakenly change the form status icon to red
when instead it should stay gray (since only the calc field has data on that form).
(Ticket #40940)

Version 8.1.13 - (released 5/1/2018)•

BUG FIXES & OTHER CHANGES:o

Major bug fix: If a slider field with a saved value on a form or survey gets focus(via tabbing into the field or if the field is the first field on a form), then if the user
does not change the value of the slider after putting focus on it, then it would

mistakenly remove the slider's existing value, thus erasing its value if the user
saves the form/survey. (Ticket #40445)
o

Bug fix: When adding a project as a project template in the Control Center, thepopup dialog might fail to display if some projects contain certain special charactersin their project title. (Ticket #40283)

o

Bug fix: When the Response Limit option has been set for a survey, instead ofdisplaying the custom text on the survey page whenever the limit has beenreached, for specific versions of PHP it would mistakenly just display a blank page.
(Ticket #39659)

Version 8.1.12 - (released 4/29/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: On some specific server configurations, the REDCap Upgrade module would
not set certain server path constants correctly. (Ticket #40203)•

Bug fix: For longitudinal projects using a public survey on multiple arms, regarding allarms except the first arm, the public survey link would mistakenly be blank on the
Public Survey Link page. (Ticket #40311)•

Bug fix: When using the Twilio telophony module for sending survey invitations while
also using Automated Survey Invitations that contain conditional logic containing
datediff+today or datediff+now, if the ASI has "Participant Preference" as the invitation
type, then in certain cases (but not all the time) it would mistakenly send the invitation
via email rather than via the participant's preferred delivery method. And if thoseparticipants do not have an associated email address, then the invitation would simply
fail to send, as noted in the Survey Invitation Log. (Ticket #29316)

Version 8.1.11 - (released 4/18/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When an unsuccessful login attempt occurs in REDCap, it now only logs theusername value entered if the value is a valid REDCap user's username. If not, it
instead logs it as "[not_valid_username]" in the redcap_log_view database table. This
fixes a potential security hole in which some users might mistakenly enter theirpassword in the username login field, in which it would log their password in plain text
in the redcap_log_view database table and thus could be viewable to anyone withdirect access to the backend database.
•Bug fix: When adding a new user in REDCap (in several places throughout theapplication), if user attempts to create a username containing an ampersand, it would
not allow it even though the error message says that ampersands are allowed. Thiserror message text is incorrect because ampersands are not allowed in REDCap
usernames. (Ticket #39267)•

Bug fix: When running Data Quality rule H, it might mistakenly not return somediscrepancies in very specific cases. This would most often occur when the calculated
value has a decimal while the saved value does not contain a decimal (and vice versa).
(Ticket #38488)•

Bug fix: When using a Live Filter on the "Stats & Charts" page of a report, in which no
results should be displayed for the selected Live Filter, it would mistakenly display all
records in the charts and stats tables on the page. (Ticket #39349)•

Bug fix: When using conditional logic, report filters, etc., in which certain text is used
inside double quotes or single quotes (i.e., text that is used internally by REDCap as
special processing tokens), it would sometimes mistakenly return no results instead ofthe desired results. (Ticket #32295, #39418)•

Bug fix: Inside the red box that appears at the top of the data entry form when viewing
a survey response, it would mistakenly report that other users contributed to the survey
response, even though those users may have entered data on another instrument forthat record. This issue cannot be fixed for existing responses, but the issue will nolonger occur for any new responses created. Additionally, the text that denotes theusers that have contributed after the survey was completed would be incorrect if users
may have entered data on another instrument for that record, but this issue (unlike theother one described above) will be fixed retroactively for existing responses and for
new responses. Also, both of these issues would mistakenly include calc fields when
determining contributors; however, calc fields will no longer be considered because
they can be triggered from data being entered elsewhere for a record. (Ticket #38545)•

Bug fix: When exporting data to a stats package for a project that contains repeating
instruments, the choices listed for the field "redcap_repeat_instrument" in the stats

package's syntax file would mistakenly have the instrument label repeated multiple
times for that field if that instrument were set to be repeating on multiple events in the
project. (Ticket #38529)•

Bug fix: When viewing the Public Survey Link page of a project containing multiple
arms, if the first data collection instrument is not designated for the first event of thecurrent arm, it would mistakenly display the public survey link of another arm (typicallythe first arm). It now displays a warning on the page to inform the user to fix this issue
by designating the first instrument for the first event of that arm. (Ticket #39647)

Version 8.1.10 - (released 4/13/2018)
BUG FIXES & OTHER CHANGES:•

Minor security fixes: Some Cross-Site Scripting (XSS) vulnerabilities were found on
various pages in which a malicious user could potentially exploit them by manipulating
the query string or POST parameters of particular HTTP requests. Part of this batch offixes includes a change in the REDCap API's "content-type" HTTP header for CSV
exports from "text/html" to "text/csv" as an extra preventative measure to protect
against XSS.

•

Major bug fix: On some extremely rare occasions when loading a public survey, it
might mistakenly display the data from a previous response rather than displaying thepage with all fields blank.

•

Bug fix: The "expand" link would mistakenly not work for the "Custom text to display at
the top of the Help & FAQ page" textbox field on the General Configuration page in theControl Center.

•

Bug fix: When deleting a repeating event instance on the Record Home page, it might
mistakenly delete all files uploaded to any File Upload fields on other repeating
instances of that event. (Ticket #37988)•

Various fixes and updates for External Modules framework•

Bug fix: When using the REDCap Mobile App for a project that contains Descriptive
fields that have inline images, if the file storage setting has been set to "WebDAV" onthe File Upload Settings page in the Control Center, the images would mistakenly not
get synced to the mobile app correctly.
•

Bug fix: The action tags @NONEOFTHEABOVE and @MAXCHECKED would not work
well together and would cause @NONEOFTHEABOVE to malfunction when using bothtags on a single checkbox field. (Ticket #38119)•

Bug fix: When using a custom Data Quality rule to find a field with a blank value, inwhich the field exists on a repeating instrument, it would not always return the correct
results. (Ticket #37067)•

Various fixes and updates for External Modules framework•

Bug fix: The documentation for action tags @TODAY and @NOW mistakenly state thata field using either action tag would be disabled and not edidtable, which is no longer
true but used to be true in older versions. (Ticket #32537)•

Bug fix: When uploading an instrument zip file in the Online Designer, it would
mistakenly truncate the form name to 50 characters in length when instead it should betruncating it to 64 characters if the form name was longer than that.

•Bug fix: When clicking the "exclude" or "remove exclusion" link in the discrepancy
results in the Data Quality module when using a non-English language for the text ofthat project, it would mistakenly only show the text in English right after clicking those
links. It should instead display them in the project language. (Ticket #38408)•

Bug fix: If using an SSL database connection for MySQL, plugins and some external
modules pages would mistakenly return an error and not load. After upgrading to thisversion, an administrator will need to download the zip file containing outdated nonversioned files on the Configuration Check page, and then follow the instructions there.
(Ticket #37763)•

Bug fix: On very rare occasions, creating a new user role in a project might mistakenly
result in displaying an error to the user that states that an email could not be sent to theuser, which does not make sense because there is no user in this context. This was
supposedly fixed in the previous version but was not. (Ticket #37465)

•Bug fix: When deleting a form's data using the "Delete data for THIS FORM only"
button at the bottom of a data entry page, if it is a repeating instrument, it would
mistakenly fail to mention that this action would only delete the current repeating
instance of the form, not all repeating instances of that form.

•

Bug fix: The SQL mapping file for installing the DDP Custom demo web service mightcause an SQL error and not execute successfully if DDP mapping has already been
performed for any DDP Custom project in the system.

•

Bug fix: The Dynamic Data Pull (DDP Custom) module was mistakenly unable to utilize
repeating instruments or repeating events for capturing temporal data.

•

Bug fix: When using AAF authentication, the cross-site request forgery (CSRF)
protection would not work properly.

Version 8.1.9 - (released 3/15/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: When using the Data Search feature on the "Add/Edit Records" page, clicking
the keyboard's down arrow button mistakenly no longer selects an option returned fromthe search. (Ticket #37144)•

Bug fix: In a longitudinal project, when a user clicks the "Delete data for THIS FORM
only" button on a data entry form, if data exists on other events for the current record
AND the form being deleted is the only form containing data on the current event, thenthat event would mistakenly still show up in reports and data exports even though it nolonger contains any data and shows gray status icons for all the instruments in theevent. In the previous version, this bug was fixed for most scenarios (traditional
longitudinal and repeating instruments) except not for repeating events. This now fixes
the issue for repeating events. (Ticket #35814, #37290)•

Bug fix: If a user requests that their project be moved to production by an administrator,
in which the administrator does not use the To-Do List nor the link in the request email
but instead just goes to the project directly to move it to production, then the original
request would mistakenly not get removed from the To-Do List. (Ticket #37159)

•Bug fix: On very rare occasions, creating a new user role in a project might mistakenly
result in displaying an error to the user that states that an email could not be sent to theuser, which does not make sense because there is no user in this context. (Ticket#37465)

Version 8.1.8 - (released 3/9/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: On the Project Templates page in the Control Center, it would mistakenly
display deleted projects in the project drop-down list when choosing a project to enable
as a project template. (Ticket #36672)•

Bug fix: When the "Save & Return Later" setting is enabled on a survey and the "Allow
respondents to return without needing a return code" option is checked, if aparticipant's email address is known when they click the "Save & Return Later" buttonon the survey page, it would mistakenly display some text on the page that implied thatthey would need a Return Code to return to the survey, which is incorrect. (Ticket#36729)•Bug fix: In a longitudinal project, when a user clicks the "Delete data for THIS FORM
only" button on a data entry form, if data exists on other events for the current record
AND the form being deleted is the only form containing data on the current event, thenthat event would mistakenly still show up in reports and data exports even though it nolonger contains any data and shows gray status icons for all the instruments in theevent. (Ticket #35814)•

Bug fix: In a longitudinal project, the Scheduling module might mistakenly crash due toa fatal PHP error when attempting to generate a schedule for a record. This was often
due to using either a negative Day Offset value or negative Offset Range value forcertain Start Date values. Bug emerged in REDCap 8.1.5. (Ticket #36592)•

Bug fix: REDCap Messenger might throw a JavaScript error after being opened
because certain web browsers are beginning to deprecate synchronous AJAX requests
in JavaScript. (Ticket #36970)

•Bug fix: When using the @NOW action tag for a date field (rather than a datetime field),
it mistakenly inserts the full timestamp into the date field, which results in a field
validation error. It now instead inserts only today's date as a value into the field, as if@TODAY were used. (Ticket #36969)•

Bug fix: If a slider field on a survey or data entry form is set to display its numericalvalue, if "100" is selected for the slider, the text field would partially cut off the value
being displayed. (Ticket #37048)•

Bug fix: When using "<>", "<", or "<=" in the choice labels for drop-down, radio, orcheckbox fields on an instrument, they would not display correctly on the page but
instead might omit those operators or instead display nothing as the choice label.
(Ticket #37007)•

Various fixes and updates for External Modules framework

Version 8.1.7 - (released 3/1/2018)
BUG FIXES & OTHER CHANGES:•

Bug fix: On the Field Comment Log page in a project, if a user is using the Internet
Explorer web browser, clicking the "Apply filters" button would mistakenly cause it
mistakenly to search for the keywords "Keyword" and "search" even when the"Keyword search" text box has been left blank. This would often cause it to return noresults, which is confusing. (Ticket #36266)•

Bug fix: Projects that use repeating events or repeating instruments will now *always*
output the "redcap_repeat_instrument" and "redcap_repeat_instance" fields in a reportor data export, as well as the output of REDCap::getData, regardless of whether thereport/export contains any repeating data or not. In previous versions, it would
mistakenly only output those fields if any data in the report/export was repeating. Thismeans that the number of columns would vary unpredictably based on the filters
applied to the report/export (or based on the parameters passed to REDCap::getData),
which is confusing and inconsistent with how reports/exports typically behave. (Ticket#36263)•Bug fix: When a record is deleted in a project (either via the user interface or via API),the logging page would mistakenly display the event name for the logged event, whichis confusing because the record as a whole was deleted, not just for a specific event. It
now no longer displays the event name for the logged event, and if the project contains
multiple arms, it will instead display the number and name of the arm from which therecord was deleted. (Ticket #36358)•

Bug fix: When viewing the data entry form of a repeating instrument, in which the"Current instance" drop-down list is displayed at the top of the page, if a user clicks the"+" button inside the drop-down rather than clicking the "Add new" text, it would
mistakenly take the user to an incorrect page.

•Bug fix: When viewing/exporting a report or using the REDCap::getData() method in alongitudinal project with multiple arms, in which the user is exporting data from an armthat currently has no records in it (i.e., the data set being returned should be empty
because there is no data from that arm to return), then it would mistakenly output a listof all records from other arms but with blank/default values. (Ticket #36470)•

Bug fix: In a longitudinal project with multiple arms, in which a record exists on morethan one arm, if a user clicks the "Lock all instruments across all events" on the Record
Home page on a certain arm, it would mistakenly lock all the instruments/events onother arms in addition to the current arm. It should only lock the instruments on thecurrent arm. Note: The unlocking process does not appear to be affected by this issue.

•

Bug fix: When using DDP Custom or DDP on FHIR and adjudicating temporal data forseveral different events, if a field value is adjudicated in one event, it might mistakenly
get marked as adjudicated for that same field in other events. This causes the field tobe hidden in the DDP adjudication popup when viewing the other events, so it makes it
appear as if it has already been adjudicated when it has not.

•Bug fix: On certain occasions, the Scheduling module might mistakenly crash due to afatal PHP error when attempting to generate a schedule for a record. This appears to
only occur for PHP 5.3. (Ticket #36592)•

Various fixes and updates for External Modules framework

Version 8.1.6 - (released 2/23/2018)

BUG FIXES & OTHER CHANGES:•

Major bug fix: If a longitudinal project has more than one arm and also has theSecondary Unique Field enabled, if a record exists in multiple arms, then whenever auser saves a value on a form or survey for the Secondary Unique Field, it would
mistakenly set that value for all events in all arms for that record when instead it should
only set that value for all events in the current arm.

•

Minor security fix: Some Cross-Site Scripting (XSS) vulnerabilities were found on
various pages in which a malicious user could potentially exploit them by manipulating
the HTTP Referrer header of an HTTP request.

•

Bug fix: When viewing a record on a data entry form that exists on a repeating eventand then clicking a PDF download option to download that instrument with saved data,
the resulting PDF would mistakenly contain all the repeated instances of the instrument
for that record instead of just the current instance being viewed. This issue does notoccur for repeating instruments but only for instruments on a repeating event.

•Bug fix: For a matrix of fields displayed in the Online Designer, the matrix headers were
not aligning correctly with the radio button/checkbox for the fields. This only occurred
when viewing a matrix in the Online Designer.

•

Bug fix: When using the date-picker or datetime-picker widget to select a date/time on aform, survey, or other page in REDCap, the field validation alert might get calledprematurely, which can cause it to be displayed to the user unnecessarily or may evencause the user to get stuck (because the widget keeps displaying whenever it isclosed) and have to reload the whole page. (Ticket #35735)•

Various fixes and updates for External Modules framework•

Bug fix: When uploading a file using Send-It, if the recipients text box is left blank when
the submit button is clicked, it would forever say "Working...", in which the user would
have to manually reload the page in order to start over. (Ticket #35986)•

Bug fix: When using the Record Status Dashboard in a project with Data AccessGroups, if the paging drop-down has a specific page selected and then the user selectsa Data Access Group from the DAG drop-down, it could mistakenly try to display a"page" of records that does not exist for the new resulting data set and thus would

display "no records", which could be confusing. In this case, it will now revert back to
page 1 if the selected page no longer exists for the new DAG selection. (Ticket #36053)•

Bug fix: When using the Randomization module in a project and attempting torandomize a record on a data entry form in which the @NOW or @TODAY action tag isused *and* piping is also being performed on the same form, then the "Randomize"button would fail to appear if the user was specifically using iOS (Mobile Safari webbrowser). (Ticket #35998)

Version 8.1.5 - (released 2/15/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: When using the "Save & Return Later" survey feature, and a participant
has partially or fully completed a survey, in certain cases if they use the return codeand enter it while using the public survey link (as opposed to a private/unique surveylink), it might mistakenly create a new record instead of modifying the existing record.

•

Bug fix: When viewing the Participant List of a survey that is a repeating instrument oris on a repeating event, REDCap would mistakenly add extra placeholder rows in theParticipant List if the instrument is utilized on multiple events. These extra
ghost/placeholder rows would point to non-existing instances of an instrument. Note: If
these placeholder rows have already been created in the Participant List, thenunfortunately they will not be able to be removed. (Ticket #34741)•

Bug fix: When a non-CSV file is being uploaded into a place where only CSV files are
permitted (e.g. Data Import Tool, Data Dictionary), it would mistakenly provide a link to
a Microsoft webpage that no longer exists. The link URL has now been replaced with aworking link.

•

Bug fix: When performing a data import in a project with repeating instruments or
repeating events, in which the redcap_repeat_instance field is included in the import file
but is mistakenly given a non-numerical value, then the data values on that row might
mistakenly be saved in the database incorrectly. (Ticket #35143)

•Bug fix: In the Scheduling module when using a Start Date with the year 2038 or
higher, it would mistakenly return dates in the year 1969 for the projected schedule thatis generated. (Ticket #35178)•

Bug fix: Fixed compatibility issues when using REDCap with PHP 7.2. This includes afatal PHP error on the REDCap install page, and a fatal PHP error when downloading a
PDF of an instrument. (Ticket #35240)•

Bug fix: On the Data Dictionary upload page, it might mistakenly display someuninterpreted HTML tags and some misformatted text for warnings and errors on thepage after uploading a Data Dictionary. (Ticket #35499)•

Bug fix: If running PHP 5.3 on the REDCap server, in certain situations theConfiguration Check page might mistakenly fail to mention that PHP 5.4 or higher isrequired in order to use External Modules.

•

Bug fix: When using the "Save & Return Later" survey feature with the option enabled
to "Allow respondents to return and modify completed responses", if a respondent
begins a public survey and clicks "Save & Return Later", and then returns to thepartially completed survey using a private survey link (not using the public survey link
as before) and completes the survey, and then returns to the completed survey again
using the public survey link (not the private survey link), using the return code theyobtained the first time they visited the survey (not the return code they obtained laterthat is tied to the private link), and then they click "Save & Return Later", it will
mistakenly set the survey status back to incomplete even though the survey has been
completed. (Ticket #35210)•

Bug fix: When downloading a PDF of an instrument while on a data entry form, in whichdata has been modified on the form, after clicking a "download PDF" option it would
mistakenly display a confirmation prompt letting the user know that they will beabandoning the page, which is not true. So the prompt is unnecessary and confusing.

•Bug fix: When downloading a file attachment for a Descriptive field on a survey, inwhich data has been modified on the survey page, it would mistakenly display aconfirmation prompt letting the participant know that they will be abandoning the page,
which is not true. So the prompt is unnecessary and confusing. (Ticket #35436)

•Bug fix: If a report is being sorted by the record ID field in descending order or therecord ID field is sorted as asc/desc with one or two other sort fields, and the project
has record auto-numbering enabled but the record ID field does not haveinteger/number validation, then the report would fail to order the results correctly.

•

Bug fix: When viewing the "Stats & Charts" page for a report, slider fields and calc
fields would mistakenly not have a scatter plot displayed for them.

•

Bug fix: The field label of the Secondary Unique Field would mistakenly get displayedeven if the field has no value. It should not display the label unless there is a value.
(Ticket #35637)•

Bug fix: When importing data into a project in XML format via the API or via the plugin
method REDCap::saveData(), in certain cases it would not gracefully handle an error in
the XML but would instead mistakenly cause a PHP fatal error. (Ticket #35368)•

Bug fix: If a survey is using "Save & Return Later" with the option "Allow respondents toreturn without needing a return code" enabled, then if a participant clicks the "Save &Return Later" button at the bottom of the survey, in the email that REDCap sends to theparticipant with the survey link needed to continue the survey, the email text would
mistakenly mention that a return code would be needed, which is not correct. (Ticket#33365)

Version 8.1.4 - (released 2/1/2018)
BUG FIXES & OTHER CHANGES:•

Major bug fix: When downloading the CSV export of a survey's Participant List, a race
condition might occur if multiple users are downloading the list (or if multiple requests
are coming from the same user) near-simultaneously, in which it could possibly return aParticipant List export file that contains Survey Access Codes that do not really exist
and are therefore not valid access codes. (Ticket #34862)•

Bug fix: The setting for "External Modules: Alternate module directories" on the
Modules/Services Configuration page in the Control Center did not have clear
examples and had confusing instructions.

•Bug fix: The dashboard page in the Randomization module might mistakenly not get
rendered correctly and thus may not be viewable if malformed HTML exists in the fieldlabel or choice label of the randomization field or a criteria field.

•

Bug fix: The "Set up Survey Queue" popup in the Online Designer would mistakenly
note that the first survey instrument is not displayed in the popup and therefore cannot
be used in the Survey Queue. However, this is no longer true (but was true in earlier
versions), so that incorrect text has now been removed.

•

Bug fix: For a survey that does not have "Save and Return Later" enabled, if a
respondent returns to an incomplete survey response using a unique survey link, it
would mistakenly display the "Start Over" button to allow them to erase their answers
even if the response had been locked by a user on the data entry form. Respondents
should not be able to modify data or erase data if the form has been locked. This has
been changed so that if the response is locked, it will not display the "Start Over" button
and will inform the respondent that they cannot do anything until a survey administrator
has unlocked their response. (Ticket #34676)•

Bug fix: Fields having any of the "Number (comma as decimal)" validations would
mistakenly not have their scatter chart or descriptive stats displayed on the "Stats &Charts" page for a report.

•

Bug fix: When copying an instrument via the "Copy" action in the Online Designer, if the
instrument contains a "calc" field in which its equation has been left blank, it would
display an error stating that the instrument could not be copied.

Version 8.1.3 - (released 1/25/2018)
BUG FIXES & OTHER CHANGES:•

Medium security fixes: Many Cross-Site Scripting (XSS) vulnerabilities were found invarious pages in which a malicious user could potentially exploit them by manipulating
the query string or POST parameters of an HTTP request.

•

Minor security fixes: Some Cross-Site Scripting (XSS) vulnerabilities were found on
the "Create users (bulk upload)" section of the "Add Users" page in the Control Center,in which a malicious user could potentially exploit them by manipulating the contents of

the CSV file that an administrator uploads on that page to create new Table-basedusers.
•

Bug fix: If a survey is using "Save & Return Later" with the option "Allow respondents toreturn without needing a return code" enabled, then if a participant takes a survey using
a public survey link and clicks the "Save & Return Later" button at the bottom of thesurvey, REDCap would mistakenly email them the public survey link rather than theirprivate survey link which would normally allow them to return to their survey response
to begin where they left off. The public survey link that gets emailed to them would
mistakenly not allow them to continue their survey response.

•

Bug fix: If text data that contains line breaks/carriage returns is piped into another fieldvalue via piping inside an @DEFAULT action tag, the piped text would mistakenly
contain HTML break tags (e.g., <br>) rather than proper line breaks/carriage returns.

•

Bug fix: If a project's "Character encoding for exported files" option (on the Edit A
Project' Settings page) is set to "Chinese (UTF-8)", then the webpage would crash witha fatal PHP error whenever a user attempted to download a PDF of one or more data
entry forms. (Ticket #32892)•

Bug fix: When piping a radio button field into another field's label on the same
instrument, if the piped field is modified on that page, thus instantly piping the new
selected value's choice label, the choice label being piped would mistakenly be nonbolded text, even though the rest of the field label remains as bolded text.

•

Bug fix: For a project that utilizes the randomization module, if any of the strata fields
being used in the randomization have field labels or field notes into which data is being
piped, then the randomization dialog popup that displays these strata fields would
mistakenly not have the data piped into their labels/notes. (Ticket #33282)•

Bug fix: When a project contains repeating instruments, and a report is created that
contains fields from a repeating instrument, the "Stats & Charts" view of that reportmight mistakenly display an incorrect number of missing values for fields on a repeating
instrument. (Ticket #32078)•

Bug fix: On a data entry form or survey that utilizes a calc field or certain action tags
anywhere on the page, a random blank text field might mistakenly have a red sidebar
appear on the input field for no reason.

•

Bug fix: If an External Module is utilizing the API endpoint URL, and a new REDCap
version has been placed on the web server but the upgrade has not been completed
yet, then the API endpoint would mistakenly redirect to the wrong place. (Ticket#33520)•Bug fix: For surveys that have no questions and have been set to "One section per
page (multiple pages)" in their survey settings, it would mistakenly display the Form
Status field on the survey page. (Ticket #33467)•

Bug fix: In a production project in draft mode when adding a matrix of fields in theOnline Designer and assigning it a matrix group name that already exists, it mistakenly
allows the user to add that matrix group name, but then subsequently displays an error
message when the whole matrix setup is saved. (Ticket #33661)•

Bug fix: When using the Data Search feature on the "Add/Edit Records" page, the"Searching..." text/spinner would not accurately reflect the search request time but
would mistakenly disappear on some long searches, thus making it appear that the
search has completed when it actually has not. (Ticket #7805)•

Various fixes for External Modules framework•

The Help & FAQ page content was updated•

Bug fix: When using the @TODAY or @NOW action tag for a field on a survey
instrument, although the action tags will correctly insert the date/timestamp when the
instrument is opened as a survey page, it would mistakenly not do this on the data
entry form. Note: This only occurs on an instrument that has been enabled as a survey
and is being opened as a data entry form when the field has no value. (Ticket #33609)•

Bug fix: The "simultaneous users" check that prevents two different users from viewing
the same record/instrument/event in the same project would not successfully stop auser from viewing the data entry form if the user already on the form performs one of
the following actions: 1) upload a file onto a File Upload field, 2) download a file, 3)delete a file, or enter a value into the Secondary Unique Field (if enabled).

•

Bug fix: In certain rare cases, if a respondent clicks the download link for a File Upload
field on a survey page, it might mistakenly display an error page rather thandownloading the file.

•Bug fix: When deleting a message in REDCap Messenger, in which a non-English
language is being used for the system, it mistakenly would tell the user to type thetranslated version of the word "delete" for the local language; however it was instead
expecting the user to literally type the English word "delete", not the translation of theword. For technical reasons, the English word must be typed, so the instructions havebeen changed to clarify this. (Ticket #34174)

Version 8.1.2 - (released 12/28/2017)
BUG FIXES & OTHER CHANGES:•

New LTS branch based on REDCap 8.1.1 (Standard) + the bug fix listed below.

•

Bug fix: If attempting to enable the Twilio SMS and Voice Call services on a REDCap
server that is not publicly available to the web (i.e., on a private network or behind afirewall), it would mistakenly allow the Twilio module to be enabled in a project even if
the Twilio Request Inspector had not been disabled for the Twilio account being used.

Version 7.4.23 - (released 12/21/2017)
BUG FIXES & OTHER CHANGES:•

Medium security fixes: Many Cross-Site Scripting (XSS) vulnerabilities were found invarious pages in which a malicious user could potentially exploit them by manipulating
the query string or POST parameters of an HTTP request.

•

Bug fix: When using repeating instruments in a multi-arm longitudinal project, in whicha record exists in multiple arms at the same time, it would mistakenly display the tablesof repeating instrument data from other arms at the bottom of the Record Home Page
for a given record. It should only be displaying tables for repeating instances from thecurrent arm, not from other arms. (Ticket #32284)•

Bug fix: If the path to the hook functions file contains a dash/hyphen, it would
mistakenly cause REDCap Hooks not to be called. (Ticket #32336)•

Bug fix: If viewing the drafted changes page for a production project, in which a multiple
choice field's choices do not have a space immediately after the comma that follows thecoded value for a given choice (e.g., "1,one", as opposed to "1, one"), then if a user

clicks the Compare button in the drafted changes table on that page, it would
mistakenly not display any of the choices for the field in the resulting dialog popup thatis opened.
•

Bug fix: If using the Data Search feature on the "Add/Edit Records" page in a project, inwhich there exists a lot of matches for the search term entered by the user (e.g., if the
project has lots of records) *and* the project has either Custom Record Labels or
Secondary Unique Field enabled, then REDCap would mistakenly cause way too many
queries to be made to the database, which could cause a major load on the databaseserver. (Ticket #31544)•

Bug fix: If exporting a Project XML file for a project that contains repeating instruments,
in which a repeating instrument existed beforehand but has since been deleted, that
instrument would mistakenly still persist in the<redcap:RepeatingInstrumentsAndEvents> section of the Project XML file. However,this would not affect anything if using the Project XML file to create a new REDCap
project (i.e., the instrument would still remain deleted).

•

Bug fix: If an administrator is on the "Security & Authentication" page in the Control
Center, and the cursor is placed in either of the two text boxes for entering IP address
ranges for Two Factor Authentication, if the text box is left blank for those, it would
mistakenly display a prompt saying that the IP ranges entered are not correct, which
would keep popping up and could only be resolved by refreshing the page.

•Bug fix: If a survey instrument contains a date or datetime field, in which a respondent
completed the survey and left the date/datetime field blank, and then afterward a user
added the @TODAY or @NOW action tag to the field, then if a user opened the
response on the data entry form, it would mistakenly insert the current date value orcurrent timestamp into the blank field even though the form was still in read-only mode
(i.e., the user had not yet clicked the "Edit Response" button near the top of the form).
(Ticket #32537)•

Bug fix: Text displayed on a few certain buttons and icons would mistakenly gettruncated for non-English languages, especially French. (Ticket #32668)•

Bug fix: For certain server configurations or certain versions of PHP, any branching
logic or calculations that are not syntactically correct might mistakenly produce fatal
PHP errors. (Ticket #32486)

Version 7.4.22 - (released 12/11/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: When clicking the "Erase all data" button on the Other Functionality page whenutilizing surveys in a project, on some occasions it may mistakenly return an error
message saying that it could not delete all data, even though it did successfully delete
all project data.

•

Bug fix: REDCap Messenger would sometimes mistakenly open when navigating to a
new page even though it was just closed, and sometimes it would close on a new page
when it was just opened on the previous page.

•Bug fix: If a user is on a data collection instrument that has been enabled as a survey,
in which the record has not yet been created, if the "Save & Mark Survey as Complete"button is clicked on the data entry form, it would save the form but would mistakenly not
set the survey as complete. (Ticket #31784)•

Bug fix: If a user is on a data collection instrument that is a repeating instrument andhas also been enabled as a survey, if the "Save & Mark Survey as Complete" button isclicked on the data entry form, it would save the form but would mistakenly not set thesurvey as complete for the correct repeat instance of the instrument.

•

Bug fix: When viewing the drafted changes in the Project Modification Module of a
production project, if a field has branching logic that is being modified, in which neither
the old nor the new branching logic has spaces and both are longer than 90 characters,then the logic text might not display correctly in the table on that page. (Ticket #31765)•

Bug fix: If a project previously had repeating instruments or repeating events enabled,in which some repeating data was collected, after which repeating instruments/eventswas disabled, both the Record Status Dashboard and the left-hand project menu might
mistakenly display an incorrect status icon (the "stack" status icon) for a non-repeating
instrument/event.

•Bug fix: When creating a project by importing the REDCap project XML file that wasexported from another project, it would mistakenly remove all carriage returns/line
breaks in field labels. (Ticket #31908)

Version 7.4.21 - (released 12/1/2017)
BUG FIXES & OTHER CHANGES:•

Minor security fixes: Some Cross-Site Scripting (XSS) vulnerabilities were found invarious pages in which a malicious user could potentially exploit them by manipulating
the query string of an HTTP request.

•

Bug fix: If a project in production status is in draft mode, and the Move Field icon isclicked for a field in the Online Designer in order to move a field, in which the field is thefirst field on a data collection instrument, then after being moved, the project's
instruments might not display correctly in the Online Designer, such as making somefields not even viewable on any instrument in the Online Designer view. This issue
would persist while still in draft mode, but would eventually resolve once the draftedchanges were approved. Note: This issue would not affect how fields or instruments
are displayed on data entry forms or survey pages when entering data.

•

Bug fix: If two users are simultaneously on the Online Designer or Data Dictionary pagein a project in production status that is in draft mode, in which one user clicks the"Submit changes for review" button immediately after the other user clicks the "Remove
all drafted changes" link, it would mistakenly delete all the fields in the project if thesubmitted changes were approved by an Administrator.

•

Bug fix: If a user enters data on a repeating instrument but fails to enter a value for arequired field, and then the user clicks the "Ignore and go to next form" button in the"Some fields are required" prompt, in which the next form is *not* a repeating
instrument, then it would mistakenly take the user to the next form but on an incorrect
instance, which may cause some data to not get stored properly on that second form.
When clicking the "Ignore and go to next form" button, it should always take the user toinstance #1 of the next form unless the user is currently on a repeating event. (Ticket#29801)•

Bug fix: When uploading a data dictionary containing calc fields, it might mistakenly
display an error stating that some equations are not syntactically correct, which isultimately caused due to line break characters from Mac Excel (as opposed toWindows Excel line breaks).

•Bug fix: When clicking the H icon next to a field to open the Data History Widget on adata entry form, it would mistakenly omit any logged events for "Update record (API)(Auto calculation)". (Ticket #31362)•

Bug fix: When downloading a PDF of a data entry form, on specific occasions it may
mistakenly crash and return an error message saying "FPDF error: Interlacing notsupported...". (Ticket #31101)•

Bug fix: When downloading the Project XML file (metadata or metadata+data file), it
might mistakenly duplicate a checkbox field's choices numerous times in the metadata
section of the ODM XML file. (Ticket #29287)•

Bug fix: When assigning a user to a user role on the User Rights page in a project, if
the user is using certain versions of Internet Explorer, the "Notify user via email?"checkbox would sometimes mistakenly not get displayed after clicking the "Assign torole" button. (Ticket #30764)•

Bug fix: When the survey login is used in a longitudinal project, if three fields are set tobe the login field, in which the same field is used but on different events or arms,
although it would save the settings correctly, if the survey login popup was later
reopened after being saved, the event/arm drop-down for the login field #3 would
mistakenly have the event/arm value of login field #1. (Ticket #18430)•

Bug fix: When using other languages as the stock text for a project, a JavaScript error
may occur on the Survey Settings page for an instrument when a user attempts to set"Send confirmation email" as "No" after first setting it as "Yes", which may prevent thesection from closing or re-opening. (Ticket #30713)

Version 7.4.20 - (released 11/17/2017)
BUG FIXES & OTHER CHANGES:•

Minor security fix: A Cross-Site Scripting (XSS) vulnerability was found in a pageused by various functionality dealing with user accounts, in which a malicious user
could potentially exploit it by manipulating the query string of an HTTP request. (Ticket#30806)

•Bug fix: When a user is viewing the Data Export Files tab on the File Repository pagein a project, and they set the "filter by" drop-down to Stata, R, SPSS, or SAS, then in
the results displayed in the table below, the Data CSV file would mistakenly not be
downloadable. (Ticket #30578)•

Bug fix: When creating a new Data Quality rule that is attempting to find blank values(via [field]=""), if all the fields being referenced in the rule logic are blank/null for a given
record, the rule would mistakenly not return any discrepancies for that record. (Ticket#30655)•

Bug fix: When viewing the Configuration Check page in the Control Center, if the"mbstring" PHP extension is not installed on the web server, it would mistakenly throwa fatal PHP error on that page during the "able to send emails" check. (Ticket #30657)•

Bug fix: In longitudinal projects that utilize the survey queue to display surveys acrossmultiple events, the survey queue would mistakenly order the surveys by instrument
order rather than by event order. This has been fixed so that it now orders surveys inthe queue by event order so that all the surveys in a given event are grouped together.
(Ticket #30704)•

Bug fix: When a survey is enabled in the survey queue in a longitudinal project, andthen that survey instrument is removed from a given event (via the Designate
Instruments page), thus orphaning the survey-event in the survey queue, if no othersurvey-events are enabled in the survey queue, then the Survey Queue button in theOnline Designer might mistakenly still have a green checkmark icon next to it, eventhough no survey-events are enabled in the queue anymore. Also, in this case thesurvey-event may mistakenly get displayed in a record’s survey queue when the survey
is no longer designated for that event.

•Bug fix: When the survey login is used in a longitudinal project, if multiple fields are set
to be the login field, in which the same field is used but on different events or arms,
then it would mistakenly not save both instances of the field but would only save one.
(Ticket #18430)

Version 7.4.19 - (released 11/9/2017)
BUG FIXES & OTHER CHANGES:•Minor security fixes: Some Cross-Site Scripting (XSS) vulnerabilities were found invarious pages in which a malicious user could potentially exploit them by manipulating
the query string of an HTTP request.

•

Bug fix: When downloading a PDF of a data entry form with data, in which the user isdownloading all forms for all records or all forms for a single record, it would mistakenly
not display the locking/e-signature timestamps in the PDF. (Ticket #29915)•

Bug fix: When downloading a PDF of a survey response with data, on certain
occasions it might mistakenly display incorrect survey completion timestamps in the
PDF. (Ticket #29930)•

Bug fix: On the Record Status Dashboard when clicking on the form status stack icon
(representing multiple repeating instances of a form or event) in a longitudinal projectthat has multiple arms, it might mistakenly not display the floating table of instances but
instead would display a horizontal black line after clicking the icon. (Ticket #29927)•

Bug fix: In longitudinal projects using repeating events, the Record Home Page might
mistakenly display some form status icons in the wrong column in the table for records
that have more than one instance saved of a repeating event. (Ticket #30077)•

Bug fix: When one or more fields in a matrix contain certain special characters in theirfield label, it might prevent the "Edit Matrix of Fields" popup from being displayed after
clicking the pencil icon on the Online Designer. (Ticket #30250)•

Bug fix: On certain occasions, rule E in the Data Quality module will mistakenly return
discrepancies that have blank/null values, which should never be returned whenrunning rule E. (Ticket #14976, #28576)•

Bug fix: If a Notes field is using the @READONLY action tag, the "expand" link
displayed on the survey or form below the text box would mistakenly not work. (Ticket#30433)•

Bug fix: If a project is utilizing the randomization module, and the randomization fieldsomehow already has a value saved for it prior to a given record being randomized,then it will now disable that field on the data entry form and prevent the record frombeing randomized. (Ticket #30427)

•Bug fix: If a project that has repeating instruments or repeating events is using the Data
Resolution Workflow module, and a value is marked as Verified on the first instance ofa repeating instrument/event, then if a value is changed on another instance of that
instrument or event, respectively, then it would mistakenly De-verify the field on the first
instance rather than on the current instance. (Ticket #30457)•

Bug fix: If a project that has repeating instruments or repeating events is using a Data
Quality rule with Real-time Execution enabled, if the DQ rule finds discrepancies whensaving a repeating instrument/event, in which the user is not on the first instance, thenin the DQ discrepancy popup, it might mistakenly display some data values from thefirst instance of the instrument/event rather than from the current instance. (Ticket#30477)•

Bug fix: Fixed typo in "Branching Logic Errors Exist!" popup

Version 7.4.18 - (released 11/3/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: The font size of any links that were placed in a survey's instructions, fieldlabels, or acknowledgment text would appear too small if the survey was set with
"Large" or "Very Large" text size.

•

Bug fix: If a user is uploading a Data Dictionary containing a PROMIS CAT (computer
adaptive test) survey, in which the CAT contains some multiple choice fields that have
duplicate codings, it would mistakenly prevent the user from uploading the Data
Dictionary. It should be ignoring duplicate codings in CATs.

•

Bug fix: If a user is uploading a Data Dictionary containing a PROMIS CAT (computer
adaptive test) survey and the user modified the Choices column for a CAT field in the
Data Dictionary, it would mistakenly accept those changes and allow the Data
Dictionary upload to proceed, thus corrupting the CAT's field metadata. This would notaffect participants taking the CAT in any way (i.e., the survey would still appear
correctly when taking it), but it might cause the CAT not to display correctly when auser views a participant's CAT response on a data entry form afterward.

•Bug fix: If a user enters data on a repeating instrument but fails to enter a value for arequired field, and then the user clicks the "Ignore and go to next form" button in the"Some fields are required" prompt, in which the next form is also a repeating
instrument, then it would mistakenly take the user to the next form but on the same
instance number that the previous form was on, which may cause some instancenumbers to get skipped on the second form. When clicking the "Ignore and go to nextform" button, it should always take the user to instance #1 of the next form if the next
form is a repeating instrument.

•

Bug fix: Improving compliance with SMTP email servers by added a space after the"Cc:" and "Bcc:" email headers since some SMTP servers might reject emails sent fromprevious REDCap versions, which had no space in those headers. (Ticket #3943)•

Bug fix: When editing or adding a calc field in the Online Designer, it would mistakenly
still show the results in the section "test calculation with a record" if that option had justbeen used for another calculated field that was being edited or added previously whileon that page, thus mistakenly showing results that do not correspond to the current
field being edited/added (Ticket #29682)•

Bug fix: When opening the Automated Survey Invitation setup popup in the Online
Designer, if a particular ASI has been set as "inactive" beforehand, then when the
popup opens, it would mistakenly display all the ASI setup options as blank as if it had
never been set up before. (Ticket #29765)•

Bug fix: When the Project Modification Module displays a list of "fields to be deleted", itwould mistakenly truncate the count of records/events that would be affected by thefield being deleted. (Ticket #29770)•

Bug fix: If a user opens a data entry form on a repeating event, it would mistakenly
never enable the Survey Options at the top right of the page, even if the form has beensaved already. (Ticket #29857)•

Bug fix: When using Twilio telephony services for surveys and then opening the"Analyze surveys for SMS & Voice Calls" popup on the Project Setup page, it would
incorrectly say that no surveys have been enabled (even though they have) if the user
had failed to check at least one of the checkbox options under the "Choose survey
invitations types to use" section in the Twilio configuration. (Ticket #18658)

•Bug fix: When adding/editing the logic for a Data Quality rule, in which the logic
contains a "less than" (<) character followed immediately by a function name (e.g.,round) - i.e., without a space between the "<" and the function name, then the rest of
the logic would get truncated when displaying the logic in the table of Data Quality
rules. (Ticket #30088)

Version 7.4.17 - (released 10/25/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: If a user is in REDCap Messenger and using the "Search by person"
option in the Search Conversations feature, then after selecting a username to searchon, if the user being searched for has a conversation that has the *exact* same title as
one of the current user's conversations' titles, then it would return the other user's
conversation in the result (and mistakenly allow its messages to be viewed by thecurrent user) even if the current user does not have access to that conversation. Thisbug is very rare since it requires using the "Search by person" option (as opposed tothe "Search by keyword" option) while also requiring that both users have access to aconversation that is different but has the exact same title.

•

Bug fix: Data Resolution Workflow popup dialog might mistakenly appear empty ifsome comments or logged events contain certain special characters. (Ticket #29391)•

Bug fix: The Record Home Page would not display some form status icons correctly for
repeating instruments in which the first instance of the instrument does not exist - most
likely because it was deleted at some point. (Ticket #28821)•

Bug fix: The tables of repeating instruments displayed at the bottom of the Record
Home Page might not display in the correct order.

•

Bug fix: If field labels contain certain special characters, then when creating/modifying areport, the auto-suggest feature when typing variable names in Step 2 or 3 would
mistakenly not work. (Ticket #29354)•

Bug fix: Confusing text is mistakenly displayed for the instructions on the "Request
delete project" button on the Other Functionality page in a project that is in production
status. (Ticket #29355)

•Bug fix: Confusing text is displayed when in draft mode in a production project after adata dictionary has been uploaded. It now states explicitly that the changes have been
made to the draft and thus have not been committed to the live version of the project.
(Ticket #29430)•

Bug fix: The Publication Matching module would mistakenly treat a PI's email address
as separate emails if it was found to be typed in different cases (lower vs upper) in
different REDCap projects. This would cause some PIs to receive emails saying thatthey had publications to review in REDCap, but it would say "0 publications" when theyclicked the link in the email to open the page. Note: While this should fix the issue
going forward, it may not fix it for publications already pulled from PubMed for the PIs.
(Ticket #29381)•

Bug fix: When submitting data on a data entry form or survey page, the server-side
validation mistakenly does not check the values submitted for an "SQL" type field.
(Ticket #29401)•

Bug fix: If a File Upload field has a file uploaded for it but also has the @READONLY
action tag, the link to download the file would mistakenly be disabled, thus preventing
users from downloading the file. The download link should be enabled to allow users to
download the file. (Ticket #29484)

Version 7.4.16 - (released 10/18/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: Automated Survey Invitations would mistakenly not get scheduled for
longitudinal projects where the conditional logic contains datediff+today and also
contains cross-event logic in which one of the events has no data (i.e., empty event ofgray status icons). This same issue would also occur for custom Data Quality rules, inwhich it would mistakenly not return any discrepancies for records if the rule logic
contains datediff+today and also contains cross-event logic in which one of the events
has no data. (Ticket #28516)•

Minor security fix: While REDCap already protects against BREACH attacks by
outputting invisible random text of random length onto each web page, it was
mistakenly not protected if 302 redirect requests inside REDCap were being analyzed.

(This refers to the few scripts in REDCap that serve as a pass-through by outputting an
HTTP 302 status code and merely redirect the user to another page.) To prevent
BREACH attacks through analysis of REDCap's 302 redirects, it now outputs a new
HTTP header with each request, in which the header's value is random text of random
length. In this way, even 302 redirect requests will return with a random content-lengtheach time.
•

Bug fix: If a survey queue is set up in a longitudinal project, and then the event-form
designations are modified afterward, it might mistakenly display some surveys in thesurvey queue that should not be displayed. (Ticket #28696)•

Bug fix: If a report is being sorted by the record ID field in descending order, and the
project has record auto-numbering enabled but some of the record names are notnumerical (because they were created via a data import or before record autonumbering was enabled), then the report would fail to order the results correctly. Thisoccurs because the report would falsely assume that all record names were numericalmerely because record auto-numbering was enabled, in which case it would try
performing a numerical sort, which does not work as expected with non-numerals.
REDCap now only attempts to perform a numerical sort of the sort fields if the fields are
truly numbers (i.e., have "number" or "integer" validation or are a slider or calc field).

•

Bug fix: The cron job to trigger Automated Survey Invitations that have datediff+today
in their conditional logic would stop suddenly if any ASI logic was syntacticallyincorrect, thus preventing other later ASIs in that same project from getting run.
Additionally, the cron job might mistakenly be checking ASIs that had been disabled.
(Ticket #28516)•

Bug fix: For longitudinal projects with multiple arms and with repeating instruments, on
the Record Home Page or Record Status Dashboard when clicking on the form status"stack" icon for a repeating instrument with multiple instances saved, it would
mistakenly not display the floating popup list of all the instances for that instrument but
would instead display an empty box. (Ticket #28970)•

Bug fix: The Safari browser might mistakenly throw JavaScript errors on survey pages.

Version 7.4.15 - (released 10/10/2017)

BUG FIXES & OTHER CHANGES:•

Major bug fix: If a calculated field in a longitudinal project is using cross-event
calculations, in which at least one of the fields in the calculation has a prepended event
name (e.g., [enrollment_arm_1][field]) while also one of the fields does not have aprepended event name (e.g., [feld]), then even though the calculated value displayedon the form/survey appears correct prior to saving, the field might mistakenly get savedwith a blank value when pressing the Save button. This would not be noticeable by theuser when entering data but only seen in a report/export or when running Data Quality
rule H. Note: This issue does not appear to affect Automated Survey Invitations,calculations performed during data imports, or Data Quality rule H, but it only occurs
when saving data on data entry forms and surveys in this very specific scenario
described above. To fix this issue after upgrading REDCap, the user can run Data
Quality rule H in the project, or an administrator can use the "Find Calculation Errors in
Projects" page in the Control Center to find any affected projects.

•

Bug fix: If the PHP memory_limit configuration setting was set in units of "G" (forgigabytes) in the PHP.INI file, it would get interpreted incorrectly when attempting toincrease PHP memory allocation.

•

Bug fix: When printing out a survey containing responses where some "enhanced radio
buttons and checkboxes" have been selected on the survey, it would be confusing in
the printout as to which choice was selected. (Ticket #28111)•

Bug fix: Project pages would not render correctly due to JavaScript errors occurring on
every page if the using Internet Explorer 8. (Ticket #28178)•

Bug fix: When viewing a read-only survey response on a data entry form (i.e., prior toclicking the "Edit response" button), if a calculated field's value changed when the page
loaded, then if the user attempted to close the browser tab or clicked a link to navigate
to another page, it would mistakenly prompt them with the "Save your changes?"dialog. It should only prompt them with that dialog if they were in edit mode for thatsurvey response.

•

Bug fix: When the Data History popup for a field on a data entry form, if two events forthe field occurred at the same exact time, such as saving data with an auto-calculation
event right after, those two events might mistakenly not be displayed in the correct
order in the popup.

•Bug fix: When using Table-based authentication and a user is asked to set up theirpassword recovery question, their email address would not get displayed correctly
inside the prompt if their email address contains an apostrophe, in which this would
prevent them from fully setting up their recovery question. (Ticket #28439)•

Bug fix: When a data export takes more time to complete than the set auto-logout timefor REDCap, it would mistakenly prevent the data export from completing fully because
the "Your REDCap session has expired" dialog would appear on the page even if theuser is actively moving their cursor around or clicking on the page, which normallyrestarts the auto-logout timer to prevent the auto-logout from occurring while a user isstill active on a page.

•Bug fix: When using the Data Resolution Workflow module in a project containing
repeating instruments while also using Data Access Groups, some of the charts
displayed on the the Resolution Metrics page, specifically "Number of open queries (bydata access group)" and "Number of closed queries (by data access group)", would
mistakenly display incorrect counts in the chart. This issue was supposed to have been
fixed in the previous release but mistakenly was only partially fixed.

•

Bug fix: If the Data Resolution Workflow (DRW) is enabled on a project, and a user has
DRW user privileges but does not have Data Quality user privileges, then the "Data
Quality" link would mistakenly be displayed on the left-hand menu. (Ticket #28514)•

Bug fix: When importing data via the Data Import Tool or API import records method, if
a variable in the import mistakenly had some uppercase letters when all letters should
be lowercase, the error message to the user would omit those uppercase letters whendisplaying the incorrect variable names to the user, thus making it difficult tounderstand the error message to learn what is wrong. (Ticket #28293)

Version 7.4.14 - (released 10/2/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: If using "LDAP & Table-based" authentication and an LDAP user logs in
to REDCap when a Table-based user account already exists under the sameusername (i.e., a username conflict), then the LDAP user would mistakenly get
successfully authenticated into REDCap and would be able to view and access all theother user's projects as if they were the other user. This has been changed so that now
if a username conflict occurs, in which a Table-based username is the same as a valid
LDAP user's username, then when the LDAP user attempts to log in, REDCap will notallow them to log in but will give them an informational note about the username conflict
and will recommend that they contact their local administrator about how to resolve theissue.
•

Bug fix: If the Rate Limiter on the General Configuration page in the Control Center is
set to "0" or a blank value, it would mistakenly ban the IP address of every user that
attempted to use REDCap.

•

Bug fix: In a multi-arm longitudinal project using the Scheduling module, in which a
record has been scheduled for more than one arm, the "View or Edit Schedule" page's
record drop-down list would mistakenly display the record only for a single arm rather
than for all arms for which it had been scheduled.

•

Bug fix: When exporting data to a statistical analysis package (i.e., SAS, SPSS, R,
Stata), if the project contains Data Access Groups and also Repeating
Instruments/Events, it would mistakenly list the DAG field and Repeating
Instrument/Instance fields in the wrong order in the stats package's syntax file that getsgenerated. This would prevent users from loading the data into the stats package.
(Ticket #27883)•

Bug fix: If a user fails to enter data for a required field that exists on a repeating event,then when the required field popup prompt is displayed, if the user clicks the "Ignore
and go to next form" button, it would mistakenly redirect them to the first instance of theevent rather than to the current instance. (Ticket #27891)•

Bug fix: When using the Data Resolution Workflow module in a project containing
repeating instruments while also using Data Access Groups, some of the charts
displayed on the the Resolution Metrics page, specifically "Number of open queries (bydata access group)", "Number of closed queries (by data access group)", "Avg time toquery resolution (by data access group)", and "Avg time for query response (by data
access group)", would mistakenly display incorrect counts in the chart. (Ticket #27888)•

Bug fix: When viewing drafted production changes for a project on the Control Center's
To-Do List page, if a user clicks the Compare button next to a multiple choice field thathas been modified inside the popup, then when they close the popup (which is a popupinside a popup), it would also mistakenly close the whole To-Do List popup (the parent
popup), thus causing the user to have to re-open it again. This issue has been fixed for
Chrome, Safari, and IE 11. Note: There is currently no known way to fix this bug for
Firefox or older versions of IE at this time, unfortunately. (Ticket #27915)•

Bug fix: If a Data Quality rule has been created and is set with the Real Time Execution(RTE) option, the DQ rule would fail to perform RTE on a data entry form if the form
exists on repeating event, in which it would mistakenly not report any discrepancies
that exist. This only occurs on repeating events but not on repeating instruments(Ticket #27960)•

Bug fix: If data from a Notes field is being piped into a label of another field, then if thetext itself contains line breaks, that text would mistakenly have double line breaks foreach single line break when exporting a PDF of the instrument with data. (Ticket#27983)

Version 7.4.13 - (released 9/27/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: When using Automated Survey Invitations in a longitudinal project,under certain conditions ASIs with datediff+today would mistakenly not get evaluated,
and thus invitations would not get scheduled/sent. This might have occurred with thesecond or more invitation for an instrument configured across more than one event
between versions 7.4.0 and 7.6.6.

•

Minor security fix: When sending emails of any kind, REDCap now performs an extra
validation on the From email address of the email being sent to ensure it is a valid
email address, thus preventing any kind of injection by malicious users like those seenin the PHP mail issues CVE-2016-10033 and CVE-2016-10045.

•

Bug fix: When logging into REDCap using a mobile device, the error message would
mistakenly not display if an invalid username or password was entered, which could be
confusing as to why the login failed. On non-mobile devices, the error message
displays properly.

•

Bug fix: When viewing surveys in the Safari browser in which the survey's "Size ofsurvey text" is set to "Large", checkboxes and radio button fields would mistakenly notdisplay correctly and would overlap one another a little.

•

Bug fix: When using the Survey Login on a survey that has the "Save & Return Later"
option disabled, it would mistakenly display the "Save & Return Later" at the bottom of
the survey page if the participant had just logged in via Survey Login. (Ticket #27389)•

Bug fix: The Record Home Page and Record Status Dashboard could loadunreasonably slowly for projects containing lots of fields, many of which have stored
data values. (Ticket #27161)•

Bug fix: When clicking the "unlock all instruments" link on a multi-arm longitudinal
project's left-hand menu while viewing a record belonging to an arm that is not on thefirst arm, it would mistakenly not unlock all the locked instruments for that record.
(Ticket #27740)•

Bug fix: When piping data into a label, in which the data being piped contains text thatlooks similar to HTML tags but is not an actual HTML tag (e.g., "hello <123>"), the text
inside the <...> would get mistakenly removed from the downloaded PDF file of thedata collection instrument with data. (Ticket #27467)

Version 7.4.12 - (released 9/22/2017)
BUG FIXES & OTHER CHANGES:•

Minor security fix: A Blind SQL Injection vulnerability was found on the User Access
Dashboard page in which a malicious user could potentially exploit it by manipulating
the query string of an HTTP request.

•

Minor security fix: Modified how files get deleted in a project's File Repository so that a
POST parameter is used instead of query string parameter, which could subvert Crosssite Request Forgery (CSRF) protection.

•

Bug fix: REDCap Messenger was mistakenly not disabled in public projects (i.e., having
no authentication enabled). Because public projects do not utilize REDCap
authentication and thus store session information differently than regular projects,
REDCap Messenger will be permanently disabled from inside a public project.

•Bug fix: When the Data Resolution Workflow module is enabled in a project, and a user
is viewing the DRW popup that details the history of a data query, if a user that
contributed to that data query has since been deleted from the system, then it would
display a blank value where their username would be in the popup history. It now says"[User deleted from system]" if the user has been deleted from the system since it is
not possible to determine the username of the deleted user for that event. (Ticket#26835)•

Bug fix: When a respondent is viewing the Stats & Charts after completing a survey,
the Download Image button would fail to download an image of the chart. (Ticket#27072)•

Bug fix: When the text-to-speech feature is enabled on a survey, clicking the speaker
icon next to a survey question in order to have it speak the text would mistakenly cause
the question choice to become selected/unselected for radio buttons and checkbox
fields. (Ticket #27103)•

Bug fix: When downloading a data dictionary snapshot from the Project Revision
History page, if the dictionary contained any UTF-8 encoded characters, then thesnapshot might not open correctly in some CSV viewers, such as Microsoft Excel, in
which those UTF-8 characters would get mangled and be unreadable, whereas thenormal data dictionary download (i.e., non-snapshot CSV) would open correctly andcould be viewed normally with no mangling of characters.

•

Bug fix: The data import process (Data Import Tool or API) would mistakenly prevent
users from importing a value for a checkbox field that has a negatively valued choice(e.g., "-1"), in which it displays an erroneous error. This appears to only occur inlongitudinal projects. (Ticket #16235)•

Bug fix: When deleting a file for a File Upload field by 1) individually deleting it on adata entry form, 2) deleting the whole data entry form's data via the Delete button at thebottom of the form, or 3) deleting a whole event's data (longitudinal projects only) for arecord on the Record Home page, it would mistakenly not remove the file from the
REDCap server after 30 days, even though the file appears deleted to the user. All"deleted" files should remain on the server for 30 days, after which they are deleted bya cron job, but in these scenarios, the files would mistakenly stay on the server foreveras orphaned from the records to which they were originally attached. (Ticket #27303)

Version 7.4.11 - (released 9/13/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: When viewing the Data History popup for a field, in which the record has been
added to multiple arms in the project but was deleted from at least one arm, no data
would be displayed in the popup for the field mistakenly.

•

Bug fix: In certain rare cases on the Project Modification Module for multiple choice
fields, the Compare button would mistakenly not parse the old/new choices correctly
and give strange results displayed on the page and in the comparison popup.

•

Bug fix: If a user clicks the Enter key on their keyboard while their cursor is in the report
title text box on the Create New Report page, it would mistakenly open the User
Access popup.

•

Bug fix: For certain web server configurations, using the Create Custom Survey Link
button on the Public Survey Link page might mistakenly not create a short link
successfully.

•

Bug fix: When attempting to upload a non-XML file on the CDISC ODM tab in the Data
Import Tool page, it would mistakenly display an empty popup with no error text. (Ticket#26116)•

Minor security fixes: Some Cross-Site Scripting (XSS) and Blind SQL Injection
vulnerabilities were found in the Calendar module and Online Designer, respectively, inwhich a malicious user could potentially exploit them by manipulating the query stringof an HTTP request.

•

Bug fix: In very specific use cases where a date or datetime field is utilized in a
calculation to check if the date/time is blank or not blank, it might mistakenly not beable to parse the calculation correctly or (in some extreme cases) might result in anincorrect value. This would only occur if one of the following four scenarios exist insidean "if" statement's condition for a calculated field: 1) "...and [date]=''", 2) "...or [date]=''",
3) "...and [date]<>''", or 4) "...or [date]<>''".

•

Bug fix: When using the API Import Records method using "eav" format and importing
data into fields that exist on a repeating instrument, it might return an erroneous errorstating that the values for 'redcap_repeat_instance' and 'redcap_repeat_instrument'
were not provided, which is incorrect.
•

Bug fix: When using both Repeating Instruments and Repeating Events in a project, on
certain occasions the Record Home Page might mistakenly display a "stack" form
status icon (representing multiple instances of data) for instruments that actually haveno data. (Ticket #26094)•

Bug fix: If an SQL field has choices with values that contain commas, apostrophes, orquotes, then in some cases the drop-down might mistakenly not have the correct value
pre-selected for the field when a data entry form or survey page is loaded, in which thefield would appear blank with no option selected. (Ticket #26176)•

Bug fix: After scheduling a record in the Scheduling module, the "View or Edit
Schedule" page might mistakenly display some HTML tags (e.g., "<br/>") inside theNotes column when viewing a record's schedule. (Ticket #26550)•

Bug fix: Exporting a PDF of an instrument that was downloaded from the REDCap
Shared Library can cause a fatal PHP error if the project's "Character encoding forexported files" is set to "Japanese (Shift JIS)" or "Chinese (UTF-8)" on the "Edit A
Project's Settings" page. (Ticket #26766)•

Bug fix: When entering certain YouTube video URLs as a Descriptive field's external
video, it might mistakenly not parse the URL correctly, thus causing the video not to beplayable on data entry form or survey. (Ticket #26672)•

Bug fix: After a REDCap administrator approves a production draft mode request, theTo-Do List in the Control Center would mistakenly display the request time of the lastproduction change for all the previous production changes that have been requested in
the past for that one project. (Ticket #26635)•

Bug fix: If the record ID field in a project was used as a Survey Login field, it would
malfunction and always get counted as correct during the login process, even if anincorrect value was entered by a participant. This would effectively allow participants to
bypass the survey login if the record ID field was the only login field being used forsurvey login. To prevent this issue, the record ID field is now no longer allowed to be
used as a survey login field. (Ticket #26456)

•Bug fix: When using the Double Data Entry module on a longitudinal project withmultiple arms, if a user is DDE person #1 or #2, they would mistakenly see all records(across all arms) in the record list on the "Add/Edit Records" page, when instead theyshould only see the records that belong to the currently selected arm. (Ticket #26371)•

Bug fix: The Control Center text discussing where a project's grant number is displayed
was incorrect and has been changed to "Name of grant to be cited (optional) displayed when users export data". (Ticket #22780)•

Bug fix: If the REDCap server's PHP.INI configuration has the post_max_size variable
set in units of gigabytes ("G") rather than megabytes ("M"), it might display anerroneous error on certain occasions saying that it has "exceeded the REDCap server's
maximum submission size". (Ticket #26966)

Version 7.4.10 - (released 8/23/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: If a project contains one or more fields using the Biomedical Ontology
functionality, and a user copies the project with all its records, then the Biomedical
Ontology labels that were cached for the original project mistakenly do not get copied,which can cause the value to get accidentally erased on a data entry form or survey if auser places their cursor into the Biomedical Ontology field but does not re-enter thevalue. (Ticket #25451)•

Bug fix: On the Control Center's System Statistics page, the "Responded" count under"Survey invitations sent" might be slightly inaccurate. (Ticket #25361)•

Bug fix: Fixed typo on Locking Management page.

•Bug fix: If a user exceeds the maximum number of failed login attempts in a set periodof time and thus gets temporarily locked out, it would mistakenly not allow them to log
in even if an administrator had reset their password afterward. It would instead makethem wait until after the lock-out window of time had elapsed before they could log inwith their new password, which is incorrect and confusing. (Ticket #23516)•

Bug fix: In the add/edit user privileges popup on the User Rights page, where a user
can click the "Explain these settings" link to open the "Settings pertaining to project

records" popup, which that explains the Create Records, Rename Records, and Delete
Records privileges, that popup contained information that was very outdated and nolonger correct. That text has now been updated.
•

Bug fix: When a user is viewing drafted changes in the Project Modification Module of a
project in production status, if any multiple choice fields have had a choice re-labeled or
had a choice removed, then when clicking the Compare button for the field, the record
count in the Choices Change Summary popup would not have correct counts forchoices listed as Unchanged, in which Unchanged choices would always mistakenly
have "0" for "Number of records having this value". (Ticket #25851)•

Bug fix: When clicking the Create Custom Survey Link button on the Public Survey Link
page in a project, some REDCap servers might have difficulty creating a custom link
successfully because REDCap was making a call to http://is.gd rather
than http://is.gd For better compatibility, this has now been changed so that the httpsaddress is always called.

•

Bug fix: When a user has been assigned to a Data Access Group (DAG) and iscreating a new record, if record auto-numbering is disabled in the project and the user
uploads a file for a File Upload field on a data entry form before clicking a Save buttonon the page to create the record, then if the user later leaves the page without saving
their changes via a Save button, the record would mistakenly not get assigned to theuser's DAG but would instead not belong to any DAG.

Version 7.4.9 - (released 8/10/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: When deleting a document that has been uploaded to a File Upload field on asurvey, it would mistakenly display a box inside the field that asks the respondent toenter their survey access code. This only occurred on surveys and not on data entry
forms.

•

Bug fix: Changed "Content-type" header to "Content-Type" in the Message PHP classbecause some email tools do not function properly if that header is in a different case.
(Ticket #25051)

•Bug fix: When viewing the Data Resolution Workflow's Resolve Issues page andexporting the dashboard table as a CSV file, it might mistakenly output HTML charactercodes (e.g., ') for apostrophes, quotes, and non-breaking spaces in the CSV file.
(Ticket #24833)•

Bug fix: When clicking the "Unlock all instruments" link on a longitudinal project's lefthand menu after selecting a record, it would mistakenly only unlock the data entry
forms in the current event being viewed rather than in all events for the record.
Additionally, the "Lock all instruments" link on some occasions might mistakenly display
an erroneous error message after being clicked. (Ticket #24861)•

Bug fix: If two-factor authentication is enabled, and a normal user logs into REDCap
when the entire system has been taken offline (via the System Status setting on the
General Configuration page), then it would mistakenly display the two-step login screen
and an empty, malformed popup rather than displaying the offline message. (Ticket#25148)•Change: Modified the explanation text for @NOW and @TODAY action tags for greater
clarity with regard to their usage. (Ticket #24847)•

Bug fix: Line breaks inside field labels do not work well in Excel on Macs when
downloading a data dictionary and then re-uploading it, in which the line breaks would
often get doubled after re-uploading it into REDCap. Technically, it now replaces as
carriage return+line feed characters with simply a line feed character to prevent thisdoubling effect. (Ticket #21681)•

Bug fix: On the Record Status Dashboard page in a project, a database query would
sometimes fail specifically for MySQL 5.7 only, in which it would be unable to retrieve
all the form status values to display for records on the page.

•Bug fix: When deleting a user-uploaded file on the File Repository page in a project, it
would not successfully delete the file on certain occasions.

•Bug fix: If using the REDCap::getPDF() method inside a REDCap hook that gets called
on a survey page, it would mistakenly force a PDF download on the page, in which the
PDF would be corrupted and not able to be opened, instead of returning the contents of
the PDF as a string to the hook. (Ticket #25198)

•Bug fix: On very specific and seemingly random occasions, a relatively long field label
in a right-aligned field might not display correctly in the PDF download of the
instrument, in which it would mistakenly display the label as one word per line rather
than wrapping the text as expected. (Ticket #15336)•

Bug fix: When a field has branching logic that is dependent on another field that is
hidden/displayed due to branching logic, if a field upstream on a form/survey has avalue that is later changed, then all the chained branching logic on the page would
mistakenly not cascade through all fields as it should, thus leaving some fields
displayed that should be hidden.

Version 7.4.8 - (released 8/4/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: Fixed incorrect language in plugin/hook documentation for the
REDCap::saveData() method. (Ticket #24619).

•

Bug fix: When using the "Test calculation with a record" functionality for a calc field in
the Edit Field popup in the Online Designer, it would mistakenly return a non-numericalvalue (rather than a blank value) in certain cases where an "if" statement is set toreturn a non-numerical value for a specified condition. It will now return "[No value]"instead. (Ticket #24612).

•

Bug fix: When using a Custom Record Label for a project, in which the fields used in
the Custom Record Label exist on a repeating instrument, it would mistakenly not pull
those fields' data correctly, thus causing those fields to be blank in the Custom Record
Label. In this case, it now pulls the data for those fields from the first instance of therepeating instrument. (Ticket #24610)•

Bug fix: On some occasions REDCap Messenger might mistakenly throw a JavaScript
error if Messenger was initially closed when the page loaded but then was opened.
This is due to AJAX synchronicity issues. (Ticket #24930)•

Bug fix: When entering an email address in certain email fields on Configuration pages
in the Control Center, the field validation would reject email addresses that have newer
domain names (e.g., rob@cabrini.technology). (Ticket #24686)

•Bug fix: If a field utilizes the @NOW or @TODAY action tag on a survey or data entry
form, and that field's value is also piped somewhere on that page, then the field's value
will mistakenly not get automatically piped when the page initially loads. (Ticket#24994)

Version 7.4.7 - (released 7/27/2017)
BUG FIXES & OTHER CHANGES:•

Minor security fix: The Bootstrap framework was upgraded to the latest version (3.3.7)
due to a minor vulnerability in the framework.

•

Bug fix: When using the Survey Auto-Continue feature for a set of surveys that exist on
a Repeating Event in a longitudinal project, if a participant completes a survey, it would
always mistakenly send them to the next survey in the first instance of the Repeating
Event instead of sending them to that survey in the current instance of the Repeating
Event. So their responses for the following surveys would not get stored in the correct
instance of the Repeating Event.

•Bug fix: In some cases where date values might have trailing spaces (e.g., "2017-12-31"), it would mistakenly cause the datediff() function to not always work correctly incalculated fields and in Automated Survey Invitation conditions, among other places
where datediff() can be utilized. (Ticket #24243)•

Bug fix: If a user loads a survey page or data entry form, in which a required fieldalready has a value at the time the page is opened, then if the value is removed andthe page is saved, it would mistakenly give the required field prompt saying that therequired field was left blank, which is incorrect.

•

Bug fix: When repeating instruments have been enabled in a project, and someinstances of a repeating instrument have been deleted for a given record, then whenviewing the record on the Record Status Dashboard, the form status icon displayed in
the table for the repeating instrument might be an incorrect color (e.g., blue stack icon
instead of green stack icon). (Ticket #23370)•

Bug fix: When copying a project, in which the reports are copied but users/roles are notcopied, if a report had custom user access set, then that same report in the new projectwould end up in a limbo state where it appears that all users can access it but
mistakenly no one can access it (except users with Edit Reports privileges via the "My
Reports & Exports" page). (Ticket #23918)•

Bug fix: When viewing the Data History popup for a field when viewing a record on adata entry form, if the record had been deleted in the past but later another record wascreated with the same record name, then it would mistakenly also display the logging
for the deleted record in the Data History popup. (Ticket #24444).

•

Bug fix: When using the datepicker/datetimepicker widget for setting the value of a text
field, if the field has a min or max range validation set, then it would prevent the userfrom selecting a new month or year in the datepicker if the existing value in the field iscurrently out of range. This made it extremely difficult to use the datepicker well if range
validation is used on the field. (Ticket #24049).

•

Bug fix: When clicking the Compare button for a multiple choice field on the Draft Mode
field comparison page, if a multiple choice option has a comma in its label, then the
resulting popup comparing the choices would mistakenly truncate the choice label atthe comma. (Ticket #24566).

Version 7.4.6 - (released 7/18/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: In very specific scenarios, deleting a record in a project might
mistakenly delete a scheduled survey invitation for a record with the same name inanother unrelated project. This would result in random survey participants not receiving
their invitations. This issue occurs very seldom. (It was thought that the major bug fix
listed in REDCap 7.4.5's release notes was responsible for this, but it was found not tobe.)•

Bug fix: When entering the equation for a calc field in the Edit Field popup in the Online
Designer, if the project is in Draft Mode while in production, then any fields referenced
in the calculation that exist only in Draft Mode will cause the logic checker to mistakenly
say "Error in syntax" right below the equation in the popup. (Ticket #23886)

•Bug fix: If viewing a survey that has "enhanced radio buttons and checkboxes"
enabled, it would display a checkbox with Left/Horizontal alignment on the survey
mistakenly as a single column of buttons rather than as two columns. Horizontallyaligned radios/checkboxes should always display as two columns of buttons, except on
small mobile devices.

Version 7.4.5 - (released 7/12/2017)
BUG FIXES & OTHER CHANGES:•

Medium security fix: A cross-site scripting vulnerability was found that could be
exploited by a malicious user by manipulating the query string of an HTTP request or
REDCap link.

•

Medium security fix: A cross-site scripting vulnerability was found that could be
exploited by a malicious user by manipulating text strings input into conversation titles
or messages in REDCap Messenger.

•

Major bug fix: On certain occasions, the cron job that schedules Automated Survey
Invitations containing conditional logic using datediff() with "today" as a parameter
might mistakenly remove survey invitations that have been scheduled for anotherproject. This would result in random survey participants not receiving their invitations.
This issue occurs very seldom.

•

Minor security fix: A couple functions (e.g., deleting files in the File Repository or on
File Upload fields) were mistakenly not being protected from Cross-site Request
Forgery (CSRF) attacks by potential malicious users.

•

Bug fix: When clicking the "Tell me more" link inside the Survey Login popup in theOnline Designer, it would mistakenly display the hidden instructional text.

•

Bug fix: When using the Data Dictionary Upload page to import a field that has a certain
type of invalid branching logic, then it can mistakenly throw a fatal PHP error andprevent the file from successfully uploading rather than gracefully catching the error.
(Ticket #23658)

•Bug fix: When exporting the REDCap XML file (containing metadata and data) on the
Other Export Options page, that option's download icon's "title" attribute would
mistakenly say "Download PDF with all data", which is incorrect. (Ticket #23674)•

Bug fix: The Data Dictionary upload process would mistakenly not catch the error
where a min or max validation range is provided without a value for the field validation
type. (Ticket #23440)•

Bug fix: When "enhanced radio buttons and checkboxes" are enabled on a survey,
radio or checkbox fields that have vertical alignment were mistakenly not displaying
their choices as one choice per line, which is what vertical alignment dictates, butinstead they were displaying as two choices per line - except on mobile devices inwhich it always displays one choice per line. (Ticket #23748)•

Bug fix: When adding a custom Data Quality rule for a project in production, it might
mistakenly return an error saying that the fields in the rule logic do not exist as real
fields in the project. (Ticket #23515)•

Bug fix: For longitudinal projects with multiple arms in which the project has the Custom
Record Label or Secondary Unique Field enabled, if a user views a calendar event thatis attached to a record (either as an ad hoc calendar event or generated via theScheduling module), then when viewing the calendar event in the popup, it would
mistakenly only display the Custom Record Label or Secondary Unique Field forrecords in the first arm. For records existing only in other arms, the value would
mistakenly be blank. (Ticket #23367)•

Bug fix: When repeating instruments have been enabled in a project, and someinstances of a repeating instrument have been deleted for a given record, then whenviewing the record on the Record Home Page, the form status icon displayed in thetable for the repeating instrument might be an incorrect color (e.g., red stack icon
instead of green stack icon). (Ticket #23370)

Version 7.4.4 - (released 6/29/2017)
BUG FIXES & OTHER CHANGES:•

New LTS branch based on REDCap 7.4.3 (Standard) + the bug fixes listed below.

•Medium security fix: A cross-site scripting vulnerability was found that could be
exploited by a malicious user or survey respondent uploading a specially designed filefor a File Upload field (or manipulate the HTTP request during the upload process) on asurvey page or data entry form.

•

Bug fix: When clicking the "Add new" button on the Record Home Page to add a newrepeating event for a record, if the event/form table is large enough on the page, thetable may mistakenly disappear on certain occasions after clicking the button. (Ticket#23165)•

Bug fix: If a logged-in user knows how to manipulate a specific HTTP request to the
REDCap server, they might be able to learn the project title of any given project.

•

Bug fix: For longitudinal projects with multiple arms that utilize repeating instruments, if
a record exists on more than one arm, the Record Home Page would mistakenly
display the repeating instruments tables from other arms for that record.

Version 7.0.20 - (released 6/22/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: When viewing a survey or data entry form on a tablet, in which an inline image
attachment is displayed in a Descriptive field on the page, it would mistakenly display
the image at a smaller size than expected if the image is larger than 250 pixels wide.

•

Bug fix: When typing a calc equation, branching logic, report filer, etc. into a text box
where it provides variable auto-suggestions, depending on the REDCap server
configuration, it might mistakenly not display suggestions for fields but instead display
an error message.

•

Bug fix: When a project is in production but not in Draft Mode, it would mistakenly
display the "REDCap Shared Library" button and "Check For Identifiers" link on the
Project Setup page. (Ticket #22605)•

Bug fix: When exporting and re-importing a project XML file of metadata to create a
new project, if any multiple choice fields have option labels that contain HTML tags,
then all options for that field that do not contain HTML in their label would mistakenly
get lost and would not appear in the newly created project. (Ticket #22610)•

Bug fix: When entering branching logic in the "Add/Edit Branching Logic" popup on theOnline Designer, if the project is in production and in Draft Mode, then it would
mistakenly report "Error in syntax" if the logic contains a variable name that is on a newinstrument that exists in Draft Mode but not in the production version of the project.
(Ticket #22604)•

Bug fix: When using the drag-n-drop option in the "Add/Edit Branching Logic", theoperator drop-down was missing "<>" as an option. (Ticket #22596)•

Bug fix: When clicking the "reset" link for a radio button field on a data entry form or
survey page, if fields immediately below to become visible due to branching logic after
the link is clicked, then in certain cases the value of the radio button field would
mistakenly not get reset.

Version 7.0.19 - (released 6/13/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: The Repeating Instrument tables would mistakenly not be displayednear the bottom of the Record Home Page. (Ticket #21721)•

Bug fix: When clicking the "fetch" link for a user on the User Access Dashboard, inwhich the user has never accessed that particular project, the spinning icon would
mistakenly continue to spin forever instead of displaying "never".

•Bug fix: When a participant is using the Survey Login feature to log in to a survey, it
would mistakenly not display the survey instructions on the first survey page unless the"Save & Return Later" option had been enabled for the survey. It now always displays
the instructions on the first page regardless. (Ticket #21646)•

Bug fix: When clicking the "fetch" link for a user on the User Access Dashboard, inwhich the user's username has an "@" sign in it (e.g., their username is their email
address), the spinning icon would mistakenly continue to spin forever instead ofdisplaying the timestamp or "never".

•Bug fix: When executing a rule on the Data Quality module, if the discrepancy results
return fields whose field label text is not saved correctly (mangled encoding that results
in a black diamond character), then the popup containing the discrepancies will
mistakenly not open when the user clicks the "view" link for that rule.

•

Bug fix: If a survey participant has clicked the button to change the survey font size at
the top of the survey, and then they view a survey page where a drop-down field or text
field is initially hidden by branching logic but is revealed later via branching logic on that
page, the previously hidden field will mistakenly be very thin and almost invisible.

•

Bug fix: If the Scheduling module is enabled in a project, it would mistakenly allow auser that does not have "Create Record" user privileges to create a new record if theyclick the "Generate Schedule" button without having selected a record from the "choose
existing unscheduled" drop-down list. (Ticket #10111)•

Bug fix: When a participant is taking a PROMIS/Neuro-QoL survey (adaptive or autoscoring only) for the first time ever for the REDCap server, it might mistakenly fail toauto-retrieve the PROMIS API keys if the REDCap server's institution name or grantfunding text on the General Configuration page contains HTML tags. This would
prevent the PROMIS service from functioning at all.

•Bug fix: When sorting projects in the My Projects list by clicking the Records or Fields
header in the table, it would mistakenly not sort them correctly if the number contained
a comma. (Ticket #21778)•

Bug fix: When executing Data Quality rule F in a project that has checkbox fields on
Repeating Instruments, it might mistakenly display false positives as discrepancies for
those checkbox fields. (Ticket #13555)•

Bug fix: If the survey confirmation email is enabled or if survey notifications are enabled
for a given survey that is enabled as a repeating survey, it would mistakenly not send
the emails if the survey has the "Before survey is completed" option set for the locationof the repeating button on the survey page. (Ticket #22276)•

Bug fix: The Repeating Instrument tables displayed at the bottom of the Record Home
Page for a project with Repeating Instruments might mistakenly display the tables inincorrect order.

•

Bug fix: If a file is uploaded to a File Upload field on a data entry form or survey for an
existing record, and then the link is clicked to download the file, it would only display"ERROR!", which is non-descriptive and confusing, whereas now it gives a more fullerror message stating that the form/survey must first be saved before the file can be
downloaded. Also, if a file is uploaded and then deleted via the "Remove file" link, it
would mistakenly display "ERROR!" in that field with no option to re-upload a field.
Additionally, to be consistent with all this behavior, users will no longer be able to send
the file via the Send-It button below it until the data entry form has first been saved andreloaded. (Ticket #22022)•

Bug fix: The drop-down list of records on the "Add/Edit Records" page would
mistakenly display HTML tags if the Custom Record Label or Secondary Unique Fieldlabel contained HTML tags. (Ticket #22351)•

Bug fix: When importing data for checkbox fields via the Data Import Tool or API, in
which the checkbox exists on a Repeating Instrument, it would mistakenly display anerror saying that the value cannot be imported. (Ticket #22387)

Version 7.0.18 - (released 5/29/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: If the REDCap web server is running PHP 7.1, numeric survey access codes
for Twilio telephony services could never be created and could cause some processes
to go into infinite loops until the PHP script crashed. (Ticket #21169)•

Bug fix: When using Twilio telephony services and sending an SMS survey invitation
for participants listed in the Participant List for the first instrument, it would mistakenly
keep asking the participant for their survey access code via SMS after they initiallyreplied back via SMS, thus preventing them from starting the survey. (Ticket #20303)•

Bug fix: If the 'records' parameter in the API "Delete Records" method is passed as astring instead of an array, it would mistakenly return a "1" for success, even though it
did not delete any records. (Ticket #21424)•

Bug fix: When the cron job is running for the Publication Matching module, it might
mistakenly throw a fatal PHP error and halt the cron job mid-way through completing incertain situations. (Ticket #21347)•

Bug fix: If a field used in the Survey Login has another field's value being piped into its
field label, then the Survey Login screen would mistakenly not perform the piping.
(Ticket #19610)•

Bug fix: When one of the "Number...comma as decimal" field validation types is used
for a field that also has a field min/max range validation set, then when importing data
into the field via Data Import Tool, it would display erroneous error messages sayingthat the value is out of range. (Ticket #20959)•

Bug fix: When using the designated survey email field on a survey, if a value is entered
for the field, then the field would mistakenly be disabled on the survey page. It should
only be disabling the field on the survey if the user entered the email address into theParticipant List and if the user has also enabled the designated email field, which exists
on that survey. This is done to prevent the email address in the Participant List and theemail from the designated email field from getting out of sync. But it should not bedisabling the field if the email value does not come from the Participant List. (Ticket#21504)

Version 7.0.17 - (released 5/24/2017)•Bug fix: When calculated fields utilize date/datetime fields in certain ways, such as
inside the condition of if() functions or comparing the date/datetime value to "" or"NaN", it can return an incorrect value on data entry forms (via JavaScript) or during adata import or Data Quality rule H (via PHP). (Ticket #21030)•

Bug fix: Reports that use advanced logic containing datediff functions strung together
with ORs (e.g., datediff(...)>6 or datediff(...)<40 ) would not return any matchingrecords/events for the datediffs that contained one or both date parameters having
blank/null values. This appears to only affect reports.

•

Bug fix: If a survey instrument has fields from it being displayed in a report that is set toshow the survey identifier and survey timestamp fields, in which that survey instrument
is set to be a repeating instrument or is on a repeating event, then the survey identifier
and timestamp fields would mistakenly only ever display a blank value instead of thereal value in the report.

•

Bug fix: In a project with Double Data Entry enabled, if a user is DDE user #1 or #2 andenters a page where DDE users are not allowed (e.g., Data Import Tool) and is thus
presented with a yellow error message stating that the page is disabled, it would
mistakenly make the links on the project's left-hand menu into dead links or will point to
the wrong URL.

•

Bug fix: Data Quality rule G would mistakenly return discrepancies for checkboxes thatexist on an instrument set as a Repeating Instrument. (Ticket #19259)•

Bug fix: On the Record Home Page of a project that has repeating instruments, it would
mistakenly display the table listing all instances saved for a repeating instrument even if
the user does not have Data Entry user privileges to that particular instrument. It now
no longer displays the table. (Ticket #20554)•

Bug fix: SQL fields were mistakenly not displaying on the "Stats & Charts" page. (Ticket#20195)•

Bug fix: If HTML tags are used in the Custom Record Label, then those tags will
mistakenly be displayed at the top right corner of an exported PDF containing record
data. It now strips out any HTML tags in the PDF for the Custom Record Label. (Ticket#21229)•Bug fix: If creating a project using a Project XML file that contains a data collection
instrument with no fields other than the Form Status field, that instrument would
mistakenly not get created in the new project, and if longitudinal, will throw an error andprevent the project from even being created.

•Bug fix: When renaming a Data Access Group on the DAG page, if the DAG namecontains non-Latin characters, it would mistakenly not saved the DAG name correctly.
(Ticket #20958)•

Bug fix: The "Order by another field" customization on the Project Setup page's"Additional customizations" popup was no longer working on the drop-down list ofrecords on the Record Home Page. Bug emerged in version 7.0.0. (Ticket #15091)•

Bug fix: If a field utilizes the @DEFAULT action tag on a survey or data entry form, andthat field's is also piped somewhere on that page, then the field's value will mistakenly
not get automatically piped when the page initially loads. (Ticket #21288)•

Bug fix: Values for the fields "redcap_repeat_instrument" and"redcap_repeat_instance" would not get fully validated during a data import, thus
causing the data to get mistakenly imported into non-repeating events/instruments andorphaning some of the data after the import completed. (Ticket #21100, #20028)

Version 7.0.16 - (released 5/17/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: Specific usages of the "if" function in calc fields would cause opposite
results for auto-calcs and for Data Quality rule H. This includes the usages below.
(Ticket #17479, #18945, #17882)•

oif ([field] = "NaN", ... , ...)oif ([field] <> "NaN", ..., ...)oif ([field] = "", ..., ...)oif ([field] <> "", ..., ...)

Bug fix: At the top of the data entry form when viewing a survey response, it would
incorrectly list an API user as a contributor to that response when the API user has
imported data values for *any* field for that record, not just fields on that particularsurvey instrument. It now only lists contributors who have modified values on that
instrument. (Ticket #20452)•

Bug fix: When executing Rule C "Field validation errors (incorrect data type)" in the
Data Quality module, it would mistakenly return false positives in the discrepancy list
when there exist no fields in the project having field validation and also when there areno slider fields or calc fields.

•Bug fix: When sending multiple attachments in an email sent from a hook or plugin
using the Message class in REDCap, it would mistakenly attach extra empty text files
to the email for some email providers.

•Bug fix: The auto-generated unique event name for events in a longitudinal projectmight mistakenly begin or end with an underscore, which might cause erroneous errors
when using a unique event name in report filter logic or in other similar logic. (Ticket#20301)•

Bug fix: The API Playground mistakenly displays a drop-down of events for the Delete
Record method when it should instead display a drop-down of arms. (Ticket #20599)•

Bug fix: The data search on the Add/Edit Records page will mistakenly never return any
results when searching over "All fields" when the REDCap web server is running PHP
7. (Ticket #20111)•

Bug fix: When renaming a record on the Record Home Page, it would mistakenly allow
users to enter illegal characters in the record name, such as ampersands, apostrophes,plus signs, and pound signs. (Ticket #19719)

Version 7.0.15 - (released 4/28/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: If a survey has "Enhanced Radios and Checkboxes" enabled, and a radio orcheckbox is selected by a participant on the survey page and then the field gets hidden
by branching logic, then if the field later becomes visible again due to branching logic, itwould mistakenly still seem to be selected even though it is not really selected. (Ticket#19034)•

Bug fix: If using the Online Designer's "Copy" button to copy an instrument containing amatrix of fields, it would mistakenly not append the specified suffix (e.g., "_v2") to thematrix group name but would instead append a random string of alpha-numericcharacters. (Ticket #19333)•

Bug fix: If deleting an event of data on a record's Record Home Page, it would
mistakenly not delete all the event data if the event contained one or more repeating
instruments that had some data saved on non-first instances of the instrument. (Ticket#17694)•

Bug fix: If a user is locking all forms across all events on the Record Home Page for arecord that has repeating events of data in a project with Repeating Events enabled, itwould mistakenly not lock any empty forms (i.e., having a gray status icon) that exist on

a repeating event, excluding the first repeating instance. Additionally, empty forms on
repeating events (excluding the first repeating instance) were showing up as locked on
the Record Home Page (i.e., having lock icon) even though they were not really locked.
(Ticket #17615)•

Bug fix: When using the Scheduling module in a longitudinal project that contains
repeating instruments, in certain cases a record might mistakenly not be displayed inthe "choose existing unscheduled" drop-down on the Scheduling page, thus preventing
the user from scheduling certain records. (Ticket #17272)•

Bug fix: When enabling the Survey Login feature in a multi-arm longitudinal project, if arecord does not exist in an arm whose fields/events are specified as the login fields,
then the survey login page would mistakenly display an error saying that the login form
could not be displayed (and thus provide no way to log in to the survey). In this
scenario, it should instead bypass the survey login form and display the survey pagesince the record exists in another arm as the specified login fields, thus the record
should not be subject to it. (Ticket #18430)•

Bug fix: When using the Survey Queue and selecting the option to display the survey inthe queue "when the following survey is completed", it was only checking to see if that
instrument was completed as a survey. It should have also been checking if the
instrument had been set to a Form Status of "Complete" on a data entry form, which is
how Automated Survey Invitations have always behaved for this same setting. Thiswas causing some surveys to show up as not having been completed in theparticipant's survey queue. (Ticket #15640)•

Bug fix: When using the Survey Queue and referencing a value from a repeating
instrument inside the conditional logic for the survey queue item, it might mistakenly notdisplay the survey in the queue or might show it as not having been completed when it
was completed as a data entry form. (Ticket #15640)•

Bug fix: When importing data via the Data Import Tool, if any error messages contain acomma in the text, it would mistakenly truncate the error message at the comma whendisplaying it on the page for the user.

Version 7.0.14 - (released 4/21/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: When renaming a record on the Record Home Page, it would mistakenly nottrim off any spaces accidentally added to the beginning or end of the new record name,thus leaving the record in a limbo state where it is not accessible in data entry forms
and could not be deleted.
•

Bug fix: If a text field that lacks integer or number validation has a trailing space in its
value and is then used in the equation of a calculated field, the resulting calculation as
seen on data entry forms and survey pages might mistakenly be incorrect, whereas
data imports and Data Quality rule H would perform the calculation correctly. (Ticket#19037)•

Bug fix: In certain versions of Internet Explorer, the "Cancel" button would not work
correctly and would mistakenly submit the form on the following pages: Copy Project
page and Create/Edit Survey page. (Ticket #18996)•

Bug fix: When exporting data to a stats package (e.g., SPSS, SAS, R, Stata) for a
project that contains repeating events or repeating instruments, if the report being
exported does not include any fields from a repeating event or repeating instrument,
then the fields listed in the stats package's syntax file might not line up with the fields
contained in the resulting CSV data file, thus making it impossible to load the data into
the stats package. (Ticket #18996)•

Bug fix: When the Data Resolution Workflow module is enabled, and a user attempts to
respond to an open query by uploading a file, the file would mistakenly fail to upload.

•

Bug fix: When the Data Resolution Workflow module is enabled, and a user enters avalue for a field that has an open query, which causes the "Save and then open Data
Resolution Pop-up" button to appear, if the button is clicked on a repeating instrument
or on a repeating event, then it would mistakenly redirect the user back to the first
instance of the data entry form (rather than the current instance) after successfullysaving the form's data.

Version 7.0.13 - (released 4/13/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: In a longitudinal project with repeating events enabled, if a user adds data forseveral repeating events, in which one of the instruments on a repeating event has agray status icon, then the corresponding icon(s) for that instrument/event for that record
would not display correctly on the Record Status Dashboard, such as displaying a graystatus icon when it should display a red stack status icon. (Ticket #18073)•

Bug fix: When viewing the popup for the Data Resolution Workflow on a repeating
instrument, the table rows that show the data value changes for the field in the popup

would mistakenly always show the first instance's data, not the current instance of therepeating instrument. (Ticket #18873)

Version 7.0.12 - (released 4/6/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: If an apostrophe exists in the name of a User Role, then the role could not beedited when clicked on the User Rights page. It would instead mistakenly throw a
JavaScript error.

•

Bug fix: When exporting a PDF of a data entry form with data, in which the form isenabled as a repeating instrument, if a checkbox field on the instrument has branching
logic, it might mistakenly not display the checkbox in the PDF when it should be
displayed. (Ticket #17621)•

Bug fix: When deleting an event of data for a repeating event on the Record Home
Page in a longitudinal project, it would remove the event instance from the Record
Home Page, but the event instance would mistakenly still appear in reports and data
exports. (Ticket #17859)•

Bug fix: The bug fix in REDCap 7.0.10 LTS that dealt with the usage of "" and "NaN" incalc fields mistakenly did not get incorporated into the Data Quality rule H and autocalc implementation of calculated fields (via PHP), but it only got incorporated into the
JavaScript-fired calculations on data entry forms, thus causing erroneous results toappear when executing Data Quality rule H for very specific cases where >"" or =""were used in a calculation. (Ticket #17882)•

Bug fix: When enabling Twilio telephony services in a project and ensuring that theRequest Inspector has been disabled for that Twilio account, it would mistakenly failand never allow the user to enable Twilio services for that project. This was due to a
recent change in Twilio's API methods. (Ticket #18040)•

Bug fix: When data quality rules have very long logic, they can take up an inordinate
amount of the page, making it very difficult to view or execute several at once. (Ticket#17548)•

Bug fix: When moving a project to production and opting to delete all data, it mistakenly
says that it will also delete all data dictionary snapshots, which is not correct. All data
dictionary snapshots will be preserved. The text will be corrected. (Ticket #17785)

•

Bug fix: "MySQL over SSL" is now fully supported. In previous versions, it would fail toconnect in certain instances, such as if using a self-signed SSL certificate or if using
Table-based authentication.

•

Bug fix: When saving data in a hook or plugin using the REDCap::saveData method, if
the event name field is not included when saving data for a longitudinal project, then it
would appear to save the data to the first event of the record, but the record would notshow up in any record lists if the record did not exist beforehand. (Ticket #17881)•

Bug fix: HTML tags were mistakenly not being interpreted but were being displayed asis for the institution name and organization name in project, as well as any custom text
displayed at the top of the project home page, the top of data entry forms, and the topof Record Home page (Ticket #17912)•

Bug fix: When executing a custom Data Quality rule containing fields in a project thathas repeating events/instruments enabled, in which the fields utilized in the rule's logic
are not located on a repeating event/instrument, it might mistakenly return duplicate
discrepancies in the results.

•

Bug fix: When using the "Copy" instrument action on the Online Designer, if the first
field in the instrument has a section header above it, that section header would
mistakenly not get copied into the new instrument.

•

Bug fix: When a longitudinal project has long event names that have non-Latincharacters in their name, it may mistakenly throw an error when attempting to create a
new project using the project's XML metadata file. (Ticket #17055)•

Bug fix: When a project with surveys has already sent out survey invitations (excluding
public survey links) to participants, and then records were later deleted via the "Erase
All Data" option or by deleting all records when moving the project to production, therecords' survey links would mistakenly still be active and could be used by theparticipant (even though the record no longer exists in the project), which would create
a new record. (Ticket #17457)•

Bug fix: When a user is requesting that an administrator move their project toproduction, the confirmation popup that the user sees mistakenly displays a blankspace inside parentheses when it should be displaying the user's email address there.
(Ticket #18197)

•Bug fix: When a user downloads an Instrument Zip file for an instrument on the Online
Designer, certain server configurations would result with an error and not export the zip
file successfully due to GZIP HTTP compression being enabled by mistake for thatparticular process. (Ticket #18094)•

Bug fix: When exporting a PDF of an instrument with data, in which data is being piped
into text on that instrument and the data contains line breaks/carriage returns, it might
mistakenly display a rectangular symbol in the PDF at the beginning of each line of thepiped data. (Ticket #17947)•

Bug fix: On the Logging page in a project, if a user has set the time range filters at thetop, and then changes the "Displaying events (by most recent)" option, it would
mistakenly reset the time range filters back to blank values. (Ticket #18057)•

Bug fix: When changing the time of a scheduled survey invitation on the Survey
Invitation Log, it would mistakenly not always update the new date/time with theupdated time submitted. (Ticket #17791)•

Bug fix: In a longitudinal project that contains multiple arms, survey participants fromanother arm might mistakenly be displayed when viewing a survey/event's Participant
List that belongs to a different arm. It will now no longer display participants from otherarms. (Ticket #18354)•

Bug fix: When adding a matrix of fields via the Online Designer for an instrument that
does not yet have any fields, if the project is in production in Draft Mode, then the new
matrix might mistakenly not display at all on the Online Designer or the data entry form
until either a new field is added to the instrument or until a data dictionary is uploaded.
(Ticket #16871)•

Bug fix: When the Project Notes text is very long for a given project, the text cansometimes render outside its black box when displayed on the My Projects page.
(Ticket #17414)•

Bug fix: When importing data via Data Import Tool or API for a project that has Data
Access Groups, in which the data being imported contains the fieldredcap_data_access_group, it might mistakenly throw an error stating that the unique
DAG name is not valid when it actually is. (Ticket #18087)

•Bug fix: For certain server configurations, in a longitudinal project with repeating events
enabled, it might mistakenly think that some of a record's repeating events haverepeating instruments within them (showing a stacked status icon inside a repeating
event column), which is not possible. (Ticket #17596)•

Post-release fix: For REDCap web servers running PHP 5.3, some components of the
Repeating Instruments/Events do not work correctly in longitudinal projects. In the
setup of repeating instruments/events on the Project Setup page, it would mistakenly
display the letter "W" inside the custom label text box if a longitudinal event has been
selected as a repeating event. Also, the Record Home Page for a given record would
mistakenly display the stack status icon for instruments in a repeating event, which isvery confusing, when it should only ever display that icon for a repeating instrument.
These issues only arise for longitudinal projects and only when running PHP 5.3.

Version 7.0.11 - (released 3/17/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: Removed all instances of the PHP function set_magic_quotes_runtime() and
get_magic_quotes_runtime() because they are deprecated in PHP 7.0 and later.
(Ticket #16893)•

Bug fix: The API Playground might mistakenly allow the user to make rapid sequentiallyrequests to the server by holding down the up/down arrow on the multi-select fields on
the page. Also, for the Import Records method on the API Playground, the "Update"link has been removed, in which the "data" parameter is now updated when the user
leaves the Data field instead, because users were not aware that the "Update" link had
to be clicked at all, which caused lots of confusion.

•

Bug fix: When exporting data in CDISC ODM (XML) format on the "Data Exports,
Reports, and Stats" page, if any "File Upload" fields are included in the data set but
they do not have a file uploaded for them, then it would mistakenly output an empty filein the XML file and would cause issues when importing the XML file to a REDCap
project.

•

Bug fix: When a project is in Draft Mode while in production, and the first instrument isa survey, and then via the Online Designer the user moves another non-survey
instrument into the first form position, it would mistakenly cause all the survey

timestamps from the original first instrument to be associated with the instrument thatwas moved (this will occur only after the drafted changes are approved).
•

Bug fix: When piping data from a text field that has the biomedical ontology autosuggest enabled, it would mistakenly pipe in the raw value instead of the label. (Ticket#12705)•

Bug fix: Cross-form branching logic does not always work successfully on a repeating
event. (Ticket #16372)•

Bug fix: A fatal PHP error might occur when uploading files on some REDCap web
server configurations that do not have the PHP function mime_content_type(). It iscurrently not know why this function would be missing for some configurations.

•Bug fix: The "Export Records" API method would mistakenly not export the
redcap_repeat_instrument and redcap_repeat_instance fields when exporting datafrom a repeating instrument or repeating event in EAV format.

•

Bug fix: When creating a new REDCap project from a Project XML metadata file, inwhich the project is not longitudinal but contains repeating instruments, it might notenable the repeating instruments in the newly created project.

•

Bug fix: When clicking the "Move" icon for a field in the Online Designer, if some fields
in the project have very long Field Labels, then it might cause display issues for thedrop-down list of field inside the popup that is displayed because the drop-down is too
wide.

•

Bug fix: The "Repeatable instruments and events" video on the Training Videos page
mistakenly displays the wrong video title inside the popup when viewing the video.
(Ticket #16502)

Version 7.0.10 - (released 3/10/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: The use of [field]="" inside the condition of an IF statement for a calculated field
does not behave as users would expect, and this often requires users to use[field]="NaN" as an alternative for checking if a field's value is blank/null. Now [field]=""will work as one would expect and will work identically to [field]="NaN".
•

Bug fix: Drop-down fields with autocomplete enabled will mistakenly display little arrows
in front of the choice labels in Google Chrome only. (Ticket #15862)•

Bug fix: After being on any page for more than 3 minutes, it would disable certain
jQuery-enabled triggers, such as auto-complete drop-down fields on data entry forms
and any custom Bootstrap components. (Ticket #15989, #14863)•

Bug fix: When upgrading REDCap, if the new REDCap version directory has been
uploaded to the web server but the upgrade has not been completed yet, then the
REDCap cron job would mistakenly not run until the upgrade has completed. It will now
always run when it is supposed to, even in the midst of an upgrade. (Ticket #15991)•

Bug fix: If running PHP 7.1 or higher on the REDCap web server, the Data Resolution
Workflow popup would mistakenly fail to open when a user tries to open it. (Ticket#16040)•Bug fix: If doing a user search using "all user attributes" on the Browser Users page in
the Control Center, it would mistakenly always return every user in the system. (Ticket#16026)•

Bug fix: The "email" field validation would mistakenly not accept email addresses
containing accent marks and other valid UTF-8 characters. (Ticket #15874)•

Bug fix: When downloading PDFs containing record data, it would sometimes
mistakenly display duplicate pages for an instrument for longitudinal projects only.
(Ticket #12797, #14945)•

Bug fix: When viewing the Survey Invitation Log, for certain situations, some invitations
might mistakenly not be displayed on the page.

•Bug fix: When editing an existing report that uses advanced logic in Step 3, if a user
clicks the "Switch format: Use simple logic" link, the drop-down list of fields in that
section would mistakenly not be displayed, thus making it impossible set set a filter
unless the user reloads the page.

•

Bug fix: When setting up an Automated Survey Invitation and using conditional logic, if
a record is selected in the "test logic with a record" option *and* the project is inproduction, then it might mistakenly return "[No value]" rather than True or False
regarding whether the condition is true/false for a given record.

•

Bug fix: The field name auto-suggest feature for branching logic, calculations, ASIs,
etc., would mistakenly suggest checkboxes in the wrong format (i.e., withoutparentheses with a value inside them). It now suggests checkboxes in the correct
syntax. (Ticket #15510)•

Bug fix: On the Randomization page in a project, the drop-down lists of fields might be
too wide for the page. (Ticket #16559)•

Bug fix: When clicking the "Show Stats Only" button on the "Stats & Charts" page, it
might mistakenly still show the "Download Image" button if all the field plots have notfully loaded yet on the page. (Ticket #6534)

Version 7.0.9 - (released 2/23/2017)
BUG FIXES & OTHER CHANGES:•

Minor security fixes: Cross-site scripting vulnerabilities and SQL injection vulnerabilities
were found on several different pages, in which the vulnerabilities could possibly be
exploited by a malicious user.

•

Bug fix: A few PHP files contained ¥r (CR) characters without ¥n (LF) characters
immediately following them, which caused issues when uploading the REDCap sourcecode to certain web servers.

•

Bug fix: When using Send-It to send a file from a data export, a File Repository file, orfrom a File Upload field, it would result in an error when the user would click the "Send
It!" button. (Ticket #12747)•

Bug fix: When clicking the "Lock all instruments across all events" option on the Record
Home Page, it would mistakenly only lock instruments for events that contain data. This
mistakenly changed in a previous version and is now set back to the way it was
originally where it would lock all forms across all designated events regardless ofwhether there is data in the form or in the event.

•Bug fix: If running PHP 7.1 or higher on the REDCap web server, any API importmethod with content in XML format would fail. (Ticket #15764)•

Bug fix: When doing a CSV Raw data export while exporting the survey fields, theheader text for "Survey Timestamp" would mistakenly be blank. (Ticket #14316)•

Bug fix: If running PHP 7.1 or higher on the REDCap web server, any Data Quality rulewould fail when executed. (Ticket #15582)•

Bug fix: The font resize option at the top of surveys mistakenly does notincrease/decrease all text uniformly on the page. (Ticket #15749)•

Bug fix: If running PHP 7.1 or higher on the REDCap web server, the biomedical
ontology auto-suggest feature for Text fields would always return nothing from thesearch.

•Bug fix: When creating or editing a report and adding a new field in Step 2, if the user
hits the Enter key while in the text field when the text field is empty, it would mistakenly
display the "List of users with access" popup.

Version 7.0.8 - (released 2/16/2017)
BUG FIXES & OTHER CHANGES:•

Major bug fix: If a user's Data Export permissions are "De-Identified" or "Remove all
tagged Identifier fields" when they are using the Export Records API method, in which
they specify a list of fields (or forms) by variable name (or form name) in their API
request, then if every one of those specified fields are also fields that would normally
get removed due to their export privileges, then it would mistakenly return data for all
the fields in the project. (Ticket #15003)•

Medium security fix: A malicious user or survey respondent could uploaded a
specially designed file for a File Upload field on a survey or data entry form, and thenexploit it by getting a REDCap Administrator to then navigate to a specially crafted link,
which might allow them to escalate certain Administrator privileges and take advantageof them, even capturing their login information.

•

Minor security fixes: Several cross-site scripting vulnerabilities were found on various
pages, such as the User Rights and Project Setup pages, in which the vulnerability
could possibly be exploited by a malicious user.

•

Bug fix: Enhanced radio buttons on surveys were not vertically aligned correctly but
mistakenly had extra padding above them. (Ticket #14996)•

Bug fix: When viewing a data entry form of a repeating instrument that is also enabled
as a survey, the survey options drop-down at the top of the form will mistakenly bedisabled if the instance number is greater than "1" and the form has not the form saved
yet. (Ticket #14629)•

Bug fix: When viewing a data entry form of a repeating instrument that is also enabled
as a survey, and the user chooses to compose a survey invitation using the survey
options drop-down at the top of the form, it would mistakenly always send the survey
link pointing to the first instance of the survey rather than to the correct instancenumber. (Ticket #14629)•

Bug fix: When a repeating instrument is also enabled as a survey with the repeat
survey button option set to be "Before the submit button in the survey", if any required
fields on the survey were left blank and the repeat survey button was clicked, it would
mistakenly not prompt the respondent to enter the required fields that were left blankand would mark the survey as completed. (Ticket #14092)•

Bug fix: When using the Twilio telephony services for surveys, in certain cases it would
not always erase the logs on the Twilio website of SMS messages sent via REDCap. It
now does a much more comprehensive job of deleting SMS messages than before.
(Ticket #11167, #13676)•

Bug fix: The "E-Signature and Locking Management" page would mistakenly display
instruments that have locking capabilities disabled as set on the "Record Locking
Customization" page. (Ticket #15020)•

Bug fix: The drop-down Topic list on the "Help & FAQ" page was not scrollable, which
made it impossible to view the bottom items of the list if your browser window was notvery tall.

•

Bug fix: When executing a user-defined Data Quality rule in a longitudinal project, it
might mistakenly return duplicate results for any discrepancy found.

•Bug fix: If a user has been given "De-Identified" data export privileges in a project that
contains surveys, then when exporting data from the "Data Exports, Reports, andStats" page, it should automatically pre-select the checkbox to force date-shifting thesurvey completion timestamp fields because survey timestamps can be consideredidentifiers (PHI) in many cases. (Ticket #15145)•

Bug fix: When the Dynamic Data Pull (DDP) module is enabled in a project, it might
mistakenly display duplicate values for a field inside the DDP adjudication popup. This
usually occurs when a single source field is mapped to many different REDCap fields inthe project. Additionally, if a user chooses not to select any fields in the adjudication
popup but wants to mark them all as having been adjudicated, then it would nevercause the number of items left to be reduced after clicking the Save button, thus always
showing that X items are left to adjudicate.

•Bug fix: If users use "!=" instead of "<>" in a calculated field's equation, it would notalways evaluate the calculation correctly when viewing the form or survey where thecalc field is located. (Ticket #15339)•

Bug fix: Horizontally-aligned slider fields would mistakenly display as vertical on mobile
devices only. (Ticket #15390)•

Bug fix: HTML tags places inside the rule name of a Data Quality rule would get
escaped and be viewable as-is rather than interpreted as HTML.

•Bug fix: If running specific versions of PHP on the REDCap web server, the Field
Comment Log popup would crash and never display the popup. (Ticket #15333)•

Bug fix: Some text was missing when describing the Duo two-factor authentication
option in the Control Center.

•

Bug fix: When attaching a YouTube video to a Descriptive field on a survey or data
entry form, at the end of the video it would mistakenly display other recommended
videos (added automatically at the end by YouTube). It has now been set to never dothat.

Version 7.0.7 - (released 2/9/2017)
BUG FIXES & OTHER CHANGES:•

Bug fix: When using the Dynamic Data Pull (DDP) module and mapping fields withcomposite mapping (i.e., many-to-many mapping), it might mistakenly not save thosemappings correctly, which might prevent data from being pulled into them correctlyfrom the source system and would also cause issues displaying the mapping pagecorrectly afterward.

•

Bug fix: The record count on the System Statistics page in the Control Center might
mistakenly be slightly higher than the actual count.

•

Bug fix: When using Send-It to send a file from a File Upload field, from a data export,
or from the File Repository, it would mistakenly display the "Select a file" option to
upload a new file when it should instead display the filename of the file.

•

Bug fix: When a calculated field is located on a repeating instrument, it may mistakenly
not show up in Data Quality rule H as a discrepancy when there is a discrepancy
between the saved value and the true calculated value.

•

Bug fix: When the record ID field is located on a repeating instrument, it may
mistakenly cause discrepancies to show up as duplicates in Data Quality rule H.

•

Bug fix: When executing Data Quality rule F, it would mistakenly return discrepancies
for checkbox fields that were hidden by branching logic but had all their choices
unselected. (Ticket #13555)•

Bug fix: When calling the API Delete Records method, it was mistakenly checking thewrong user permissions. It should have been checking to require that the user has API
Import/Update permissions and Record Delete permissions. (Ticket #14328)•

Bug fix: When a project is in production but not in draft mode, it would mistakenly
display the "Download Data Dictionary with drafted changes" link on the Project Setup
page. It should only display that link when the project is in draft mode. (Ticket #14851)•

Bug fix: When viewing a data entry form or survey page using a recent version ofAndroid, depending on the device, the backspace button may get inadvertently

disabled on the device's keypad for integer-validated text fields only, thus preventing
users from removing an integer that was entered into a field. The fix for this has adownside, which is that integer-validated text fields will now no longer display just thedevice's keypad on Android devices but will instead display the full alphabetic
keyboard.
•

Bug fix: The REDCap Language File Creator/Updater would create corrupted language
files to be used for translation due to presence of the HTML character code " in certain
string of language text in the English.ini file. (Ticket #14843)•

Bug fix: When using the To-Do List in the Control Center and clicking the info button on
the right for a given item in the list, some of the text revealed in the box would not becompletely viewable. (Ticket #14368)•

Bug fix: When copying a data collection instrument via the Online Designer's "choose
action" button, if a field on the instrument has a new resulting variable name that islonger than 100 characters, then it would result in an error and prevent the user fromcopying the instrument. (Ticket #14770)•

Bug fix: When users are not allowed to copy projects on their own but must request
administrators to do so for them, if an administrator processes a "copy project" request
via the link sent in the email (rather than directly via the To-Do List in the Control
Center), then the request item will mistakenly not get marked as "completed" on the ToDo List page. (Ticket #14891)•

Bug fix: If a user is typing branching logic or a calculation into a text field where it
provides the variable auto-suggest feature and logic validation in real time, then insome cases if the user does this a lot in a short amount of time, it might mistakenly ban
the user's IP address and lock them temporarily out of REDCap. (Ticket #14405)•

Bug fix: If scheduling a survey invitation via the Compose Survey Invitation popup on adata entry form and setting a reminder to "send at exact date/time", then the reminder
would mistakenly send immediately rather than at the time defined.

•

Bug fix: When uploading an attachment file onto a Descriptive field in the Online
Designer, if the file's filename link is clicked to re-download the file inside the Edit Field
popup, it would mistakenly display an error.

•Bug fix: After creating a custom link for a public survey link, it would mistakenly notprovide a way for users to remove the custom link (i.e., the red X was not being
displayed) on the Public Survey Link page.

•Bug fix: When importing data in EAV format using the Import Records API method forclassic (non-longitudinal) projects only, it might mistakenly not update the value offields that already have data and instead simply add the new value to the back-end
database, leaving the field with more than one value stored.

•

Bug fix: If a multi-page survey has some pages that might get completely skipped
because all fields on the page have branching logic, then if the survey instrument isalso enabled to be a Repeating Instrument in the project, then it would mistakenly fail toskip the page when branching logic dictates that it should be skipped. (Ticket #13764)

Version 7.0.6 - (released 2/3/2017)
BUG FIXES & OTHER CHANGES:•

Medium security fixes: Several cross-site scripting vulnerabilities were found on
various pages, in which they could possibly be exploited by a malicious user.

•

Minor security fix: An SQL injection vulnerability was found on the Control Center's
Browse Users page, which could possibly be exploited by a malicious user that hascompromised an administrator's account.

•

Bug fix: When making a call to the Import Metadata API method, it would mistakenly
always return "18" as the response rather than returning the number of fields that wereactually imported.

•

Bug fix: When creating a Project Bookmark in a project and using the Link
Type="REDCap Project", the project list would mistakenly include deleted projects.
(Ticket #13855)•

Bug fix: When choosing the "Lock all instruments" option from the record action dropdown on the Record Home Page of a given record, in longitudinal projects it would
mistakenly lock instruments on events that do not contain data. Bug emerged in
REDCap 7.0.0.

•Bug fix: After choosing the "Lock all instruments" option from the record action dropdown on the Record Home Page of a given record, it would mistakenly not display thelock icon on that page for instruments with a gray status icon (it should always display
the lock icon for all instruments on all events containing data). Bug emerged in
REDCap 7.0.0.

•

Bug fix: If the Double Data Entry module is enabled in a project, and a user clicks oneof the "Compare" buttons at the top of the Data Comparison Tool page immediately
after merging a record, it will mistakenly save some values in the back-end databasetable, thus mistakenly creating an additional new record that has no relation to theother existing records. (Ticket #13394)•

Bug fix: If a user leaves a required field blank on a repeating instrument or repeating
event, it will reload the data entry form to display the error message, but will mistakenly
load the first instance of the form/event rather than the correct instance being saved.
(Ticket #14099)•

Bug fix: The input fields inside the "Enable reminders" box in the Compose Invitations
dialog on the Participant List page were too small to read.

•

Bug fix: IF running PHP 7.X on the web server, then the API Playgound page mightcrash on specific occasions with a fatal PHP error when attempting to view the code
produced at the bottom of the page for various programming languages.

•

Bug fix: If scheduling a survey invitation via the Compose Survey Invitations popup on
the Participant List page and setting a reminder to "send at exact date/time", then thereminder would mistakenly send immediately rather than at the time defined. (Ticket#14314)•

Bug fix: When deleting a record on the Record Home page when the record namecontains a space, the message displayed after successfully deleting the record would
mistakenly have a "%20" in place of the space in the record name displayed.

Version 7.0.5 - (released 1/20/2017)
BUG FIXES & OTHER CHANGES:•

New module: Find Calculation Errors in Projects - (Note: While LTS typically does not
get new modules, this module is used to help find bugs in calculations and is therefore
indirectly fixing bugs, which is why it was added to LTS.) This new page in the Control
Center allows administrators to determine if any projects in the entire REDCap system
contain calculation errors. It is possible in certain cases that the data saved for
calculated fields in projects might not be accurate. This might be due to a user
modifying a calc field's equation after data collection has begun, or perhaps due tosoftware bugs that may have occurred in REDCap in the past that affected calculations.
This new module will not fix any incorrect calculations in projects, but it will identify
projects with issues so that the administrator or a user in the project can go to the Data
Quality module in the project and run Rule H, which will help fix any calculation errors.

•

Bug fix: When using the Save & Return Later feature on a survey that is enabled as a
Repeating Survey (via Repeating Instrument feature), it would mistakenly ask for the
Return Code (or ask for the respondent to log in if Survey Login is enabled) on therepeated instances of the survey after the first one has been entered. (Ticket #13240)•

Bug fix: When a user's password has been reset and they are emailed a link to reset
their password, on certain random occasions when the click the link in their email, it will
fail to begin the password reset process and will also mistakenly display an "Access
Denied" message stating that the user is now locked out of REDCap temporarily for X
minutes. (Ticket #7457, #11260, #1710, #13109)•

Bug fix: If a user on a data entry form leaves spaces before or after a value entered in atext field, the prompt that asks them if they want the spaces trimmed mistakenly gets
displayed in the wrong vertical position on the webpage in certain cases. (Ticket#13486)•

Bug fix: If a project has repeating instruments that are enabled as surveys, and a user
clicks the "Delete data for THIS FORM only" button at the bottom of a data entry form,
then it would mistakenly not remove that instance of the instrument from the Participant
List.

•

Bug fix: If a project has repeating instruments that are enabled as surveys, and a
Custom Label has been set for the repeating instrument, then it would mistakenly notdisplay the custom label for Instance #1 in the Participant List.

•

Bug fix: If a project has repeating instruments that are enabled as surveys, and a
Custom Label has been set for the repeating instrument, then it would mistakenly notdisplay the custom label for Instance #1 in a record's Survey Queue.

•

Bug fix: If a project has repeating instruments that are enabled as surveys, then on
certain occasions in longitudinal projects, it might mistakenly only display the first
instance of the survey in a record's Survey Queue.

•

Bug fix: Data Quality rule F would mistakenly return discrepancies for visible fields with
branching logic and have data saved for them rather than only fields that are currently
hidden. (Ticket #13555)•

Bug fix: If a field is given the variable name "length", then the "Reset" link will not workfor the field if it is a radio or slider field. Also, a slider field with that variable name will
not get enabled when initially clicked by the user. (Ticket #13595)•

Bug fix: If using a custom message to display to users when creating/copying a project,then if a user goes to copy a project, it will mistakenly bypass the custom message
prompt and copy the project regardless. (Ticket #13674)•

Bug fix: If the randomization module is enabled on a longitudinal project with multiple
arms, in which a record exists on multiple arms (one of which is the arm that contains
the randomization field), then if the record is deleted from the non-randomization arm,
then its randomization allocation would mistakenly get removed from the randomizationarm. This means that the record's allocation would get removed mistakenly as if it were
never randomized and thus allow another record to mistakenly take its allocation later.
(Ticket #13278)

Version 7.0.4 - (released 1/13/2017)
BUG FIXES & OTHER CHANGES:•

Minor security fix: A cross-site scripting vulnerability was found on the Data Import Toolpage, which could possibly be exploited by a malicious user. (Ticket #13193)•

Bug fix: When viewing the Stats & Charts page in a project, clicking the "Show Stats
Only" button would cause the "Download image" button to sometimes obscure the stats
table for the field. (Ticket #6534)

•Bug fix: When exporting a PDF of data when the "Character encoding for exported
files" has been set to "Chinese (UTF-8)", then it will result in a fatal PHP error if the
REDCap web server is running PHP 5.4.0 or higher. (Ticket #13334)•

Bug fix: If text containing HTML comments (e.g., <!--...-->) is added to a field label,
survey instructions, or other text that appears on surveys and data entry forms, it might
mistakenly prevent the full rendering of the page and might make it impossible to enterand save data successfully. (Ticket #13214)•

Bug fix: When a survey Stop Action has been enabled for a drop-down field that has
the auto-complete option enabled, then if the Stop Action is triggered after selecting a
choice, the value of that field would mistakenly not get saved. It would still save allother field data on the survey, but it would not save the value of the field triggering theStop Action. This would not affect all drop-down fields but only those with the autocomplete option enabled.

•

Bug fix: When merging two records in a Double Data Entry project, slider fields would
mistakenly not have a way to enter a new value in the third column of the merging
table, thus making it impossible to set a value other than those from the two records
being merged. For sliders on that page, it now displays an integer-validated text fieldwith 0-100 range limit as a slider substitute since creating an actual slider on the pageis a bit complex due to certain technical dependencies. (Ticket #13196)

Version 7.0.3 - (released 1/6/2017)
BUG FIXES & OTHER CHANGES:•

Medium security fix: Cross-site scripting and SQL Injection vulnerabilities were foundon several pages, which could possibly be exploited by a malicious user.

•

Major bug fix: Calculation errors may (in specific situations) occur on surveys or data
entry forms if a calculation uses a number-validated or integer-validated field in its
equation, in which the result might mistakenly get calculated as "0" instead of leaving
the calc field as blank. This might also cause the "Erase value" prompt to appear on
data entry forms as well.

•

Major bug fix: In specific situations, Data Quality rule H and auto-calculations may
differ from the calculation performed on surveys or data entry forms if a calculation
uses any of the advanced functions where many values can be used as parameters(e.g., min, max, mean, sum, stdev). The discrepancy occurs in Rule H and autocalculations when all the values referenced inside the function have a blank/null value.
(Ticket #12771)•

Bug fix: If the equation of a calc field contains a tab character, it will display an error on
the survey or data entry form where the calc field is located.

•

Bug fix: The cached count of records in a project (displayed on the My Projects page)would mistakenly not get reset when clicking the Erase All Data button on the Other
Functionality page or when deleting all records while moving the project to production
status.

•Bug fix: When copying a project containing surveys using the "Copy the project" buttonon the Other Functionality page, it would mistakenly not copy over the Enhanced
Choices option (if enabled) or the Repeating Survey options (if the Repeating
Instruments functionality is enabled) from the Survey Settings page for each survey.

•

Bug fix: For projects with Repeating Instruments enabled that are also enabled assurveys with the Repeating Survey option enabled, if the Survey Queue is alsoenabled, then there is the possibility that only the first instance of a repeating survey
will display in the Survey Queue instead of all the saved instances.

•

Bug fix: When creating a new project whose purpose is set to "Research", the text box
for entering the project PI's middle initial is not wide enough. (Ticket #12786)•

Bug fix: If the Data Resolution Workflow is enabled in a project and a user is viewing
the dialog/popup of data query actions and logged data, on certain occasions it might
mistakenly not display all the items in correct chronological order. (Ticket #12825)•

Bug fix: When upgrading REDCap, if the version directory has been placed on the
REDCap web server and the administrator is on the REDCap Upgrade page, the linkon that page to the Language File Creator/Updater page would mistakenly redirect
them to the REDCap Home page instead of the correct page.

•

Bug fix: When opening a To-Do List request in the popup dialog on the To-Do List pagein the Control Center, the top of the popup would be mistakenly hidden underneath the
top navigation bar, thus making it impossible to close the popup.

•

Bug fix: When editing a report and changing the field/variable used for a filter in Step 3,
in which the filter field being modified is not the last filter in the report, then it would
display a new filter field at the bottom with an incorrect filter number value (e.g.,
displays "Filter 3" for the last filter when it should say "Filter 8" instead). (Ticket #12766)•

Bug fix: In the API documentation for the API method "Export Project XML", theparagraph of text for the "exportFiles" parameter was displaying the wrong text. (Ticket#12974)•

Bug fix: When attempting to send a signature file or uploaded file via Send-It from adata entry form, it would display an erroneous error message when the file is sent, thus
preventing it from being sent. (Ticket #12747)

Version 7.0.2 - (released 12/28/2016)•

New LTS branch based on REDCap 7.0.1 (Standard Release)

Version 6.15.15 - (released
12/22/2016)
BUG FIXES & OTHER CHANGES:•

Medium security fix: A cross-site scripting vulnerability was found that could possibly
be exploited by a malicious user who knows how to craft a specific string of JavaScript
code to render an iframe on a project page.

•

Major bug fix: If importing data using the Dynamic Data Pull (DDP) in which somevalues on the adjudication screen are unchecked (so that they do not get imported),then it would mistakenly import those values anyway when the Save button is clicked.
(Bug emerged in version 6.15.14.)

•Bug fix: If a user in a project had been set to receive Survey Notifications whensomeone completed a survey, and then the user was removed from the project, thenthe user would mistakenly still show up in the list of users in the Survey Notifications
popup in the Online Designer, even though the user is not selectable there.

•

Bug fix: Piping was mistakenly not working in exported PDFs of instruments with data.
(Ticket #11440)•

Bug fix: When downloading a PDF of a survey response, it might on some occasions
not display the label "Response was added on [timestamp]" in the PDF for the
response.

•

Bug fix: When downloading a PDF of a survey response, it would mistakenly not
perform piping for the survey instructions if variables were used in the instructions.

•Bug fix: The API example file for the File Import API method in PHP had an error in it.
This only affects the PHP example of this method.

•

Bug fix: If using Table-based authentication and resetting one's password recovery
question on the My Profile page, it would take the user back to the My Projects pageand mistakenly not prompt them to enter a new recovery question for certain cases
when Two Factor Authentication has been enabled in REDCap.

•

Bug fix: An error would occur when a developer uses the REDCap::getData method topull data from one project (specifying the project_id parameter in the method) whileinside a hook from another project. (Ticket #12095)•

Bug fix: Fields having "email" field validation would mistakenly not allow for top-leveldomains exceeding 4 characters (the part of the email domain name to the right of thedot, e.g. john@example.global).

•

Bug fix: When importing users via the API User Import method, it would fail if the users
were being added to the project (were not existing project users) and were not being
assigned to a Data Access Group during the import. (Ticket #12031)•

Bug fix: When executing Data Quality rule H across all records in a longitudinal project,
it might mistakenly find false positives of incorrect calc field values in events that haveno data. It should instead be ignoring events with no data for each given record. (Ticket#11599)•Bug fix: For a very small minority of calculated fields, especially those using the IF
function, the resulting calculation determined when viewing the calc field on its data
entry form might be different than the one calculated during a data import or whenrunning Data Quality rule H. (Ticket #12137)•

Bug fix: If a user puts focus on the text box of an auto-complete drop-down field on asurvey or data entry form but does not change the field's value, then it would
mistakenly trigger the "Save your changes" prompt if they try to leave the page. Note:
This does not affect regular drop-down fields but only those with the auto-completefeature enabled. (Ticket #11725)•

Bug fix: If an auto-complete drop-down field on a survey or data entry form has an
option whose option label is "-" (i.e., a single dash), then it will not render that option
correctly when the drop-down is rendered on the page. Note: This does not affectregular drop-down fields but only those with the auto-complete feature enabled. (Ticket#12226)•

Minor security fix: A few cross-site scripting vulnerabilities were found on different
pages in REDCap, in which they could possibly be exploited by a malicious user who
knows how to craft a specific string of JavaScript code.

•

Minor security fix: A vulnerable version of Shockwave Flash was used on the Public
Survey Link page in projects utilizing surveys. All Shockwave Flash modules have been
removed, and have been replaced with a JavaScript equivalent.

•

Bug fix: Text fields that have the field validation of Number 1/2/3/4 decimal place will
mistakenly not have its stats displayed on the "Stats & Charts" page. (Ticket #12388)•

Bug fix: When viewing the API Tokens page where it displays when a token was lastused by a user, it would mistakenly never load the "Last Used" timestamps in the table,
but would always say "Loading..". (Ticket #12477)