This bugfix release includes all bug fixes since the 23.0.4 release.

For a full list of changes follow this link

Noteworthy changes:

• [Publication] Set Content-Type for ajax responses. This could lead to an XSS attack if a user is tricked into directly accessing an ajax endpoint. The frontend was not directly vulnerable. (#7532)
• [Configuration] Fix saving of values when no previous value present (#7507)
• [Raisinbread] Fixing help_editor module to display RB instrument instructions (#6907)
• [Config] assign user creating project to a newly created project (#7505)
• [Filter] Fix Menu Filter logic to use exact match for "Sex" fields (#7498)

This was for the purpose of linking to Zenodo, but not really to be used as a release version for public consumption. Please use a numbered release.

This bugfix release includes all bug fixes since the 23.0.3 release.

For the full list of changes follow this link.

Noteworthy changes:

• [survey_accounts] Remove Email column from SurveyAccountsProvisioner (#7452)
• [FilterableDataTable] Fix behaviour of grouped fields with multi-select filters (#7453)
• [Instrument] Add support for jsonData instrument in clearInstrument function (#7484)
• [Instrument API] expand saving functionality to include Candidate age calculations and scoring (#7485)
• [User] Replace GROUP_CONCAT with implode to bypass length limitations of group_concat (#7486)

This bugfix release includes all changes from the 22.0.4 release as well as some added bugfixes for the 23.0.2 release.

For the full list of changes follow this link.

Noteworthy changes:

• [Battery] Add missing instruments to a battery when survey instruments are already populated instead of throwing an error #7163
• [Document_repository] Fix for contents displayed at root #7233
• [Filters] Fix Query Param Filtering Bug #7245
• [Instrument_builder] Fix Date element corruption in LINST files when load/saving #7247
• [Instrument] Fix form freeze for completed instruments #7344

Notes for release:

• If upgrading from 23.0.2 to 23.0.3 make sure to run the SQL patch removing the Email column from the participant_accounts table and the corresponding history entries (see #7248 for more details)
• The bugfix for populating the userId field of instrument tables (#7252) includes a back population script for all userIDs not saved in the instrument tables since this bug appeared. This script will search through the history log to retrospectively populate the userID field. It's important to note that, depending on the size of your database and history table, the script can take over 15 hours to run.

Caveat for projects:
Make sure to run the following scripts in order to remove special characters from links and ensure they are downloadable.

• tools/single_use/Cleanup_Special_Chars_Media.php (see #7386)
• tools/single_use/Cleanup_Special_Chars_Document_Repository.php (see #7428)

This incorporated v21.0.7 into the v22 release series in order to remove all traces of email addresses from the survey module.

Updating the code will remove it from the frontend, but users must manually source the patch SQL/Archive/21.0/Cleanup/2020-12-18-Remove_survey_emails.sql to remove the data from the backend.

This release removes all traces of email address from the survey module from the 21.0.x branch. Updating the code will remove it from the frontend, but users must manually source the patch SQL/Archive/21.0/Cleanup/2020-12-18-Remove_survey_emails.sql to remove the data from the backend.

This bugfix release incorporates the bug fix from v22.0.3 into the v23 branch and also fixes a number of minor issues that were not ready in time for the v23.0.1 release.

Detailed bug fixes:

[User accounts] Fix error message on new user account page (#6803)
[issue_tracker] Update validation to allow NULL Site (#6526)
[candidate_profile] Only show consent summary card if useConsent is enabled (#6807)
[Module Manager] Fix grammar in reload prompt (#6824)
[timepoint_list] Hiding Candidate Info and View Imaging Datasets buttons when missing permission (#6815)
[Statistics / Behavioural] Fix query for project breakdown (#6649)
[electrophysiology_browser] Add Project Permissions check to session page(#6640)
[Statistics/Behavioural] Site permission fix on detailed view(#6861)
[Statistics] fix behavioural tab without any project selection (#6882)
[battery_manager] Allow editing of battery with null CenterID by converting to all CenterIDs (#6858)
[Imaging_browser] Access to view session based on session project instead of candidate project (#6888)

This bug fix release fixes 2 issues an issue in LORIS v22.0 where data was incorrectly joining every header to get the acquisition date instead of a single acquisition date header, resulting in potentially unusable load times of the imaging browser for large data sets. See PR #6871

This release primarily fixes an SQL error in the upgrade script for LORIS 22->23. Existing projects should ensure they upgrade directly to v23.0.1.

This release contains user interface improvements, code clean up, bug fixes and new features. This release assigns users to projects, and begins the process of adding project-based permissions to LORIS in addition to the site-based permissions that already exist.

Full list of changes

Some of the major changes to this release are:

Core

Features

• Add configuration option to specify the format in which dates are displayed. (PR #5004)
• Configurable upload directory for data_release and document_repository modules (PR #5815)
• New radio components for forms. (PR #5846)

Updates and Improvements

• PHP minimum requirements raised to PHP 7.3 (PR #5723)
• Menus are now maintained by modules and no longer in the SQL database (PR #5839)
• New script created for streamlining instantiation of the Raisinbread demonstration
  database (PR #5260)
• New documentation for file permissions has been added to the README.md file. (PR #5323)
• Dashboard study progression section performance improvement (PR #5887)
• New API version 0.0.3 released (PR #6188)

Bug Fixes

• Fix edge-case that gave a confusing error message when changing password (PR #5956)
• Fix bug where examiner form field was incorrectly hidden (PR #6085)
• Fix special character double escaping in instruments (PR #6223)

Modules

Candidate Profile

• New module created to provide dashboard of a single candidate's data across all
  modules. (Various PRs)

Issue Tracker

• The issue_tracker module now has the feature of uploading attachments to new or existing issues. (PR #5394)
• All sites now appear in the dropdown for site, not only study sites. (PR #6135)

Battery Manager

• New module created to manage the entries in the test_battery table of the database.
  This allows projects to modify their instrument battery without requiring backend access.
  (PR #4221)

Module Manager

• New module created to manage the status of installed modules. (PR #6015)

Electrophysiology Browser

• New module created to view electrophysiology data within LORIS. (PR #5230)

Candidate Parameters

• Add tab to view and edit a candidate's date of birth. (PR #4915)
• Add date of death feature for LORIS. Store and calculate age based on a date of
  death for candidates. (PR #4929)

Create Timepoint

• Add language parameter when creating a new timepoint for multilingual studies. (PR #4976)

Data Release

• Add filters to data release module. (PR #5224)

MRI Violations

• Add support for multiple project/subproject/visit_label MRI protocols (PR #4321)

Clean Up

• New tool for detection of multiple first visits for a candidate (prevents a database
  exception). It is recommended to run this tool for existing projects (PR #5270)
• Heroku postdeploy script cleanup (PR #5275)
• Vagrantfile Deprecation (PR #5319)
• The data_integrity_flag module was removed. (PR #5824)

Notes For Existing Projects

• PHP should be upgraded to 7.3 or higher before upgrading LORIS.
• For dev instances, the php-curl extension is now a required dependency.
• Legacy Quickform instruments may have issues due to code changes (PR #4928)
• Customized entries in the LorisMenu and LorisMenuPermissions tables need to be
  transferred to the new module table and handled accordingly. (PR #5839)
• Change of name from quatUser and quatPassword to adminUser and adminPassword (PR #5785)
• The data_integrity_flag module was removed. Projects still using the module should
  copy the code into the override directory and re-add the necessary SQL to add it to
  the list of modules.(PR #5824)
• New tool for detection of multiple first visits for a candidate (prevents a database
  exception). It is recommended to run this tool for existing projects (PR #5270)
• New tool for automatically adding modules to the modules table. This tool should
  be used by projects having custom modules not in LORIS. (PR #5913)
• Duplicate filenames in the data release module will cause an error when downloading. Make sure to remove all filename duplications before upgrading to this version. (PR #6461)
• New tool for detecting and reporting the presence of double escaped special characters in the database instruments (PR #6477)
• The scope of the _selectMultipleElements variable in the NDB_BVL_Instrument class has been changed and the variable renamed to selectMultipleElements, make sure to update the variable in all your instruments and libraries accordingly (#6140)

Notes For Developers

• The tool phpstan has been added to our automated test suite. (PR #4928)
• Config files for static analysis have been moved to the test/ directory. (PR #5871)
• Dashboard was refactored to turn panels into module widgets. (PR #5896)
• Add CSSGrid component type (PR #6090)
• Format for webpack-project.config.js changed (#6122)

Upgrade Process

Please note that when upgrading between non-consecutive LORIS versions, the project must follow the upgrade steps between each major version. For example, if your project is upgrading from LORIS 23 to LORIS 26, it is imperative to read the release notes for all LORIS versions in between 23 and 26, and follow the upgrade instructions first from 23 to 24, then 24 to 25, and ultimately 25 to 26.

In addition, in order for the steps below to succeed you must be on LORIS version 22.0.2. If you are on any previous version, the upgrade might fail to complete.

1. Make sure you are using PHP 7.3 or higher before beginning to upgrade.
2. [For developers] php-curl is now a required dependency and must be installed to continue.
3. Get the 23.0.0 source code.
4. Source the SQL/Release_patches/22.0_To_23.0_upgrade.sql SQL file into your database.
5. Run make all in the LORIS root directory.
6. Run the tools/single_use/Convert_LorisMenuID_to_ModuleID.php script and apply the generated SQL commands on the database.
7. Run the tools/single_use/Cleanup_multiple_firstVisits.php script with the confirm argument to apply changes.
8. Run the tools/single_use/instrument_double_escape_report.php to detect potential special character escaping issues in the saved instrument.
9. Run SQL patches from the SQL/Archive/23.0/Cleanup directory at your discretion to remove superfluous or deprecated entries in the database.

Note: Some cleanup SQL commands might fail due to foreign key errors or other data related issues, make sure to test the release SQL patch previously and correct all necessary issues before proceeding to production.