REDCap Change Log

Version 11.3.0 (released on 2021-08-27)

CHANGES IN THIS VERSION:

  • New action tag: @RICHTEXT - Adds the rich text editor toolbar to a Notes field to allow users/participants to control the appearance (via styling and formatting) of the text they are entering into the field.
  • New API methods
    • Delete User - Remove a specified user from a project.
    • Export User Roles - Returns a list of user roles, including their role name, unique role name, and privileges, from a project.
    • Import User Roles - Allows one to create new roles (specifying their role name and privileges) or edit the role name and privileges of existing roles.
    • Delete User Role - Deletes a specified user role from a project.
    • Export User-Role Assignment - Returns a list of project users and what user role to which they are assigned.
    • Import User-Role Assignment - Allows one to assign, reassign, or unassign one or more users to/from a user role in a project.
  • New features: New drop-down options on the User Rights page to allow users to perform the tasks listed below using a CSV file in the user interface.
    • Upload users and their privileges
    • Download users and their privileges
    • Upload user roles and their privileges
    • Download user roles and their privileges
    • Upload user role assignments
    • Download user role assignments
  • New developer method: REDCap::deleteRecord() - Plugin/hook/module developers may utilize this new method to delete entire records from a project or to delete the data from a specified instrument, event, or repeating instrument/event for specific records.
  • Improvement: More options/parameters for the API Delete Record method - Users can now specify instrument, event, and/or repeat_instance to delete the data from a specified instrument, event, or repeating instrument/event for the records specified in the API request. In previous versions, the only option was to delete the entire record.
  • Change/improvement: When an administrator is reviewing a user's submitted production changes for Draft Mode on the "Project Modification Module" page and then clicks the "Compose confirmation email" button in the blue "Administrator Actions" box, the email template displayed in the dialog now contains clearer wording to help users better understand how to respond. This helps make the production change process faster and more efficient.
  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way as user-defined text in REDCap Messenger.
  • Change: If new instruments are created in a project while in production status, all users and user roles will no longer automatically get full "View & Edit" rights to that instrument for their Data Viewing Rights but instead will receive "No Access (Hidden)" rights by default for new instruments. When in development status, the instrument-level rights still defaults to "View & Edit" for new instruments. This change helps improve security when a project is in production to ensure that users do not accidentally gain access to data that they should not see if new instruments are still being added to the project. (Ticket #54096)
  • Change/improvement: When viewing the Record Status Dashboard in which one or more repeating instrument tables are displayed at the bottom of the page, if any of the tables were collapsed on a previous visit of the page, the page will load much faster, especially for records containing hundreds or more repeating instances.
  • Bug fix: Some email addresses that are entered into the value of a Text or Notes field might mistakenly not get converted into a clickable "mailto" link when viewed on a report.
  • Bug fix: When exporting and importing a Project XML file, the Survey Queue setting "Keep the Survey Queue hidden from participants?" (if enabled) would mistakenly not get enabled in the new project created from the XML file.
  • Bug fix: When calling the Export Records API method and providing the "fields" parameter, in which the parameter's value only contains the variable names of one or more Descriptive fields in the project, it would mistakenly return data for all fields instead.
  • Bug fix: When using the DDP Custom feature, required parameters (i.e., user, project_id, redcap_url) were mistakenly not being sent to the custom metadata web service.
  • Bug fix: Fields with the @DEFAULT action tag might mistakenly not get prefilled with the default value on the page if any fields on that same instrument contain saved data and have the @CALCDATE or @CALCTEXT action tag. (Ticket #110331)
  • Bug fix: If the "Save & Return Later" feature is enabled for a survey in a project that also has the "Survey Login" feature enabled, if a participant clicked the "Save & Return Later" button on a public survey, it would mistakenly display information about a Return Code, which is actually not needed and is confusing because it is inaccurate.
  • Bug fix: If a user is requesting that an administrator generate an API token for them, it would mistakenly not log the admin's action of generating the token. Technically, the action was being logged but was just not available on the Logging page in the project for which it was requested.
  • Bug fix: When using multiple action tags together on a single field, in which the action tags have values inside single quotes or double quotes (e.g., @NONEOFTHEABOVE='1,2,3' @HIDECHOICE='4'), the action tags might mistakenly not get parsed correctly, thus causing them not to function correctly in some cases. (Ticket #113018)
  • Bug fix: When the project-level setting "Prevent branching logic from hiding fields that have values" is enabled, it might cause an error popup to appear on survey pages when a field with a value is trying to be hidden by branching logic. (Ticket #113054)

Version 11.2.6 (released on 2021-08-20)

CHANGES IN THIS VERSION:

  • Improvement: On the External Modules page in a project, users with appropriate privileges may now import and export the configuration settings for any module that is enabled in the project. This feature functions as a convenience by allowing users to easily migrate the configuration settings of one or more modules to another project that has the same module(s) enabled.
  • Improvement: If a user is not assigned to a Data Access Group in a project, the user will now see a new "[No assignment]" option in the "Displaying Data Access Group" drop-down list on the Record Status Dashboard, in which selecting that option will display only records that have not been assigned to any DAG.
  • Change/improvement: "Previous instrument" and "Next instrument" buttons were added at the top right of the Online Designer field-view page to allow easier navigation between instruments. (Ticket #101057)
  • Minor security improvement: Removed the usage of the PHP function "mt_rand" in the source code, and replaced it with the more cryptographically secure PHP function "random_int".
  • Bug fix: When copying a project, it mistakenly does not copy the Data Entry Trigger URL into the new project. (Ticket #112269)
  • Bug fix: When a project has the setting "Delete a record's logging activity when deleting the record?" enabled on the Edit A Project's Settings page, it would mistakenly not display the checkbox option to allow users to additionally delete a record's logging when deleting the record itself via the Record Home Page. (Ticket #112239)
  • Bug fix: When downloading a CSV export of various things in REDCap (e.g., Notification Log export, Data Access Groups export), it might fail to add a BOM (Byte Order Mark) to the CSV file if the file contained UTF-8 characters. The Byte Order Mark is required to open UTF-8 encoded CSV files correctly in certain spreadsheet applications, such as Microsoft Excel. (Ticket #112239)
  • Bug fix: If all the discrepancies of any Data Quality rule have been excluded, it would mistakenly not display the "view" link next to the rule (even though it returns "0" results) after the rule had finished running. It is necessary to still display the "view" link so that users can click it in order to view the exclusions inside the dialog. (Ticket #112294)
  • Bug fix: When clicking "Cancel" inside the Logic Editor dialog, it might mistakenly revert the value of the text box being modified to the value of another text box that was previously edited via the Logic Editor while on that same page. (Ticket #101200b)
  • Bug fix: When exporting and then importing an instrument via the Instrument Zip file in the Online Designer, in which the instrument is enabled as a survey, it might fail to import the instrument in the zip file successfully. (Ticket #112346)
  • Bug fix: Any generated zip files would mistakenly fail upon creation and thus return an empty zip file when using Google Cloud Storage as the File Storage Method (as defined on the File Upload Settings page in the Control Center).
  • Bug fix: The developer method REDCap::getSurveyQueueLink() would mistakenly always return NULL.
  • Bug fix: Multiple blank rows in the table displayed on the survey queue page might mistakenly take up too much room on the page. (Ticket #110914)
  • Bug fix: When a survey is set to "Auto-continue to next survey" in the Survey Termination Options on the Survey Settings page while the other survey setting "Prevent survey responses from being saved if the survey ends via Stop Action?" is set to "Do NOT save the survey response...", the survey would mistakenly continue to the next survey if the participant triggered the survey to end via a Stop Action.
  • Bug fix: When viewing the data entry form for a survey-enabled instrument, if the Compose Survey Invitation dialog is opened on the page, then closed, and then opened again without refreshing the page, the rich text editor in the dialog would mistakenly not be initiated anymore. (Ticket #96574)
  • Bug fix: Custom Application Links (which are to be displayed on the left-hand project menu) were mistakenly only visible to users with User Rights privileges in the project. (Bug #112651)

Version 11.2.5 (released on 2021-08-13)

CHANGES IN THIS VERSION:

  • Improvement/change: Any HTML used in the value of a Text field or Notes field will no longer be escaped on a report (i.e., displayed as-is) but instead the HTML will be interpreted on the report to allow for the styling of text on the page. This means that while previous versions would have displayed the text value "<b>Word</b>" literally as "<b>Word</b>" (without quotes) on a report, it now instead displays "Word" as bolded text on a report. Note: This does not affect data exports or any pages other than reports.
  • Medium security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into user-defined text. (Ticket #112003)
  • Medium security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by uploading a malicious file to a File Upload field on a survey page or data entry form, and then trick someone into executing the file by providing them with a URL of specific end-point in the application in which to navigate.
  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into the user-defined URL of a Project Bookmark. (Ticket #112021)
  • Bug fix: When clicking the "Re-evaluate Alerts" button on the Alerts & Notification in a longitudinal project in which an alert is set to be triggered when an instrument status is complete and when the specified conditional logic is true, it would cause alerts to get triggered on events where the logic is true but where the instrument status is not complete. (TiBug fix: If a malicious user knows how to manipulate some AJAX requests for REDCap Messenger, they might be able to post messages to Messenger threads to which they do not belong, including the ability to post to the General Notifications channel while not being an administrator.cket #111866)
  • Bug fix: Fixed typo in email-related error message. (Ticket #112126)
  • Bug fix: Fix for PHP 8 error message when viewing contributors of a survey response. (Ticket #112144)
  • Bug fix: Logic (including branching logic, conditional logic, and calculations) might not get parsed correctly and thus might return an incorrect result if Smart Variables are used in the logic and also while an element in the logic has a blank value that appears on the left side of an equals sign - e.g., [user-dag-name] = 'vanderbilt' (assuming [user-dag-name] is blank). (Ticket #112010)
  • Bug fix: When survey participants attempt to download a file belonging to a File Upload field while on a survey page, it might mistakenly display the error message "NOTICE: This file is no longer available for download". Bug emerged in the previous version of REDCap.
  • Bug fix: If a calculated field is utilizing a date and datetime value that are used together in the same datediff() function, if the date value happens to be today's date, it might return an incorrect value (typically a value of "0"). (Ticket #112183)
  • Bug fix: When a project is not using "Default Encoding" for "Character encoding for exported files" on the Edit Project's Settings page, calling the API Export PDF method might mistakenly return a corrupt, unopenable PDF file. (Ticket #112035)
  • Bug fix: The Text-To-Speech functionality on survey pages did not work on mobile devices, iOS, or in the Safari web browser in previous versions. It should now work successfully for all platforms and browsers. (Ticket #111739)
  • Bug fix: The Smart Variable [bar-chart] might mistakenly mislabel the groupings in a bar chart that uses color grouping using a multiple choice field if there are no records that have a value for a specific choice for the multiple choice field. For example, if a grouping field has choices "One", "Two", and "Three", in which no records in the project have "Two" selected, then the resulting bar chart might mislabel all the "Three"s as "Two".

Version 11.2.4 (released on 2021-08-06)

CHANGES IN THIS VERSION:

  • Bug fix: When downloading a Descriptive field attachment while on a survey page, it might mistakenly return an error message and prevent the participant from downloading the file.
  • Bug fix: When downloading a file for a File Upload field or an attachment for a Descriptive field, in which that file is being counted via the @DOWNLOAD-COUNT action tag on another field, the download count would not get successfully incremented for the @DOWNLOAD-COUNT field when the file is downloaded on a survey page (as opposed to on a report or data entry form).
  • Bug fix: When downloading a file for a File Upload field or an attachment for a Descriptive field, in which that file is being counted via the @DOWNLOAD-COUNT action tag on another field, it might mistakenly attempt to save the incremented value to a non-existent record (as seen in the logging) when the file is downloaded on a public survey that has not been saved yet (i.e., the record does not yet exist).

Version 11.2.3 (released on 2021-08-06)

CHANGES IN THIS VERSION:

  • New action tag: @DOWNLOAD-COUNT - The @DOWNLOAD-COUNT action tag provides a way to automatically count the number of downloads for a File Upload field or a Descriptive field attachment. It can be used on a Text field or Notes field so that its value will be incremented by '1' whenever someone downloads the file for either a File Upload field or a Descriptive field attachment. The variable name of the File Upload field or Descriptive field whose downloads are to be counted should be provided inside the @DOWNLOAD-COUNT() function. For example, the Text field 'my_download_count' might have its action tag defined as @DOWNLOAD-COUNT(my_upload_field), in which 'my_upload_field' is the variable of a File Upload field. Whenever the file is downloaded on a data entry form, survey page, or report, the value of the field with this action tag will be incremented by '1'. If that field has no value or has a non-integer value, its value will be set to '1'. NOTE: The download count field must be in the same context as the File Upload field or a Descriptive field. This means that in a longitudinal project the two fields must be on the same event, and in a repeating instrument context, they must be on the same repeating instrument.
  • Medium security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into a field's value on a data entry form or survey page.
  • Change/improvement: The Configuration Check page now checks to ensure that the "Email Address of REDCap Administrator" on the General Configuration page has a valid email entered. Without an email entered there, some features might not work correctly.
  • Change: Updated setup instructions zip file for Clinical Data Interoperability Services by including a new CDIS Manual (PDF) in the zip file.
  • Bug fix: When a PDF of a survey response is sent in a confirmation email after completing a survey, saved via the survey setting “Save a PDF of completed survey response to a File Upload field”, or saved via the e-Consent Framework in the File Repository, it would mistakenly not store the survey version of the PDF (containing the survey title and instructions) but instead would store the data entry form version of the PDF.
  • Bug fix: When editing the value of the Secondary Unique Field in a longitudinal or repeating instance context, it might mistakenly log the change extra times unnecessarily. (Ticket #110740)
  • Bug fix: Making a call to the Import Records API method when importing zero records might cause an Out of Memory error. (Ticket #110761)
  • Bug fix: When using Internet Explorer 11, clicking on a slider field or matrix of fields might mistakenly cause the screen to scroll to the top of the page. (Ticket #111202)
  • Bug fix: When using Internet Explorer 11, trying to expand/collapse a project folder on the My Projects page would fail to work due to a JavaScript issue. (Ticket #111553)
  • Bug fix: The REDCap cron job named "AlertsNotificationsSender" might unexpectedly crash for PHP 8 in certain circumstances. (Ticket #110702)
  • Bug fix: Since Twilio limits SMS messages to 1600 characters, to prevent errors from being returned from a failed request to Twilio for very long text messages, REDCap now automatically breaks an SMS into multiple parts if it exceeds the 1600 character limit. (Ticket #110440)
  • Bug fix: When making API data imports without any data being imported (i.e., blank or missing value for the "data" API parameter), it might behave erratically and cause a PHP error. It now correctly returns the error message "No data was provided". (Ticket #110761)
  • Bug fix: After copying a user role, a text box would mistakenly appear on the User Rights page below the instruction text.
  • Bug fix: When exporting a PDF of an instrument with the character encoding set as Japanese (SJIS), for certain server configurations or PHP versions it might crash with a fatal PHP error. (Ticket #111593)
  • Bug fix: When editing a user role in a project that contains Data Access Groups, it would mistakenly display the "Assign To DAG" drop-down list in the dialog, which should not be displayed when editing roles.
  • Bug fix: When a project contains repeating events in which a report has filter logic to filter out specific repeating instances (e.g., [current-instance] <> "" and [current-instance] = [first-instance]), the report might mistakenly display no results or incorrect results when there is actually data to display. This does not affect repeating instruments but only repeating events. (Ticket #110896)
  • Change: Added clarifying text regarding the behavior of a non-active Automated Survey Invitations in the ASI dialog in the Online Designer. (Ticket #111182)
  • Bug fix: In a project using Twilio telephony services, any Automated Survey Invitations or manually-scheduled invitations that utilize the "Use participant's preference" option for the Invitation Type might mistakenly append the survey link to the message of the survey invitation, even when that is not desired. It now no longer appends the survey link automatically but instead sends the invitation using only the literal text defined by the user. (Ticket #111484)
  • Bug fix: When a user's account expires after the account expiration time has passed, the email sent to the user to notify them of this might be slightly incorrect and might mention user sponsors even if the user does not have a sponsor. The user sponsor related language was removed in that case.
  • Bug fix: The offline survey message that is defined on the Survey Settings page would mistakenly not perform any piping when being displayed on an inactive survey. (Ticket #111707)
  • Bug fix: Fields with the @HIDDEN-PDF action tag would mistakenly be displayed in the PDF download of the instrument when using the PDF download option "Send to printer: select 'Save as PDF' for Printer/Destination". (Ticket #111718)
  • Bug fix: If a calculated field in a longitudinal project has a cross-event calculation that contains an [X-event-name] Smart Variable, the calculation might mistakenly not get triggered when entering data on a form, survey, or via a data import.
  • Bug fix: When using Twilio SMS or Voice Call services on a survey that has only one field that is a Descriptive field, it would mistakenly ask the Form Status complete question at the end of the survey. (Ticket #111799)
  • Bug fix: When calling the surveyLink API method in which a space exists (not necessarily intentionally) at the beginning or end of the "record" parameter passed in the API request, it might cause the space(s) to mistakenly get stored in some parts of the database where the record name is stored, thus causing the Survey Login feature not to work for that particular record anymore. (Ticket #111002)

Version 11.2.2 (released on 2021-07-16)

CHANGES IN THIS VERSION:

  • Improvement: New piping parameter “:ampm” - When piping a time, datetime, or datetimes w/ seconds Text field, appending “:ampm” to the variable name (e.g., [visit_time:ampm]) will display the time in am/pm format (e.g., 4:45pm, 10:35am) instead of military time.
  • Improvement: Ability for admins to configure the required password length and password complexity for user accounts when using Table-based authentication. These settings will default to requiring a 9-character password that must contain lowercase letters, uppercase letters, and numbers (but does not require any special characters. The following new controls have been added to the “Additional Table-based Authentication Settings” section of the Security & Authentication page in the Control Center.
    • Password Minimum Length - any length between 6 and 99 characters
    • Password Complexity options
      1. Requires both letters and numbers
      2. Requires lowercase and uppercase letters and numbers
      3. Requires lowercase and uppercase letters with either numbers or special characters
      4. Requires lowercase and uppercase letters, numbers, and special characters
  • Bug fix: When making a report "public" and when viewing the report via its public link afterward, the check that ensures Identifier fields do not exist in the report would sometimes mistakenly fail to detect Identifier fields in the report.
  • Bug fix: After making a report "public", if the report was made to be no longer public, it would mistakenly still display the report when viewing it via the public link. Instead it should display only an error message on that page (until the report has been made public again).
  • Bug fix: If a public report contains the record ID field while the Custom Record Label or Secondary Unique Field is enabled in the project, REDCap would fail to prevent the report from being shown via the public link if any of the fields used in the Custom Record Label or Secondary Unique Field are Identifier fields. (Ticket #110288)
  • Bug fix: The "Download metadata & data (XML)" button on the Other Functionality page would fail to work correctly due to a JavaScript error.
  • Bug fix: When exporting a PDF of an instrument with data, any slider fields that have a custom range defined (i.e., anything other than 0-100) would mistakenly not be displayed correctly in the PDF and might appear as if the slider has a different value. (Ticket #110391)
  • Bug fix: When a user is assigned to a Data Access Group while using record auto-numbering in a project, if the user attempts to schedule a record via the Scheduling page, it would mistakenly not generate the new record name correctly (i.e., with the DAG ID number appended to the end) when creating the new record.
  • Bug fix: Download links for File Upload fields on surveys might mistakenly still be active and might allow participants to download the file if they still have the download link (e.g., clicking on the link [my_file:link] piped inside an email). The download link is correctly no longer active if the survey or project is inactive, but it would mistakenly be active if the survey response has been completed while the survey in general is still active. This has been changed so that it will now return an error message if someone follows the download link after the survey response has been completed and is no longer active anymore (i.e., no one can return to the survey response to modify it). (Ticket #110442)
  • Bug fix: When creating a user role in a project that contains Data Access Groups, it would mistakenly display the "Assign To DAG" drop-down list in the dialog, which should not be displayed when creating roles.
  • Bug fix: When assigning a user to a user role on the User Rights page while not also assigning them to a Data Access Group at the same time in the popup, it would fail to email the user even if the "Notify user via email?" checkbox is checked in the popup. (Ticket #110339)
  • Bug fix: Any HTML tags used in field labels and elsewhere in a project might mistakenly get stripped out when a project is exported as a Project XML file. (Ticket #110503)
  • Bug fix: Time-validated text fields would mistakenly not be formatted correctly in the "informat" and "format" statements in the resulting SAS syntax file when exporting data to SAS. This appears to occur only when Missing Data Codes are being utilized in the project. (Ticket #110278)

Version 11.2.1 (released on 2021-07-09)

CHANGES IN THIS VERSION:

  • Major bug fix: If using the AWS S3 file storage option, a fatal PHP error would occur when uploading or downloading documents, including on the Configuration Check page. (Ticket #110210)

Version 11.2.0 (released on 2021-07-09)

CHANGES IN THIS VERSION:

  • New feature: Ability to make reports accessible at a public link
    • Summary: When editing a report, users can now set a report as “public” and can obtain a public link to the report if they have User Rights privileges in the project. When a report is public, this means that all data in the report will be fully accessible (with no authentication required) to anyone with the public link to the report.
    • In order to make a report public, all the following must be true:
      • The user must have User Rights privileges in the project or be a REDCap administrator.
      • The report cannot have any Identifier fields in it.
      • The user is required to view the report during their current REDCap session.
      • The user must agree to and check off the following statements: 1) I understand that making this report "public" means that all data in the report will be fully accessible to anyone with the public link to the report, and 2) I understand that I am responsible if any private, sensitive, or identifying data in the report is exposed to persons who should not have access to such data.
    • The behavior of how reports are made public can be controlled at the system level near the bottom of the User Settings page in the Control Center using the setting “Allow reports to be made 'public'?”. Admins may completely disallow reports to be made public (although admins will still have this ability to do so). But if enabled, they may choose to allow users to make reports public on their own or enable the To-Do List approval process by which an admin will need to approve their request to make a given report public (similar to the same system level approval process for Project Dashboards being made public).
    • Once a report has been made public, its configuration cannot be modified while it is public (users cannot add new fields, modify filter logic, etc.). In order to modify a public report, the user will need to make it no longer public, then make their changes, and then make it public again.
  • New Smart Variables
    • [event-id] - (longitudinal only) The event id number of the current event.
    • [survey-access-code:instrument] - The Survey Access Code of the specified survey for a given record/event/instance. The format must be [survey-access-code] or [survey-access-code:instrument], in which 'instrument' is the unique form name of the desired instrument. This can be used simply as [survey-access-code] inside the content of a survey invitation, in which 'instrument' is assumed to be the current survey instrument.
    • [survey-return-code:instrument] - The Survey Return Code of the specified survey for a given record/event/instance in order to allow a participant to return to a completed or partially completed survey response when using the 'Save & Return Later' survey feature. The format must be [survey-return-code] or [survey-return-code:instrument], in which 'instrument' is the unique form name of the desired instrument. This can be used simply as [survey-return-code] inside the content of a survey invitation, in which 'instrument' is assumed to be the current survey instrument.
    • [user-role-id] - The Role ID of the user role to which the current user is assigned (blank if not assigned to any user role). This value is auto-generated for each user role. NOTE: This value is not just unique for all roles within the project but is also unique across all REDCap projects. Thus, if the project and its user roles are copied, the Role IDs of the user roles in the resulting copy will be different from the ones in the original project.
    • [user-role-name] - The unique role name of the user role to which the current user is assigned (blank if not assigned to any user role). This value is auto-generated for each user role. NOTE: This value is only unique for roles within the project. Thus, if the project and its roles are copied, the new project will retain the same unique role names, which allows you to utilize the unique role names in conditional logic, calculations, branching logic, etc. that will not break when the project is copied.
    • [user-role-label] - The name/label of the user role to which the current user is assigned (blank if not assigned to any user role). This value is defined by the user that creates the user role.
  • New Action Tag: @MAXCHOICE-SURVEY-COMPLETE - Similar to @MAXCHOICE but only counts choices on completed survey responses (does not count data entered as data entry only or on partial responses). Causes one or more specified choices to be disabled (i.e., displayed but not usable) for a checkbox, radio button, or drop-down field after a specified amount of records have been saved with that choice for completed survey responses only.
  • New feature: Tableau Data Export- Extract all records into Tableau via the REDCap API.
    • This feature enables Tableau (v10.0+) users to connect Tableau to a REDCap project using an API token. Project data can be exported on demand and be available for use within Tableau to produce summaries and visualizations. The Other Export Option page in any given project has instructions to export project data into Tableau.
    • NOTICE: It is required for a user to have an API token generated for the project in order to use this feature.
  • New feature: MailGun Email API Integration
    • As an alternative for sending outgoing emails from REDCap (rather than using the standard settings in PHP.INI to send them natively from the web server), you may use MailGun, which is a third-party paid service that can send emails on behalf of REDCap.
    • The option can be configured on the General Configuration page in the Control Center. You merely have to provide the API key and domain name for your MailGun account, and it will begin using the MailGun Web API to send *all* emails going out of REDCap.
  • New feature: Project-level setting “Prevent branching logic from hiding fields that have values”
    • This setting can be enabled by any project user with Project Setup/Design privileges in the Additional Customizations popup on the Project Setup page.
    • This setting affects both data entry forms and surveys. If it is not enabled (default), then whenever a field is to be hidden by branching logic on a data entry form, it will always ask the user if they wish to hide the field and erase its value, whereas on survey pages it will automatically erase the value of the field being hidden without displaying the confirmation prompt, which has always been the default behavior for surveys. If this setting is enabled, the branching logic behavior will change so that fields with values will not cause the 'Erase the Value of the Field?' confirmation prompt to ask the user if they wish to keep the value or hide the field, and instead fields with values will not be hidden by branching logic and will stay visible. Thus they will be exempt from branching logic. This will prevent data from being erased as it normally does if fields are hidden by branching logic.
    • When a field should be hidden by branching logic but is not hidden because it has a value, an icon will be displayed on the field to indicate this to the user.
    • This project-level setting is included in the API Export Project Info method as “bypass_branching_erase_field_prompt”. The REDCap Mobile App will soon have this same functionality, but it will only work if the REDCap server is on REDCap 11.2.0 or higher.
    • The name of Data Quality rule F has been slightly changed when this setting is enabled from “Hidden fields that contain values” to “Fields that contain values that should be hidden”.
  • Improvements for report display and/or data exports- When creating/editing a report, the “Additional report options” section in Step 2 now contains the new options below:
    • For projects that have repeating instruments and/or repeating events, the repeating fields that are automatically added (e.g., redcap_repeat_instrument and redcap_repeat_instance) can now be excluded from the report and data export. These fields are displayed by default in reports/exports.
    • Users may choose to display the field label, variable name, or both (default) in the header of a report. Note: This is only used when viewing reports and thus is not applicable for exports since there already exist options for choosing raw vs label format in data exports.
    • Users may choose to display the field label, raw data value, or both (default) for multiple choice fields in the data displayed in a report. Note: This is only used when viewing reports and thus is not applicable for exports since there already exist options for choosing raw vs label format in data exports.
  • Improvement: If the value of a Text field or Notes field contains a URL or email address, the URL or email address will be converted into clickable link and mailto link, respectively, when viewing the data in a report.
  • Improvement: More detailed logging descriptions on the Logging page for report-related logged events, such as mentioning the report name and report ID.
  • Improvement: When users download an Instrument ZIP file for a given instrument in the Online Designer, the zip file now includes all survey settings for the instrument if the instrument has been enabled as a survey, including various files (e.g., survey logo, confirmation email attachment). The downloaded Instrument ZIP can then be uploaded into any project to transfer both the fields and all the survey settings.
  • Improvement: In the Online Designer, the "Custom text to display at top of survey queue" now utilizes the rich text editor to make it easier to style the custom text.
  • Change: PHP 7.2.5 is now the new minimum PHP version that is required for running REDCap. Note: All versions of PHP 8 are currently supported.
  • Major bug fix: Fields embedded inside radio button and checkbox choices would fail to appear on data entry forms and survey pages. (Ticket #109836)
  • Bug fix: When uploading a CSV file of events on the Define My Events page for a longitudinal project that has the Scheduling module enabled, it would mistakenly not add the events in the order in which they appear in the CSV file. (Ticket #108552)
  • Bug fix: When clicking a table header on the My Projects page, the projects inside any collapsed Project Folders would disappear on the page until the page was reloaded. (Ticket #107547)
  • Bug fix: When clicking on a collapsed Project Folder on the My Projects page, it might mistakenly open multiple Project Folders. (Ticket #108579)
  • Bug fix: HTML styling on radio button and checkbox choices would mistakenly get removed on a survey page or data entry form.
  • Bug fix: Using the Smart Variable [aggregate-count] for checkboxes would mistakenly not return any value. It now returns the number of total checkboxes that have at least one checkbox option checked for the field, which is consistent with how [stats-table] behaves for checkboxes.
  • Bug fix: Referencing the record ID field in the Smart Variable [stats-table] would not return any values for that row in the table.
  • Bug fix: The cron job that sends email notifications for REDCap Messenger might mistakenly send multiple emails repeatedly to users. (Ticket #97084)
  • Bug fix: When importing alerts via a CSV file on the Alerts & Notifications page, the “Ensure logic is still true” setting would mistakenly not get set correctly during the upload if it was already disabled/unchecked for an existing alert and then was being enabled/checked in the CSV upload.
  • Bug fix: Depending on a user's number format preference as defined on their My Profile page, certain Smart Functions (e.g., [aggregate-sum:field]) might fail to work successfully in calculations and branching logic. (Ticket #109994)
  • Bug fix: The survey setting "Save a PDF of completed survey response to a File Upload field" would mistakenly display Signature fields in the drop-down list when it should exclude those. (Ticket #110071)
  • Bug fix: The [bar-chart] Smart Variable would fail to display any data in the chart when used with a checkbox field. (Ticket #109370)
  • Change: Added a dark gray line above the Custom Application Links section (if used) on the project left-hand menu to help differentiate the Custom Application Links from REDCap's built-in application page links.
  • Bug fix: When the Secondary Unique Field is enabled in a project in which a data import is being performed with values for that field, it would mistakenly allow duplicate values to be imported for the Secondary Unique Field if the same value exists multiple times within the data file being imported. (Ticket #109791)

Version 11.1.4 (released on 2021-06-30)

CHANGES IN THIS VERSION:

  • Bug fix: If a field’s value is being piped on the same data entry form or survey page where the field itself is located, if that field is being hidden by branching logic, in which the user clicks “Okay” to the “Erase value” prompt to hide the field and erase its value, the piped value seen on the page would mistakenly not get changed/reset during this process but would instead retain the previous value of the field. (Ticket #108756)
  • Bug fix: When viewing Report A or B, the built-in Live Filter for the Record ID field would display a list of all records in the project, which might crash the user's browser if tens of thousands or more records exist. To prevent this, it now only displays the first ten thousand record names in the Live Filter drop-down, similar to how the Data Quality page behaves.
  • Bug fix: A fatal PHP error might occur on some pages related to CDP or Data Mart for certain versions of PHP. (Ticket #108971)
  • Various fixes and improvements for the External Module Framework
  • Bug fix: If the headers of a matrix of fields are displayed as floating/sticky on a data entry form or survey page, the floating headers would mistakenly disappear (at least until the user scrolls the page again) whenever branching logic gets triggered or if the "Reset" link for radio buttons are clicked. (Ticket #109434)
  • Bug fix: The video link for Smart Charts/Functions/Tables in the Smart Variables dialog mistakenly pointed to the Project Dashboard video.
  • Bug fix: When exporting data to a stats package (e.g., SAS) in which some multiple choice fields contain "<" in a choice label, the resulting syntax file might be mangled, truncated, and/or incorrect. Also, that choice label with "<" may not display correctly on the Data Dictionary Codebook page. (Ticket #109571)
  • Bug fix: When importing data in standard XML format via the API, some fields that have a blank value in the XML file might cause the data import to fail. (Ticket #109293)
  • Bug fix: When using the Scheduling module for a project that has record auto-numbering disabled, it is possible that a record could mistakenly be created twice if one user creates the record via data entry at the same time that another user creates the record via the Scheduling module. (Ticket #109287)

Version 11.1.3 (released on 2021-06-18)

CHANGES IN THIS VERSION:

  • Improvement: Reports A and B now have built-in Live Filters: 1) the record ID field, 2) a list of all events (if the project is longitudinal), and 3) a list of all Data Access Groups (if the project contains DAGs and the current user is not assigned to a DAG).
  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into the URL of a specific endpoint.
  • New videos: Added two new videos for Project Dashboards and Smart Charts/Functions/Tables on the Training Video page, Project Dashboards page, and Smart Variable popup documentation.
  • Change: Small change to add clarity to the text of Step 1A when creating/editing an alert on the Alerts & Notifications page.
  • Bug fix: A PHP error would mistakenly occur in the redcap_connect.php file if the binlog_format setting for MySQL/MariaDB has been enabled on the General Configuration page in the Control Center. (Ticket #108667)
  • Bug fix: When exporting data to SAS in which the export contains some Ontology Text fields that have a dash in the raw value for some records in the export, it would prevent the data from being successfully loaded into SAS. Now when creating SAS formats for character variables in the resulting SAS syntax file, the values will be wrapped in single quotes for greater compatibility (unless all the values/options are numerical for the field).
  • Bug fix: Calendar events that had no time set (i.e., only had the date set) but were scheduled or attached to a record would mistakenly not be ordered by record name when displaying the events of a given day on the Calendar page. (Ticket #108688)
  • Bug fix: If a "bar-chart" Smart Chart utilizes multiple fields and also references a report via its unique report name, if the order of the fields defined in the Smart Chart is different than the order of the fields as they appear in the report, the bar chart would mistakenly not display correctly. (Ticket #108709)
  • Bug fix: When a project is in draft mode, the Online Designer would mistakenly allow users to modify the variable name of matrix fields that exist live in production (i.e., not just in draft mode), which should not be allowed because it could inadvertently cause fields to be deleted via renaming. (Ticket #108705)
  • Bug fix: Smart Charts and Smart Tables would mistakenly display HTML tags inside the chart/table if any HTML tags exist in the choice labels or field labels for the fields being utilized in the chart/table.
  • Bug fix: Smart Charts with long field labels or long choice labels might cause text to overlap on themselves or might show only the label ending and not the beginning, which is due to a limitation in the ChartJS library used to generate the charts. Such labels are now truncated to fit better in the chart by using an ellipsis in the middle of the label for optimal display.
  • Bug fix: When using the background fetch method for fetching EHR data via the Clinical Data Mart service, it no longer sends the user an email when the process has finished but instead sends a message via REDCap Messenger. This has been changed because it could be possible that any error messages sent inside the email might contain Medical Record Numbers. So sending the notification via Messenger is more secure.
  • Bug fix: When a REDCap server uses the HTTP_X_FORWARDED_FOR header for a user's IP address, in which the IP actually contains multiple IPs delimited with commas (often because a load balancer is being utilized), it now instead just uses the first IP address in the list rather than the whole value, which was causing a blank IP address to be recorded in REDCap's logging for users in this particular case.
  • Bug fix: In very specific cases where data has been imported into an instrument (but not for the form status complete field) and no user has entered data for that instrument via the data entry form or survey page yet, the form status icon might mistakenly display as a gray color instead of as red on the Record Home page or Record Status Dashboard. (Ticket #108183)
  • Bug fix: If using "LDAP" or "LDAP & Table-based" authentication, any user containing an apostrophe in their LDAP username would cause JavaScript issues to occur for an administrator on the Browse Users page when performing certain actions, such as changing their 2FA code expire time, suspending/unsuspending the user, or deleting the user account from the system. (Ticket #79647d)

Version 11.1.2 (released on 2021-06-11)

CHANGES IN THIS VERSION:

  • Improvement: New alternative PDF print option in the "Download PDF" drop-down at the top of data entry forms, in which there is a new PDF export choice: "This data entry form with saved data (send to printer: select "Save as PDF" for Printer/Destination)". This will produce a much improved browser-based print option to print/save the webpage as a PDF that serves as a suitable alternative to the existing server-side PDF rendering options, which can sometimes be very limited and inaccurate (e.g., when representing field embedding). Note: This “Print to PDF” does correctly hide fields that have the @HIDDEN-PDF action tag.
  • Change: Due to concerns about sending identifying information from REDCap in outgoing emails, Survey Notification emails will no longer include the Participant Identifier in the email body (if a Participant Identifier was entered in the Participant List for a given participant).
  • Bug fix: Smart Charts, Tables, and Functions that have a unique report name or "user-dag-name" as a parameter were mistakenly not using the impersonated user's username and DAG when an administrator uses the "View project as user" tool, thus mistakenly utilizing all data in the project for the Smart Chart/Table/Function instead of just the data from that user's DAG. (Ticket #108017)
  • Bug fix: Some FHIR metadata fields were mistakenly not being displayed in Clinical Data Pull (CDP) mapping page if using FHIR v2 (DSTU2).
  • Bug fix: When a user or admin is clicking the "Yes, move to production status" button in the Move To Production dialog in a development project, it would mistakenly not disable the button after being clicked, which might cause confusing pop-up messages to appear if the button was clicked again before it finished processing. (Ticket #108321)
  • Bug fix: When using the Data Resolution Workflow and assigning a user to a data query, the Messenger notification would mistakenly fail if the user chose to notify the other user of their assignment via Messenger. Thus they would not be notified. (Ticket #108335)
  • Change: When setting the 2-step login controls for a given project on the "Edit a Project's Settings" page, it now displays a popup warning if an admin attempts to set both settings to "Yes" (because they are not compatible). (Ticket #108326)
  • Bug fix: When importing or deleting a file via the API Import File or Delete File methods, it would mistakenly allow users to import files even when the entire record is locked or when the record/event/instrument/instance is locked for that file upload field. (Ticket #108399)
  • Bug fix: When an alert has an email address set for the setting "Email to send email-failure errors", in certain situations (such as when running the "Re-evaluate Alerts" process) it would mistakenly send the email failure notification for *all* alerts in the project instead of just the ones that have an email address defined for the "Email to send email-failure errors" setting. This could result in some users receiving many more emails than expected when an alert fails to send successfully. (Ticket #85030)
  • Bug fix: Fields that are embedded inside other embedded fields might not fully have their data piped in the field's label when viewed in a downloaded PDF of an instrument but might still display some field variables inside braces/curly brackets. (Ticket #108310)
  • Bug fix: In certain cases where a backslash (\) is used in a data value that gets piped (e.g., text that contains "p\0.0233"), it might cause the data to get piped recursively many times and mistakenly output a mangle mess of text. (Ticket #108451)
  • Bug fix: When selecting the Export Records method in the API Playground, if one or more values were selected for the Fields, Forms, or Records parameter, and then they were deselected to have no selections for them, the API request would return an error after clicking the Execute Request button on the page. (Ticket #108526)
  • Bug fix: When clicking the "Delete data for THIS FORM only" button at the bottom of a data entry form, if the record currently exists in multiple arms and the form data being deleted is the only data in the current arm for the record, it would mistakenly delete the record from the arm in addition to removing the form data (although the record would still exist in other arms). This would not cause any data loss, technically, but the user would have to recreate the record in that arm again.

Version 11.1.1 (released on 2021-06-04)

CHANGES IN THIS VERSION:

  • Improvement: The Easy Upgrade process should now take much less time to complete due to the implementation of a faster unzipping method used when extracting the source code files on the server from the REDCap upgrade zip file that was downloaded. (Note: This faster Easy Upgrade process may not be seen in this upgrade but in the upgrade after this one.)
  • Security Improvement for the External Module Framework
    • Cross-site Request Forgery (CSRF) protection is now available for module pages/endpoints in framework version 8. If a module has a "framework-version" value of “8” or higher in the module’s config.json file, then a valid redcap_csrf_token parameter will now be required on all POST requests (unless manually set as exempt), but will be automatically added behind the scenes in many cases.
    • NOTE: If a module is on a framework version lower than 8 (or if the framework-version is not defined in config.json), then that module does not have CSRF protection. So every module currently available in the REDCap Repo or otherwise will have to be updated in order to gain this CSRF protection feature. Thus, action is required by the module creator to add this security protection.
    • Many module pages where the REDCap page headers are included will not require any changes because the redcap_csrf_token parameter will automatically be added to static forms and jQuery post() method calls. In this case, updating "framework-version" to “8” in config.json is all that is required for adding CSRF protection.
    • The redcap_csrf_token POST parameter will need to be added to dynamically generated forms, jQuery ajax() calls, non-jQuery javascript requests, and POST requests on pages where the REDCap headers are not included. In those cases, the $module->getCSRFToken() method should be used to set the value of the redcap_csrf_token POST parameter. All POST requests made by module code should be tested before releasing a module update for this framework version.
    • For the very small number of pages where CSRF tokens should not be required (like custom APIs), pages can be omitted from CSRF checking by adding them to config.json as follows (similar fashion to no-auth-pages). See the Configuration Example module for an example. Do NOT abuse this feature by using it in cases where you should be using CSRF tokens: { "no-csrf-pages": [ "some-page" ] }
  • Bug fix: When importing a file via the File Import API method in which the file exceeds the maximum allowed file size, it would return an error message that mistakenly referenced the max upload size of the server instead of the max upload size that is manually set for File Upload fields for the project, which might be a different value than the server maximum.
  • Bug fix: If an error popup for a calculation or branching logic appears immediately when a survey page or data entry form initially loads (due to syntax errors in the branching/calculation), the stock language in the error message itself would mistakenly say "undefined" instead of actual text. However, this would not occur if the error message was displayed later on after the page had already loaded.
  • Bug fix: Certain example plugins that are included in an initial installation of REDCap would mistakenly display PHP errors if they are accessed without a "pid" parameter in their URL. (Ticket #107782)
  • Bug fix: Fixed error that prevented data from being saved in DDP Custom projects
  • Bug fix: When using the "Select instruments/events" option for a custom record status dashboard, it would mistakenly not limit the dashboard to those instruments/events. (Ticket #107785)
  • Bug fix: The "Preview Message by Record" feature on the Alerts & Notifications page would mistakenly not work when selecting a record from the drop-down list.
  • Bug fix: The horizontal line on which users/participants write their signature was mistakenly not displaying in the "add signature" dialog on forms/surveys.
  • Bug fix: The "Export Records" and “Export Reports” API method would mistakenly use the system-level default CSV delimiter (set on the User Settings page) when performing an API CSV export in "flat" format instead of correctly outputting a comma as the default CSV delimiter whenever the "csvDelimiter" parameter has not been defined in the API request. (Ticket #108082)
  • Bug fix: When copying a project or creating a new project using a project template, it would mistakenly not copy over the project-level settings below (Ticket #108151):
    • Delete a record's logging activity when deleting the record?
    • Auto-delete all Data Export Files in the File Repository that were created more than X days ago?
    • Exempt the project from 2-step login?
    • Always force 2-step login in this project for EVERY login session?
    • Double Data Entry module
    • Date Shifting De-Identification Option: Date Shift Range
    • Enable/disable the Shared Library for this project?

Version 11.1.0 (released on 2021-05-28)

CHANGES IN THIS VERSION:

  • New feature: More clinical data available via FHIR R4 endpoints for CDIS - The CDIS services Clinical Data Pull and Clinical Data Mart can now utilize version 4 (called “R4”) of the FHIR web services from their local EHR system. The new R4 endpoints include the existing data that could be pulled in earlier versions as well as the following: Adverse Events, Core Characteristics (Observation), Encounters, and Immunizations. Note that "Adverse events" are only available for "research" projects where an IRB number is specified, in which the project’s IRB number corresponds to the “Study ID” value from the EHR interface for a particular study (which is often the same as the study’s IRB number).
  • Improvements: Other FHIR/CDIS additions
    • Clinical Data Mart
      1. A new template is used for new DataMart projects when REDCap is set to use R4, including new forms for Encounters, Immunizations, Core Characteristics, Adverse Events.
      2. New option to fetch data in a background process and receive an email when completed.
      3. MRNs can be searched and fetched individually on the Clinical Data Mart page.
    • Epic institutions using the "legacy" app on the Epic App Orchard will be notified on the CDIS Control Center page with info about how to upgrade to the new R4 enabled version.
    • While on the CDIS Control Center page, changing the FHIR client ID will now automatically remove all existing FHIR access tokens stored in the backend. Note: This will not impact any data but will require each CDIS user to perform a standalone launch again or else launch REDCap via the CDP embedded window in the EHR interface before they can begin to pull data again from the EHR.
    • The FHIR statistics in the Control Center now displays CDP instant adjudication.
  • New feature: Fields that are "sql" field type (Dynamic Query - SQL field) now work in the REDCap Mobile App. In previous versions, they were not functional at all in the mobile app. Now when a project is loaded into the mobile app, any "sql" fields will be converted into static drop-down fields in the app. If new choices get dynamically added to the sql field on the server afterward, the project will need to be loaded again in the mobile app to obtain those choices for the sql field. (Ticket #107409)
  • New feature: Import/export alerts via CSV file on Alerts & Notifications page - Users may export and import alerts to the same project or another project using a CSV file. If updating an existing alert, the unique alert ID must be included in the CSV file to identify the alert that the user wishes to modify. If the unique alert ID is left blank in the CSV file being uploaded, it is assumed that the user wishes to create a new alert.
  • New feature: Reorder alerts on Alerts & Notifications page - In the options menu for any given alert, a user can select an alert to be moved to another position on the Alerts & Notifications page. When this is done, it notifies the user that moving the alert will in most cases cause the alert numbers to be renumbered for many existing alerts (since they are numbered based on their order). However, their alert title and unique alert ID will not change during this process.
  • Improvement: If using Twilio for SMS/Voice Call verification for Two Factor Authentication, there is now a new alternative phone number field on the Security & Authentication page for providing a number only to be used for the Voice Call option for 2FA. This is useful if you are in a country where a single phone number cannot be used for both voice calls and SMS. If the new field is left blank, then the existing number will be used for both SMS and voice calls, but if this new field is utilized, its value will be used for the 2FA voice call option while the first number will only be used for the 2FA SMS option. (Ticket #99563)
  • Major bug fix: If a project has randomization enabled and is using strata fields, if one or more strata fields exist on a survey instrument, and the survey containing the strata field(s) is opened after the record has been randomized, the strata fields would mistakenly not be disabled/readonly on the survey page but could be edited, which can cause major issues with a randomized project. It is expected that the strata fields should be disabled/readonly (whether on the data entry form or survey page) after the record has been randomized.
  • Change/improvement: The To-Do List page now contains a “PID” column to display the project ID of the project for which the user request belongs.
  • Change: For certain processes in which administrators perform an action that causes an email to be sent to a user (e.g., creating new Table-based users, rejecting/resetting a user's draft mode changes, and various requests from user sponsors via the Sponsor Dashboard), the email to the user would come from the admin processing the request or performing the work. Whereas many other similar tasks would send an email with the From address as the "Email Address of REDCap Administrator" value instead (which might be different from the current user). To make things more consistent now among these admin-related tasks, in all cases these emails will have their From address be the "Email Address of REDCap Administrator". (Ticket #88651)
  • Change/improvement: If the REDCap database connection needs to use a specific value for the MySQL/MariaDB "binlog_format" setting that is different from the value set in the MySQL configuration file, it can now be set on the General Configuration page to MIXED, STATEMENT, ROW, or "Use system default setting" (default). It is recommended to leave this with the default setting unless you absolutely know you need to change this and are intentional about it. This will provide greater compatibility with MySQL clusters, etc. (Ticket #107202b)
  • Change: Updates and new content for the Help & FAQ page.
  • Bug fix: When copying a project dashboard, the popup dialog might mistakenly display the name of the wrong dashboard.
  • Bug fix: When accessing an invalid link for a public project dashboard, it would mistakenly not display any error message.
  • Bug fix: When creating a custom link for a public project dashboard, it might mistakenly show a success message even when the custom link returns an error because it has already been taken.
  • Bug fix: When a project has a very large number of arms, it may prevent the Record Status Dashboard from displaying data properly, and might also prevent the background "record list cache" process from completing successfully. (Ticket #107502)
  • Bug fix: In server environments with PHP error reporting enabled, it would display a deprecation notice regarding the constructor of the PEAR Log class. (Ticket #55557b)
  • Bug fix: When unlocking an instrument using the Unlock button at the bottom of a form, any fields with the @READONLY or @READONLY-FORM action tag would mistakenly become editable. (Ticket #107549)
  • Bug fix: The <caption> HTML tag was mistakenly not allowed in field labels, survey instructions, and all places that display user-defined text on a webpage. (Ticket #107664)

Version 11.0.5 (released on 2021-05-24)

CHANGES IN THIS VERSION:

  • Major bug fix: Reverted the following change from REDCap 11.0.4 (Standard) because it cause major parts of REDCap not to work anymore for some server configurations: "REDCap now sets "SESSION binlog_format=MIXED" for every connection in MySQL to provide greater compatibility with MySQL clusters (Ticket #107202)". (Ticket #107335)
  • Bug fix: When a project is in Analysis/Cleanup mode, and a user wishes to set the project data to be read-only/locked, the popup dialog for doing this mistakenly has the wrong text for the dialog buttons.
  • Bug fix: Most of the stock language used for displaying errors for calculations and branching logic were mistakenly not abstracted and therefore were not translatable into a non-English language for a project. (Ticket #106976)
  • Bug fix: When using a Project XML file to create a project, it would mistakenly display an error that the record ID field could not be found in the XML file, which is not true. Bug emerged in REDCap 11.0.4.

Version 11.0.4 (released on 2021-05-21)

CHANGES IN THIS VERSION:

  • Change: If the setting "Allow normal users to add or modify events and arms on the Define My Events page for longitudinal projects while in production status?" on the User Settings page is set to "Yes", then in any longitudinal projects that are in production status, normal users will no longer be able to modify the name of an existing arm or event. Since renaming an event or arm can have drastic downstream consequences, such as if the unique event/arm name is used in any calculations, branching logic, report filters, or other conditional logic throughout the project, users are now prevented from renaming events and arms in this case as an extra safety net. If a user attempts to rename an event or arm, it will now display an informational message letting them know that they should contact an administrator to complete that task for them.
  • Bug fix: When using the Survey Queue in a longitudinal project, there are some scenarios where the queue might mistakenly not process the conditional logic correctly for a survey in the queue, thus causing it to return an empty queue or omit some surveys from being displayed in the queue. (Ticket #106801)
  • Bug fix: PHP 8 compatibility error when viewing some custom record status dashboards. (Ticket #107055)
  • Bug fix: When using the Data Resolution Workflow in which a normal user is attempting to delete a file attachment that has been uploaded to an opened data query, it would mistakenly display an error message every time. Instead it should display a message letting them know that only administrators are allowed to delete files attached to data queries. (Ticket #106984)
  • Bug fix: PHP 8 compatibility error when using Two Factor Authentication. (Ticket #103721)
  • Change: REDCap now sets "SESSION binlog_format=MIXED" for every connection in MySQL to provide greater compatibility with MySQL clusters. (Ticket #107202)
  • Bug fix: PHP 8 compatibility error when using the DAG Switcher. (Ticket #107209)
  • Bug fix: PHP 8 compatibility error that occurs in some specific cases when viewing the Record Status Dashboard. (Ticket #107225)
  • Bug fix: When a project contains repeating events in which a report has filter logic to filter out specific repeating instances (e.g., [current-instance] <> "" and [current-instance] = [first-instance]), the report might mistakenly display no results or incorrect results when there is actually data to display. This does not affect repeating instruments but only repeating events.
  • Bug fix: When a radio button field that is part of a matrix is embedded on a data entry form or survey page, the radio button's "reset" link would mistakenly not get embedded along with its associated field. Thus there would be no way to reset a matrix radio field that is embedded. Now the "reset" link appropriately gets moved to be immediately below its associated embedded radio field.
  • Bug fix: To prevent Microsoft Outlook Safe Links from submitting surveys and junk data on its own, REDCap survey pages now block all POST requests that originate via the IP address range 52.147.217.*, in which it immediately returns an error message. This is in addition to a recent fix that protected surveys from Safe Links coming from another IP range (40.94.*.*).
  • Bug fix: When REDCap is sending a large amount of email notifications from REDCap Messenger, such as when there is a General Notification or System Notification, if the cron job process for sending the emails takes too long, it may mistakenly get run several times, resulting in users receiving the same email notification several times. (Ticket #107208)

Version 11.0.3 (released on 2021-05-14)

CHANGES IN THIS VERSION:

  • Major bug fix: When using an Adaptive or Auto-Scoring instrument downloaded from the REDCap Shared Library, in which that survey was set to use "Enhanced radios and checkboxes" via the Survey Settings page, the survey would not function and would not allow participants to submit their responses unless the survey was reverted to no longer using "Enhanced radios and checkboxes".
  • Bug fix: The Survey Link Lookup page in the Control Center would fail when using a new survey link that has a 16 character length hash. (Ticket #106907)
  • Bug fix: When a survey participant is taking a specific Adaptive or Auto-Scoring instrument (such as "NIH TB Hearing Handicap Age 65+") downloaded from the REDCap Shared Library that contains an initial descriptive text field (i.e., it has no choices to choose from), the survey would not function and would not allow participants to submit their responses. Note: This only affects 3 or 4 total Adaptive or Auto-Scoring instruments in the entire REDCap Shared Library.
  • Bug fix: If a report contains filter logic containing around 900 or more field variables, the report might mistakenly return 0 results instead of the appropriate results. REDCap cannot parse more than 900 or so field variables in logic due to a limitation in PHP. If more than 900 field variables are used in a report's filter logic and it causes PHP to crash, REDCap will provide a helpful error message in this case to inform the user that there is either a syntax error in the filter logic or that it is too long and needs to be shortened. (Ticket #106834)

Version 11.0.2 (released on 2021-05-14)

CHANGES IN THIS VERSION:

  • Change/improvement: A new database configuration check was added to the Configuration Check page that looks at the value of the optimizer_switch's "rowid_filter" setting to make sure that it is set to OFF in the MySQL configuration file. Having that setting turned on can cause certain issues when running REDCap. (Ticket #103092)
  • Change/improvement: Added four new redcap_log_event database tables for new projects to improve server performance when REDCap is querying logging data for a project. Note: This will not improve performance when querying the logging records of existing projects but only applies to projects created after upgrading to v11.0.2 or higher.
  • Change: The alphanumeric hash that exists in all survey links has been increased in length from 10 to 16. Any new survey links created will have a 16 character length hash.
  • Bug fix: If a data export takes a long time and the user is away from the computer so long that the auto-logout dialog displays on the page, the auto-logout dialog would mistakenly be displayed underneath the "Exporting data" popup, thus preventing the user from seeing it and preventing the auto-logout process from occurring. (Ticket #106545)
  • Bug fix: When not using record auto-numbering in a project while viewing the Add/Edit Records page or Record Status Dashboard, if a record name is hand-entered in a different case than in which it was saved (e.g. "abc" vs "ABC"), it might cause issues on the Record Home page, such as not displaying Custom Labels for Repeating Instruments. (Ticket #106559)
  • Bug fix: When viewing a custom Record Status Dashboard in a project that has Double Data Entry enabled, the custom dashboard's "sort by" setting (if utilized) would mistakenly not sort the dashboard's records correctly for any user that has the DDE #1 or #2 designation. (Ticket #105030)
  • Bug fix: When REDCap is reporting its general stats to the consortium, it would mistakenly fail to send them in some cases where the URL ended up being more than 2000 characters long.
  • Bug fix: A survey theme's background color might mistakenly not get applied to a radio/checkbox matrix on the survey page, thus displaying part of the matrix in the wrong color. Bug emerged in the previous version. (Ticket #106712)
  • Bug fix: If the system-level setting for setting Project Dashboards as "public" is set to "Yes, but an administrator must approve the request", that feature would not work correctly and would mistakenly allow normal users to set their dashboards as public without the approval process. (Ticket #106813)
  • Bug fix: If the system-level setting for setting Project Dashboards as "public" is set to "Yes, but an administrator must approve the request", if a normal user clicks the "Copy" button to copy a dashboard that has been set as public, it would mistakenly set the newly created dashboard as public also. In this situation, it should set it not to be public, and a user would need to edit the newly created dashboard and click the "Set as public" setting to put in a new request for an admin to approve this new dashboard to be public. (Ticket #106813b)
  • Bug fix: Clicking the "Enable color-blind accessibility" on public Project Dashboards would fail to work. (Ticket #106901)
  • Bug fix: The chart legend was mistakenly not being displayed for the Smart Charts scatter-plot, line-chart, and bar-chart when using a grouping field for them. (Ticket #106543)
  • Bug fix: The setting "Designate an email field for communications (including survey invitations and alerts)" on the Project Setup page would mistakenly be disabled and not usable unless the project has the setting "use surveys in this project?" enabled, which is not correct since the designated email setting can be used for more than just surveys.

Version 11.0.1 (released on 2021-05-07)

CHANGES IN THIS VERSION:

  • Improvement: The Smart Charts [pie-chart] and [donut-chart] now display the percentage value on top of each colored slice in the chart.
  • Improvement: On the Calendar page when viewing the "View/Edit Calendar Event" popup for a calendar event that is attached to a record, the popup now displays a "View Record Home Page" link next to the record name to allow the user to easily navigate to the record.
  • Major bug fix: Alerts & Notifications that are set to be sent via SMS or Voice Call would mistakenly not get sent whenever the alert is triggered. Bug emerged in REDCap 10.6.18 LTS and 11.0.0 Standard. (Ticket #106260)
  • Bug fix: When viewing the public URL of a project dashboard, the dashboard's project_id would mistakenly not get passed to the redcap_every_page_before_render hook.
  • Bug fix: The wrong language is mistakenly used in the Smart Variable documentation for the ":no-export-link" Smart Table parameter. (Ticket #106023)
  • Bug fix: When using the wizard on the Project Dashboard creation page, it might mistakenly insert the unique report name for the wrong report into Step 4 when selecting an option in the report drop-down in Step 3. (Ticket #106013)
  • Bug fix: Smart Charts that are "bar-chart" type with the ":bar-vertical" parameter would mistakenly have the field label displayed on the Y-axis when instead it should be located on the X-axis for vertical display. (Ticket #106017)
  • Bug fix: On surveys that have Enhanced Radio & Checkboxes enabled, in which radio fields are embedded inside checkbox labels or checkboxes are embedded inside radio labels (or other variations of these), some of the options might mistakenly not be selected after clicking on them. (Ticket #105880)
  • Bug fix: When using the ":inline" piping parameter on a File Upload field that has a PDF file uploaded to it, the PDF would fail to successfully embed on the page and would mistakenly display a bunch of HTML in its place. (Ticket #105462)
  • Bug fix: The External Service Check for the NML Field Bank service was mistakenly missing on the Configuration Check page. (Ticket #106086)
  • Bug fix: When using the Designated Phone Field with the Twilio telephony services for surveys, the participant's record ID might mistakenly not be displayed on the Survey Invitation Log in certain cases. (Ticket #49955)
  • Bug fix: When creating a new Table-based authentication user on the "Create single user" page in the Control Center, it is possible to create a user without entering a value for their username. That should not be allowed. (Ticket #106103)
  • Bug fix: Smart Charts that are "bar-chart" type and use a second field for grouping might mistakenly display the wrong counts in the chart if there exist any blank values for the grouping field, or it might mismatch the counts for the wrong grouping category in certain scenarios. (Ticket #106017)
  • Bug fix: When using the "Move to Production status" public survey for "Custom Surveys for Project Status Transitions" when users are not allowed to move projects to production on their own but must request an administrator do so on their behalf, if the user failed to select the radio button asking "Keep existing data or delete?" in the dialog pop-up and then they completed the public survey afterward, the "Working..." progress message would appear and never go away, thus preventing the request from being submitted correctly. (Ticket #106173)
  • Bug fix: When the datediff cron job is running for Alerts & Notifications that contain datediff+today/now in their conditional logic, the cron job might mistakenly take a long time to complete (or might time out) because the record list cache has not been created yet for the projects for which the cron job is processing. To prevent the cron job from taking too long and possibly timing out, it will attempt to build the record list cache in real time for each project it is processing. This may mean that initial attempts of the cron job may still take a long time, but later instances of the cron should be much faster.
  • Bug fix: When the datediff cron job is running for Automated Survey Invitations that contain datediff+today/now in their conditional logic, the cron job might mistakenly take a long time to complete (or might time out) because the record list cache has not been created yet for the projects for which the cron job is processing. To prevent the cron job from taking too long and possibly timing out, it will attempt to build the record list cache in real time for each project it is processing. This may mean that initial attempts of the cron job may still take a long time, but later instances of the cron should be much faster.
  • Change: The REDCap cron job now automatically resets a project's record list cache if the project has had some activity in the past week and if its cache is more than 5 days old. In previous versions, it would only reset the cache if the project had some activity in the past week when its cache was more than 3 days old. This was changed because the cache is more stable in recent versions and doesn't require being reset quite as often.
  • Bug fix: When using the survey setting "Time Limit for Survey Completion" in which a user clicks the clock icon for a participant in the Participant List in order to modify their Link Expiration time, clicking the "Expire it now" button in the dialog would mistakenly fail to do anything because of a JavaScript error. (Ticket #106167)
  • Bug fix: When a text field is embedded inside a checkbox field, clicking inside the text box mistakenly causes its parent checkbox to become unchecked. (Ticket #105001b)
  • Bug fix: When launching the Clinical Data Pull embedded window inside an EHR user interface, it might mistakenly say that the current web browser is not compatible.
  • Bug fix: In some cases, upgrading to REDCap 11.0.0 mistakenly did not load the new project template that illustrates Project Dashboards, etc. If that project template is missing, it will automatically be added when upgrading to 11.0.1. (Ticket #105976)
  • Bug fix: If a field is using the @CALCDATE action tag that references a field variable as the second parameter, if that second parameter field has a blank value, the @CALCDATE calculation might return an incorrect value when instead it should be returning a blank value. This only occurs on the server-side (PHP) processing of @CALCDATE when a form/survey is being saved, and does not occur with the client-side (JavaScript) version of the function. This means that while the value looks blank when viewing a data entry form or survey page, the incorrect value would be seen on reports, data exports, or wherever the @CALCDATE field is being piped. (Ticket #106243)
  • Bug fix: If using a survey-level designated email field, in certain cases the Participant Email displayed in the Survey Invitation Log might mistakenly be blank or might display the project-level designated email field instead. Bug emerged in REDCap 10.6.18 LTS and 11.0.0 Standard.
  • Bug fix: When a survey invitation is sent to a participant via a Twilio SMS message, viewing the message afterward in the Survey Invitation Log would mistakenly display extra text (e.g., "-- To begin the survey, visit...") appended to the message that did not actually get sent to the participant in the SMS message. Additionally, when viewing an SMS message in the Survey Invitation Log, it would mistakenly display any URLs in the message as clickable links instead of correctly displaying them as non-clickable URLs, which is more accurate to how they are seen by the recipient. (Ticket #104997)
  • Bug fix: When a project has been set up with Automated Survey Invitations and is using the Designated Email Field, the Public Survey Link page might mistakenly display the red box saying "WARNING: The designated email field does not exist on the first survey", which might not be true if a survey has been orphaned (created in the past but then later removed) in which the survey had one or more ASI's set up for it.
  • Bug fix: Dots/periods have been allowed in checkbox codings since REDCap 9.9.0, but the data dictionary import process would still mistakenly display an error message saying that this is not allowed, which is not correct. (Ticket #106375)
  • Bug fix: When a project is using Twilio for sending survey invitations, and an Automated Survey Invitation is set to "use participant's preference" for the invitation type/delivery method, then any participant whose delivery preference is "email" would mistakenly receive the expected email body text but with extra text appended to it (e.g. "Please take this survey. You may open the survey..."). In many cases, this means that the email body is duplicated in the email, which is not desirable. (Ticket #102953)
  • Bug fix: When editing a field in the Online Designer and using different background colors or text colors in tables added via the rich text editor, a survey theme's color might mistakenly override a table row's or table cell's background/text color when viewing the field on a survey page. (Ticket #106340)
  • Change/improvement: The green highlight background color will no longer appear when a user/participant puts focus on or clicks on a field that is embedded inside another field on a data entry form or survey. From now on, it will only highlight the field with green for non-embedded fields. This should improve the user experience when many fields are embedded in the same table row on the page in which the green highlight would highlight all of them (sometimes making the entire page green), which is often not desirable.
  • Bug fix: For certain projects, unique report names were mistakenly not being generated for some or all reports in the project. (Ticket #106366)

Version 11.0.0 (released on 2021-04-30)

CHANGES IN THIS VERSION:

  • New feature: Project Dashboards
    • INTRO: Project Dashboards are pages with dynamic content that can be added to a project. They can utilize special Smart Variables called Smart Functions, Smart Tables, and Smart Charts (described below) that can perform aggregate mathematical functions, display tables of descriptive statistics, and render various types of charts, respectively. User access privileges are customizable for each dashboard, and anyone with Project Design privileges can create and edit them. A Wizard is provided on the Project Dashboard creation page to help users easily construct the syntax for Smart Functions, Smart Tables, or Smart Charts, and a basic list of helpful examples is also included. Example dashboard: https://redcap.link/dash1
    • Setting project dashboards as “public”
      1. If enabled at the system-level (described in detail below), any project dashboard can be enabled as “public”, which means it can be accessed at a unique URL that does not require any authentication. Making a dashboard public is useful if you wish for people to view it without having to be REDCap users or log into REDCap. Public dashboards are simply standalone pages that can be viewed by anyone with a link to them.
      2. Users can opt to create a custom/short url (via the https://redcap.link service) for any project dashboard that is enabled as “public”.
      3. System-level setting to allow/disallow public dashboards (on the User Settings page in the Control Center) - By default, normal users will be able to set any project dashboard as public. If you do not want users to do this or even know about this feature, you can completely disable it on the User Settings page. Alternatively, it can be set to “Allow public dashboards with admin approval only”. If set to allow public dashboards after approval by an admin, the admin will receive the request from the user via the To-Do List page (and via email, if the email notification setting is enabled on the To-Do List page), and after the admin approves the request, the user will receive an email regarding the response to their request.
    • Setting to control data privacy on public dashboards and other public pages
      1. The User Settings page in the Control Center has a setting to define the “Minimum number of data points required to display data for any Smart Charts, Smart Tables, and Smart Functions on a *public* project dashboard, survey queue, or survey page”. By default, it is set to a value of “11”. While only aggregate data is displayed in Smart Charts, Smart Tables, and Smart Functions, if any of these utilize very few data values, it might pose a threat to an individual’s data privacy if these are being displayed on *public* dashboards and other public pages (i.e., where authentication is not used).
      2. If someone is viewing a public page that has Smart Charts, Smart Tables, and Smart Functions that utilize data that does not meet the minimum data point requirement, instead of displaying the chart/table/number on the page, it will instead display a notice saying “[INSUFFICIENT AMOUNT OF DATA FOR DISPLAY]” with a pop-up note with details about the minimum data requirements.
      3. Project-level override: While this behavior is controlled by a system-level setting, the system-level setting can be modified by an administrator via a project-level override for any given project on the “Edit A Project’s Settings” page.
      4. Note: This setting does not get used when viewing project dashboards inside a project (i.e., at a non-public URL).
    • PDF export: Each project dashboard can be exported as a one-page PDF file.
    • Dashboard cache: To prevent server performance degradation, each project dashboard will have its content cached (stored temporarily) automatically for up to 10 minutes at a time rather than generating its content in real time every time the dashboard is loaded. It will note at the top right corner of the dashboard page when the dashboard content was last cached. If a user is viewing the dashboard inside a project (i.e., not via a public dashboard link), they have the option at the top right to “Refresh” the dashboard at will, which will refresh/generate its content in real time. Note: The refresh option will only be displayed on the page when the dashboard content is at least 30-seconds old.
  • New feature: Smart Functions
    • Smart Functions are aggregate mathematical functions that are utilized as Smart Variables. The following Smart Functions exist: [aggregate-min], [aggregate-max], [aggregate-mean], [aggregate-median], [aggregate-sum], [aggregate-count], [aggregate-stdev], and [aggregate-unique]. Each represents the mathematical functions minimum, maximum, mean/average, media, sum, count, standard deviation, and unique count, respectively. Each must have at least one field attached to it that follows a colon - e.g., [aggregate-mean:age]. Multiple fields may be used in each one, which will perform the function over all the data values of all the fields. By default, the functions will utilize all data values for all records in the project. To limit the data values being utilized to a subset of the total project data, see the Smart Variable documentation on how to apply filters, such as attached unique report names, DAGs, and other parameters
    • Note: When using [aggregate-count:record_id], in which “record_id” in this example represents whatever the variable of the Record ID field is, it performs a special count that does not literally count the number of data values but instead returns a count of the total number of records in the project. This is a quick way to display the total record count of the project.
    • Smart Functions can be used anywhere in a project where piping is allowed, and can even be used inside calculations, branching logic, and other conditional logic (report filters, alert conditions, etc.).
  • New feature: Smart Tables
    • Smart Tables are tables displaying aggregate descriptive statistics in which the results of any or all of the following stats functions can be displayed for one or more fields: minimum, maximum, mean/average, media, sum, count, standard deviation, count of missing values, and count of unique values.
    • Smart Tables are represented with the Smart Variable [stats-table], which accepts as a parameter the variable names (comma delimited) of all the fields to be displayed as separate rows in the table. There is no limit to the number of fields that can be used. For example, [stats-table:field1,field2,field3].
    • By default, all available columns will be displayed in the table and are as follows: Count, Missing, Unique, Min, Max, Mean, Median, StDev, Sum. To display only a subset of the columns, you may provide any of the following designations (comma-separated) that represent a specific column in the table: count, missing, unique, min, max, mean, median, stdev, sum. For example, [stats-table:field1,field2,field3:mean,max].
    • By default, each stats table will have an "Export table (CSV)" link displayed immediately below it to allow users to download the table as a CSV file. But if users wish to hide the export link, they can simply attach “:no-export-link” to the Smart Variable, which will cause the link not to be displayed. For example, [stats-table:field1,field2,field3:no-export-link].
    • Smart Tables can be used anywhere in a project where piping is allowed.
  • New feature: Smart Charts
    • Smart Charts are various aggregate plots and charts utilized as different Smart Variables. The following plots are available for use: bar charts, pie charts, donut charts, scatter plots, and line charts. These are all represented by the following Smart Variables, respectively: [bar-chart], [pie-chart], [donut-chart], [scatter-plot], and [line-chart]. These Smart Variables accept one or more field names and also other optional parameters, as described below for each.
    • Bar charts - Displays a bar chart for a single multiple choice field. It can optionally perform color grouping if a second field (multiple choice only) is provided. The fields must be comma-separated. For example, [bar-chart:field,grouping-field:parameters]. Bar charts have optional parameters that can be applied to alter their appearance. By appending the parameter “:bar-stacked” when two fields are used, the bars in the chart will appear stacked on top of each other rather than side by side. By default, bar charts are displayed with their bars going horizontally, but by appending the parameter “:bar-vertical”, the orientation will be changed to display vertically instead.
    • Pie charts - Displays a pie chart for a single multiple choice field. For example, [pie-chart:field:parameters].
    • Donut charts - Displays a donut chart for a single multiple choice field.Note: A donut chart is essentially the same as a pie chart but with the center removed. For example, [donut-chart:field:parameters].
    • Scatter plots - Displays a scatter plot of one number/date/datetime field for the x-axis and a second field (number field only) for the y-axis. (If a second field is not provided, a random value will be assigned for the y-axis.) It can optionally perform color grouping if a third field (multiple choice only) is provided. All fields must be comma-separated. For example, [scatter-plot:x-axis-field,y-axis-field,grouping-field:parameters].
    • Line charts - Displays a line chart of one number/date/datetime field for the x-axis and a second field (number field only) for the y-axis. It can optionally perform color grouping if a third field (multiple choice only) is provided. All fields must be comma-separated. Note: A line chart is essentially the same as a scatter plot except with dots connected with a line. For example, [line-chart:x-axis-field,y-axis-field,grouping-field:parameters].
    • Color blindness accessibility: Pie charts and donut charts have the ability for the user to enable color blindness accessibility, via a gray link displayed immediately below each chart, in which it overlays different patterns onto the colored pieces of the chart to make each color more distinct for many types of color blindness. This option to enable color blindness accessibility is stored in a secure cookie on the user’s device and will be used to remember this choice anytime a pie/donut chart is displayed on any page for any REDCap project for that REDCap server.
    • The colors displayed in each chart/plot are preset and are not modifiable.
    • Smart Charts can be used anywhere in a project where piping is allowed *except* for inside the body of outgoing emails.
  • Optional parameters for Smart Functions, Smart Tables, and Smart Charts
    • There exist various optional parameters that can be used with Smart Functions, Smart Tables, and Smart Charts to either filter the data used in them (e.g., via a unique report name) or to change their appearance (e.g., bar-vertical). See the descriptions for each below, which are all documented in the Smart Variables documentation.
    • :R-XXXXXXXXXX Unique Report Name - For Aggregate Functions, Charts, and Tables, filter the data being used by appending a Unique Report Name. Next to each report on the 'My Reports & Exports' page is its unique report name, which has 'R-' following by alphanumeric characters. By default, all Aggregate Functions, Charts, and Tables will use the values of all records in the project, but if a unique report name is appended to any of them, only data from that specific report will be used. Using a report as a surrogate to filter data is a very useful technique of performing complex filtering logic for Aggregate Functions, Charts, and Tables.
    • :record-name "record-name" - For Aggregate Functions, Charts, and Tables, filter the data being used to the *current record* by using the literal value 'record-name'. Note: This parameter will only work in a context where a single record is being viewed/accessed, such as on a survey page, data entry form, etc. This parameter can be used with any of the other parameters except unique report names.
    • :event-name "event-name" - For Aggregate Functions, Charts, and Tables, filter the data being used to the *current event* (longitudinal projects only) by using the literal value 'event-name'. Note: This parameter will only work in a context where a single record/event is being viewed/accessed, such as on a survey page, data entry form, etc. This parameter can be used with any of the other parameters except unique report names.
    • :unique-event-names Unique Event Names - For Aggregate Functions, Charts, and Tables, filter the data being used to specific events (longitudinal projects only) by providing an event's unique event name (found on the Define My Events page). You may use one or more unique event names (comma-separated). Note: This parameter can be used with any of the other parameters except unique report names.
    • :user-dag-name "user-dag-name" - For Aggregate Functions, Charts, and Tables, filter the data being used to the records assigned to the *current user's Data Access Group* by using the literal value 'user-dag-name'. Note: This parameter will only work in a context where an authenticated user belongs to a project and has been assigned to a DAG in the project (this excludes survey pages and public project dashboards). This parameter can be used with any of the other parameters except unique report names.
    • :unique-dag-names Unique DAG Names - For Aggregate Functions, Charts, and Tables, filter the data being used to the records assigned to specific Data Access Groups by providing a DAG's unique group name (found on the Data Access Groups page). You may use one or more unique DAG names (comma-separated). Note: This parameter can be used with any of the other parameters except unique report names.
    • :bar-vertical "bar-vertical" - Display a bar chart with the bars going vertically instead of horizontally (the default) by using the literal value 'bar-vertical'. Note: This parameter can be used with any of the other parameters.
    • :bar-stacked "bar-stacked" - Only for bar charts using two fields, display the bar chart with the bars stacked on top of one another for each choice. Whereas the default view is that the bars of each field are displayed side by side to show the color grouping. To enable this, use the literal value 'bar-stacked'. Note: This parameter can be used with any of the other parameters.
    • :no-export-link "bar-stacked" - Only for bar charts using two fields, display the bar chart with the bars stacked on top of one another for each choice. Whereas the default view is that the bars of each field are displayed side by side to show the color grouping. To enable this, use the literal value 'bar-stacked'. Note: This parameter can be used with any of the other parameters.
  • NOTE: Using Smart Functions/Tables/Charts elsewhere in a project - While project dashboards are an excellent place to use Smart Functions, Smart Tables, and Smart Charts, it is important to know that Smart Functions/Tables/Charts can actually be used *almost anywhere* in a project, such as on data entry forms, on survey pages, and in report instructions (to name a few). You can use Smart Functions/Tables/Charts anywhere that piping can be used. Click the green "Smart Variables" button on the Project Setup page to learn more about them. Note: The only place that Smart Charts cannot be used is inside the body of outgoing emails.
  • NOTE: Smart Functions/Tables/Charts do not yet work in the REDCap Mobile App; however, it is planned that they eventually will (to a certain degree).
  • NOTE regarding permissions for Smart Functions/Tables/Charts:
    • DAG permissions (i.e., filtering out records not assigned to the current user’s DAG) are NOT applied by default to Smart Charts/Tables/Functions but are only applied when the Smart Chart/Table/Function utilizes a unique report name as a parameter (thus mimicking the natural DAG-filtering behavior of reports themselves) OR when the Smart Chart/Table/Function utilizes the “user-dag-name” parameter. This means that if a user is assigned to a DAG and views a project dashboard with the Smart Chart [scatter-plot:weight], for example, the plot will display data for ALL records in the project and not just the user’s DAG. To limit the plot to just data in the user’s DAG, it could be changed to [scatter-plot:weight:user-dag-name] in this case.
    • Smart Charts/Tables/Functions that utilize a unique report name as a parameter for data filtering purposes will still function and display normally even if the user does not have explicit access to view that specific report referenced as a parameter.
  • New feature: CSV Delimiter as a user-level preference - The My Profile page now has a new user preference to allow a user to set their own preferred CSV delimiter (e.g., comma, semi-colon) that will be used as the delimiter character in all CSV file downloads throughout REDCap, such as data dictionary import/export, event import/export, user rights import/export, etc. This setting is not used by data imports and exports because those already have a way to specify the CSV delimiter manually. The system-level default value for this user preference can be set on the User Settings page in the Control Center, in which all new users created afterward will have their user-level preference set with this system-level default value. To modify all existing users’ preference after upgrading (if your users would not want a comma delimiter), it will require running an “update” query in the database, such as this: UPDATE redcap_user_information SET `csv_delimiter` = ';' ;
  • Improvement: Report “description” text now utilizes the rich text editor. Additionally, users may perform piping into a report’s description, such as project-level Smart Variables, including Smart Charts, Smart Functions, and Smart Tables.
  • Improvement: New option for Project Templates called “copy records”, which will copy any existing records in the template to the new project created from the template. This option can be enabled for any new or existing Project Templates.
  • Improvement: A new Project Template was added to illustrate new features in 11.0+. The new template is named “Project Dashboards, Smart Functions, Smart Tables, & Smart Charts”.
  • Change/improvement: The Logic Editor popup is now utilized when editing the "Action Tags/Field Annotation" text box in the Online Designer. (Ticket #103007)
  • Bug fix: When exporting data via the Export Records API method as type=eav, it would mistakenly fail to include the value of the redcap_event_name field (and would export it as blank/null) if the project is longitudinal and the exported data format is XML or JSON. Bug emerged in REDCap 10.6.16 (LTS) and 10.9.3 (Standard). (Ticket #105673)
  • Bug fix: When attempting to use the Easy Upgrade on an AWS Quick Start deployment of REDCap, the upgrade process may fail due to "\r" characters in the upgrade shell script. (Ticket #103939)
  • Bug fix: When creating a project via a Super API Token, the API call would fail due to a fatal PHP error, thus preventing the project from being created. Bug emerged in REDCap 10.6.16 (LTS) and 10.9.3 (Standard).
  • Bug fix: When importing data (via Data Import Tool, API, or REDCap::saveData), all records would mistakenly have spaces trimmed off the beginning and end of every value being imported. This would prevent the data from being imported as-is. It now no longer trims whitespace off of the beginning and end of data values during data imports.
  • Bug fix: On certain occasions, an alert that is triggered may mistakenly send an email to the "Email to send email-failure errors" recipient multiple times (instead of just once) or may send it to that recipient when it is not supposed to.
  • Bug fix: A field using the @CALCTEXT action tag would mistakenly return a blank value whenever it should be returning a value of 0. (Ticket #105128)
  • Bug fix: When using the concat() function in a @CALCTEXT field, the calculation might mistakenly fail if certain characters such as "+" are utilized inside the concat() function. (Ticket #105445)
  • Bug fix: When a text box field is embedded inside a checkbox field on a survey that is using Enhanced Checkbox/Radio Fields, the checkbox would be unable to be selected. (Ticket #97954)
  • Bug fix: When a checkbox field is embedded inside a checkbox field, it would mistakenly check the first sub-checkbox whenever checking the parent checkbox. (Ticket #97954)
  • Bug fix: When a radio field is embedded inside a checkbox field, several things would function incorrectly when clicking on the labels of the radio fields or their "reset" link. (Ticket #105001)

Version 10.9.4 (released on 2021-04-22)

CHANGES IN THIS VERSION:

  • Minor security fix: A Cross-site Scripting (XSS) vulnerability and Cross-site Request Forgery (CSRF) vulnerability were discovered where a malicious user could potentially exploit them on two specific Control Center pages.
  • Bug fix: When upgrading to REDCap version 10.9.2 from a version lower than 10.5.0, the REDCap Messenger system notification that announces the @SETVALUE action tag was mistakenly still referring to it by its previous name (@PREFILL).
  • Bug fix: The description of the @SETVALUE action tag mistakenly mentioned that it makes the field read-only, which is incorrect. (Ticket #105072)
  • Bug fix: When a @CALCTEXT field is used in a longitudinal project, in which its value gets set but all other fields on its instrument do not have a value saved, a red form status icon would mistakenly be displayed for its instrument on the Record Home page and Record Status Dashboard. The status icon should instead remain gray in this case even when calc fields and @CALCTEXT fields have a value. (Ticket #105061)
  • Bug fix: PHP 8 compatibility error in LDAP authentication code. (Ticket #105100)
  • Bug fix: If questions are being prepopulated on a survey using the @DEFAULT action tag, in which those fields are also being piped to other places on that same survey page, then the piping would mistakenly not occur when the survey page loads but only after one of the piped fields' values are modified on the page. Bug emerged in REDCap 10.9.3. (Ticket #105220)
  • Bug fix: If a record is deleted via the Delete Record API method, and then another record is created later having the same record name, the Data History popup for a given field would mistakenly list the logged events from the previously-existing record when instead it should not. (Ticket #105144)
  • Bug fix: If using the :inline piping parameter for a File Upload field when uploading an image file to the field while the piping location exists on the same page, deleting the image from the File Upload field via the "Remove file" link would mistakenly not remove the inline image that is piped on the page until the page is reloaded. (Ticket #105106)
  • Bug fix: If submitting a public survey, and the record ID field is referenced in the equation of a calculated field located on another instrument, the calculated field's value would mistakenly not get saved. (Ticket #105178)
  • Bug fix: If using Twilio telephony services for surveys, in which the "Control each participant's invitation preference using a multiple choice field" option is enabled and references a field that exists on an instrument that is not enabled as a survey, then modifying that field's value on a survey/form would mistakenly not change the participant's invitation preference as reflected in the Participant List. (Ticket #104907)
  • Bug fix: When using Twilio telephony services in which multiple projects are using the same Twilio Account SID but have different Twilio phone numbers, some of the Twilio logs on the Twilio website might mistakenly not get erased as they should (REDCap automatically deletes all Twilio logs after each SMS or phone call for privacy purposes).
  • Bug fix: If a repeating survey has one repeating instance of the survey that has been locked at the instrument level, then if another repeating instance (that is not locked) of that same survey is opened, it would mistakenly display an error to the participant saying that the response has been locked, which is not true.
  • Bug fix: When using the Data Resolution Workflow and viewing an opened query that has not yet been assigned to a user, it would mistakenly not allow you to assign the query to a user. (Ticket #105205)

Version 10.9.3 (released on 2021-04-16)

CHANGES IN THIS VERSION:

  • New authentication method: Azure Active Directory OAuth2 - REDCap now includes a new authentication method to allow users to authenticate via Microsoft's Azure AD. This will be especially useful for institutions that are deploying REDCap on the Azure cloud platform. Thanks for Neal Blackburn and Matthew Peterson at Oregon State for their collaboration to help make this new addition possible. For more info on Azure AD and how to set up a client application for REDCap authentication, see https://redcap.link/azuread.
  • Improvement: When viewing files in the File Repository that are archived from a data export, it now displays the data export details (as seen on the Logging page) for each export listed in the table on the "Data Export Files" tab. This provides more context regarding the contents of the data in the archived export files.
  • Change: The @PREFILL action tag has been renamed to @SETVALUE, which more accurately captures how it behaves. Some confusion had occurred regarding this action tag's behavior simply because of its name. This change to the name is backward compatible so that projects already using @PREFILL will still work with its legacy counterpart (i.e., @PREFILL and @SETVALUE will work equivalently), but @SETVALUE will be the preferred name going forward. The description of the @SETVALUE action tag in the Action Tags documentation notes this name change.
  • Change: Any fields using the @PREFILL/@SETVALUE action tag will no longer be read-only/disabled on survey pages and data entry forms but will be editable. Some users had complained of the read-only attribute as being too restrictive and inflexible, thus preventing some valid use cases. If users wish to make the field read-only, it is recommended they simply add the @READONLY action tag as a means of maintaining the previous read-only behavior.
  • Change: In many places in the REDCap code where MD5 hashing is performed on non-security-related things, the MD5 function has been replaced with the SHA1 function. (Note: MD5 is never used on any security-related code in REDCap.)
  • Bug fix: When adding a user to a project by assigning them to a role, if the user's username contains spaces or apostrophes, the process might break due to a JavaScript error, thus preventing the user from being added to the project and role. Bug emerged in REDCap 10.9.2.
  • Bug fix: When viewing a "PDF Export with data" logged event on a project's Logging page, it might mistakenly display "(Event #)" next to the record name when the project is not longitudinal. It should only display the event for that logged event in longitudinal projects. Bug emerged in REDCap 10.9.2.
  • Bug fix: When generating System Notifications for REDCap Messenger during a REDCap upgrade, it was mistakenly using the PHP constant NOW instead of the MySQL function NOW() in a specific query. For that specific process, it now uses the MySQL function NOW() only when hosting REDCap on Google App Engine, otherwise it uses the PHP constant NOW, as it did in previous versions. Bug emerged in 10.9.2.
  • Bug fix: When a field with the @PREFILL action tag is being piped somewhere on the same page, the field would mistakenly not have its value piped successfully when the page is loaded. (Ticket #104613)
  • Bug fix: It was impossible to disable the "Auto logout time" setting (i.e., by setting its value to "0") on the Security & Authentication page in the Control Center because it would prompt the admin to enter a minimum value of "3". (Ticket #104680)
  • Bug fix: If a File Upload field is embedded inside a checkbox choice label, in which the File Upload field has branching logic so that it is only displayed when the checkbox next to it is checked, the upload or download process for the File Upload field would mistakenly cause the checkbox to be checked/unchecked, thus causing the issue of hiding the File Upload field while trying to upload/download its file. (Ticket #104664)
  • Bug fix: When a user attempts to assign a new user to a DAG and user role at the same time on the User Rights page, the pop-up for selecting the DAG and role would mistakenly close immediately after selecting an item from one of the drop-downs. Bug emerged in REDCap 10.9.2 Standard. (Ticket #104655)
  • Bug fix: In the "Compose Survey Invitations" dialog on the Participants List page, the "Display name" drop-down (when setting the "From" address) would mistakenly be disabled and could not be used. Bug emerged in REDCap 10.9.2. (Ticket #104749)
  • Bug fix: When performing a data import that contains checkbox fields in which a checkbox has a Missing Data Code previously saved for it, any checkbox options being set to "1" for that field during the data import will mistakenly not remove the existing Missing Data Code from the field. Thus the field ends up with a Missing Data Code and other checked values, which should not happen. Additionally, when viewing the field on a data entry form afterward, the field would mistakenly still appear to have a Missing Data Code. (Ticket #104712)
  • Bug fix: When an instrument has already been enabled as a survey and it does not have the e-Consent Framework enabled, if a user then navigates to the Survey Settings page and enables the e-Consent Framework for that survey, the "Allow e-Consent responses to be edited by users?" option is mistakenly not checked by default. That option should be checked by default when enabling the e-Consent Framework. (Ticket #104869)
  • Change: Added a recommendation in the "Configure Twilio Settings" popup to suggest that the users consider adding a field that says, 'I agree to be contacted by text or phone' (or something similar) as means of them consenting participants to being contacted by text or phone.
  • Bug fix: When a matrix checkbox field is embedded on a survey page or data entry form, and another field has branching logic that references that embedded matrix checkbox, the branching logic would fail to work successfully when the trigger checkbox is checked/unchecked. (Ticket #104866)
  • Bug fix: If an administrator has set a project to be "Offline", users could inadvertently still use the API for that project, which should not be allowed. (Ticket #104931)
  • Bug fix: Depending on the username or the name of a Data Access Group, the "(+1)" text that signifies the amount DAG Switcher assignments might mistakenly not display next to the user's current DAG on the User Rights page's table of users.
  • Change: Slight change in an SQL query used to generate the Participant List that improves the loading performance of that page. (Ticket #95693)
  • Bug fix: If a user/participant adds a signature to a Signature field in which they resize the popup to make it larger while signing it, it would result in a larger image being saved that would mistakenly not always fit correctly in an exported PDF of that instrument. (Ticket #104927)
  • Bug fix: Data Quality rules A and B might mistakenly not display all valid discrepancies for a field if the field's branching logic contains certain Smart Variables. (Ticket #99077)
  • Bug fix: When performing an API data export of CSV data in EAV data format, it would mistakenly display the CSV "event" header as "event_id" instead of "redcap_event_name".
  • Bug fix: When importing data via the API in EAV format (where type=eav) and using the value "new" to perform auto-numbering of the redcap_repeat_instance field, it was mistakenly not returning an error for this. This is not allowed since the "new" value for redcap_repeat_instance cannot be used when type=eav but only for type=flat. This has also been added to the API documentation to inform users of this limitation. (Ticket #104491)
  • Bug fix: If a user is idle on a data entry form, and the red auto-logout message appears and states that their session has ended, if they attempt to close that browser tab, it would mistakenly display the prompt asking them if they wish to leave the site. It should not display that prompt. (Ticket #104948)

Version 10.9.2 (released on 2021-04-09)

CHANGES IN THIS VERSION:

  • Improvement: Assign a user to a DAG at the same time as adding the user to the project - Whenever a user is being added to a project via the User Rights page, if Data Access Groups are being utilized in the project, a new option will appear (whether if adding the user with custom rights or if assigning them to a user role) that allows you to assign the user to a DAG at the same time as adding them to the project. This helps prevent a common issue where a newly added user might temporarily have access to the records of *all* DAGs in the project prior to the user being assigned to a DAG immediately after getting added to a project. By making this two-step process a single step, it avoids possible data access issues for users who need to be assigned to a DAG.
  • Improvement: When exporting a PDF of all record data via the "Other Export Options" page, a copy of the downloaded PDF will now be archived and stored in the File Repository, similar to how other data exports (i.e., CSV, SPSS) are archived. This will help REDCap users keep better track of exactly what data was downloaded by someone when they export a PDF of all records in the project. Note: This does not apply to other PDF exports but only to the "all records" PDF export on the "Other Export Options" page.
  • Improvement: The project logging page now displays more information for PDF Exports that contain data, such as displaying the record name, event, and instrument for the downloaded PDF.
  • Change/improvement: When using the “Upload Users (CSV)” option on the User Rights page, it now displays a checkbox option in the dialog to allow the user to optionally send an email notification to all new users being added to the project via this import process. In previous versions, no users would be notified via email if they were added to the project via the “Upload Users (CSV)” option but only if added using other methods.
  • Improvement: Minor performance improvement when loading the Participant List page, especially for surveys that are not repeating instruments and surveys that do not exist on repeating events.
  • Change/improvement: There is a new check on the Configuration Check page for Windows web servers only that checks if the REDCap Cron Job's Scheduled Task is set to "Run a new instance in parallel". If the scheduled task is not set with that setting, then the REDCap Cron Job will not be able to run in parallel to itself, which is often needed. This check merely checks to see if the cron job has been running every minute over the past 3 days, and if there are gaps and it has not been running every minute, this implies that perhaps the Scheduled Task is not set properly to run in parallel.
  • Change/improvement: The User Access Dashboard now displays "Last logged activity" for each project displayed on that page.
  • Bug fix: If the body of an alert contains an inline image with a "src" attribute value containing "&file=" followed by an integer, there is a small possibility that an unrelated file that belongs to another REDCap project might get mistakenly attached to the alert that is sent.
  • Bug fix: The User Access Dashboard was mistakenly displaying projects that have been "marked as completed". Such projects are not accessible by normal users and therefore should not be visible on that page.
  • Bug fix: When a calc or @CALCTEXT field is used in the calculation of another calc or @CALCTEXT field, depending on the specific arrangement and order of the fields on the page, it could mistakenly cause the field to trigger itself over and over on the webpage, even when just initially loading a survey page or data entry form, in which it will use more and more web browser memory as time passes until the page crashes in the user's browser after several seconds or minutes. (Ticket #104217)
  • Bug fix: When using the randomization feature and viewing any data entry form on an already-randomized record, in very specific circumstances the values of some embedded fields on the page might mistakenly not get saved successfully after being modified.
  • Bug fix: On multi-page surveys, a section header might mistakenly be displayed on the page even though all fields in the section are hidden. (Ticket #66721b)
  • Bug fix: For every webpage in REDCap, the HTML DOCTYPE declaration and the HTML tag's "lang" attribute were mistakenly hard-coded as "EN" (English). This was causing issues with regard to browsers assuming that the webpage was always in English, which is not always true. (Ticket #104487)
  • Bug fix: If a user contains an apostrophe in their username and they attempt to create a new project, the process would fail due to a SQL query error. (Ticket #79647b)
  • Bug fix: If a user contains an apostrophe in their username and an administrator clicks the "Edit user info" button on the "Browse Users" page when viewing their account, it would mistakenly display an error message saying "User names can only contain letters, numbers, underscores, hyphens, and periods" and would not let them leave the field, thus forcing the admin to refresh the page. (Ticket #79647c)
  • Bug fix: When using Twilio for survey invitations, if a participant sends an SMS message to the Twilio phone number being used in a REDCap project, it might mistakenly reply back to the participant from a different Twilio phone number if the Twilio account has multiple phone numbers associated with it, in which the other number is associated with another REDCap project that is also using Twilio.
  • Bug fix: Several places in REDCap were mistakenly still linking to the old Language Center on the REDCap Community site instead of the newer plugin page that now serves as the current Language Library.
  • Bug fix: When exporting data to SAS, fields that have a number, integer, date, or datetime data type might mistakenly not have their "informat" or "format" syntax set correctly in the SAS syntax file, which could cause warnings or errors when loading the exported data into SAS. (Ticket #96569)
  • Bug fix: If checkboxes are embedded and they are also piped to other places on the same page, then the piping action would mistakenly not occur in real time if the checkbox's choice label is clicked. Note: The piping would work correctly if the checkbox element itself is clicked or if the page was saved and reloaded, but it would not act in real time when clicking the label of the checkbox. (Ticket #104317)
  • Bug fix: The Data Access Group drop-down filter was mistakenly not being displayed at the top of the project logging page for projects that contain DAGs. (Ticket #104574)
  • Bug fix: If certain user-defined text (e.g., field labels, survey instructions) contain HTML character codes, there is a chance that the HTML character codes might not get parsed correctly when being sanitized for security purposes prior to being displayed on the page. This could cause them not to display correctly on the page or (worst case) cause the page to result in a PHP error if it gets stuck in an infinite loop while processing this text. (Ticket #104583)

Version 10.9.1 (released on 2021-04-02)

CHANGES IN THIS VERSION:

  • Medium security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in various places in REDCap, such as in survey question text and other user places that store user input.
  • Improvement: Further performance gains for projects with lots of records (25K+), especially during the process of creating new records via data entry forms and via data imports, which have been known to be slow in the past for large projects.
  • Change/improvement: The "Phone (North America)" field validation now allows phone numbers that begin with "800" and “811”.
  • Bug fix: When using the survey feature "Prevent survey responses from being saved if the survey ends via Stop Action?" to prevent responses from being saved, if a one-page survey (which must be the first instrument in the project) contains a required field that is left blank when the survey is submitted, and then the survey later ends via a Stop Action, the saved data on the survey would mistakenly not get deleted when the survey ends.
  • Bug fix: Fixed a compatibility issue when hosting REDCap using the PHP7 version of Google App Engine.
  • Bug fix: If a report's filter logic contains only Smart Variables and no real project fields (e.g., [current-instance] = [first-instance]), the report would mistakenly not return any results for fields that exist on the first instrument if the first instrument is a repeating instrument.
  • Bug fix: When uploading an Instrument Zip file into the Online Designer, any field variables in the Action Tag/Field Annotation text would mistakenly not get renamed (as they do for calculations and branching logic) if those variables exist on the instrument being uploaded and already exist as variables in the project. (Ticket #102968)
  • Bug fix: When copying an instrument via the "Choose action" drop-down in the Online Designer, if a matrix of fields has a very long matrix group name, the action might fail and return an error message. (Ticket #103564)
  • Bug fix: When performing a CSV data import via the Data Import Tool, if the CSV file contains a byte order mark (BOM), it can cause processing issues in certain situations, thus returning an error about not being able to find the Record ID field in the file. To remedy this, the BOM is now always removed (if it exists) before the CSV gets processed during the data import process.
  • Bug fix: In a longitudinal project that uses Automated Survey Invitations in which a user deletes an entire event via the Define My Events page, any already-scheduled invitations via ASIs would mistakenly remain in the Survey Invitation Log but would no longer be associated with any event (i.e., partial orphaning). This would cause the invitations to still be sent, which is not expected, and thus causes issues because those invitations no longer point to a real survey/event anymore, in which they would display a message to the recipient opening the survey link that they are not a participant for that survey. This has been fixed so that any already-scheduled invitations connected to the deleted event will also get appropriately deleted. (Ticket #103930)
  • Change: Increased the max execution time for cron jobs to 2 hours (was previously 1 hour) to allow for some long-running cron jobs to finish.
  • Bug fix: Fixed typo in field label for Twilio-related phone options for Alerts & Notifications on the "Modules/Services Configuration" page in the Control Center.
  • Change: Removed the "up arrow" and "down arrow" icons used to represent Field Embedding because the arrow was potentially confusing to some users, especially in the Online Designer. (Ticket #103988)
  • Change: If a user in a project with lots of calc fields and/or lots of records attempts to execute Data Quality rule H in which it ends with an error after running too long or running out of server memory, it will now display the "Fix calcs now" button inside the results dialog (despite the error occurring) to at least allow the user to attempt to fix the calcs little by little even though the initial evaluation process of the calcs has failed.
  • Bug fix: When deleting a project, due to a SQL query error, the contents of the project logging (e.g., data values that were saved, record names, other record-specific logged events) were mistakenly not being deleted from the log when the project gets officially deleted after 30 days (or if an administrator clicks the "Delete it now" option in the Control Center). (Ticket #103532)

Version 10.9.0 (released on 2021-03-26)

CHANGES IN THIS VERSION:

  • New feature: Field that maps to a participant’s Twilio delivery preference - When using Twilio for surveys, users can control each participant's invitation preference automatically using a multiple choice field. If survey participants require using different methods (e.g., email, SMS w/ link, voice call survey) for receiving survey invitations and/or taking surveys, users can select a multiple choice field whose choices represent each survey invitation delivery method. After mapping the invitation preferences to a field, whenever the value of the field is added or modified, the participant's invitation preference will automatically be changed accordingly. IMPORTANT: The multiple choice codings for the selected field must be defined exactly as delineated below, although their corresponding choice labels can be modified to be whatever text the user desires. Also be aware that if the value of the field that is mapped is set to blank/null, then the invitation preference for the participant will revert to the project's default invitation preference (as defined in the Twilio configuration on Project Setup). Additionally, if a participant's invitation preference is modified via the Participant List, that change will also change the value of the mapping field selected above. Mapped field choice options:
    • EMAIL, Email invitation
    • SMS_INVITE_WEB, SMS invitation (contains survey link)
    • SMS_INITIATE, SMS invitation (take survey via SMS)
    • VOICE_INITIATE, Voice call (participant receives voice call)
    • SMS_INVITE_MAKE_CALL, SMS invitation (contains phone number to call)
    • SMS_INVITE_RECEIVE_CALL, SMS invitation (reply via SMS to receive voice call)
  • New feature: Custom offline message for surveys in offline status- Users can provide custom text that is displayed to participants only when the survey is offline. This custom text will be displayed in place of the default offline text on the survey while the survey is in offline mode. This text can be set at the top of the Survey Settings page.
  • New feature: Survey-level Stop Action controls (new section on Survey Settings page)
    • Alternative survey completion text - Users can optionally set alternative survey completion text that is displayed in place of their standard survey completion text whenever a survey is ended via a Stop Action on any field. This is useful when it doesn’t make sense for non-eligible participants to see the same survey completion text as those who completed the survey fully.
    • Prevent survey responses from being saved if the survey ends via Stop Action - Users can optionally choose to prevent submitted responses from being saved as data in the project if the survey ends via Stop Action. This is useful if survey administrators do not wish to keep the data for ineligible participants, for example. This means that if a one-page public survey is started but ends via Stop Action, no data from that response will be saved into the project (i.e., no new record will be created), but it will log this event on the project Logging page (so that users are at least aware of this happening despite no data being saved).
      1. NOTE: If any data has been saved on the survey instrument for a given record prior to the Stop Action being triggered, that data will be deleted from that instrument. For example, if the survey is a multi-page survey in which data has been entered on previous pages prior to triggering the Stop Action, all data collected thus far in that survey will be deleted as if the survey was never taken. Additionally, if the record does not contain data in any other instruments, the entire record itself will be deleted during this process. If data does exist in other instruments, the record will not be deleted.
      2. PRIVACY NOTE: If the option for Data Privacy/GDPR has been enabled in the project, in which it removes the contents of the log for a record that is deleted from the project, then if an entire record is deleted via this particular survey setting via a Stop Action, then all logged data values for the record will be removed from the log as per this project's data privacy setting.
  • Improvement: New project-level option for importing email addresses for patients from an EHR via REDCap’s Clinical Data Interoperability Services (CDIS) - When this option is enabled at the system level on the CDIS page in the Control Center, an administrator can then enable this option for any given project via the “Edit A Project’s Settings” page. Once enabled for a project, users will then be able to map the “email address” field in either a Clinical Data Pull or Clinical Data Mart project, thus allowing them to import patient email addresses for the EHR. This option is disabled by default.
  • Improvement: If a project contains more than 25,000 records, the Logging page will no longer display the record filtering drop-down at the top of the page but instead will display an auto-complete text box to allow the user to enter the record name if they wish to filter the logging by record. This behavior is similar to the "Add/Edit Records" page when not using record auto-numbering if a project contains more than 25,000 records.
  • Medium security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in various places in REDCap, such as in survey question text and other user places that store user input.
  • Major bug fix: When using randomization in a longitudinal project in which randomization strata fields exist on a different event than the randomization field, if the values of the strata fields are added or modified during the randomization process, their values would mistakenly not get saved or logged in the correct event, thus orphaning those values. (Ticket #103189)
  • Major bug fix: If signature image files are being uploaded for Signature fields across multiple REDCap projects simultaneously (within milliseconds of each other), there is a small chance that one of the signature files might mistakenly get associated with a field in another project where someone was adding an image at the same moment. (Ticket #102764)
  • Bug fix: If a survey participant receives a survey link via email in Microsoft Outlook (in either the desktop client or web version), in which Microsoft Outlook Safe Links has been implemented and has replaced the survey link in the email body, whenever the Safe Link version of the survey link is clicked by the participant, a Microsoft service (located in the IP address range 40.94.*.*) will make a POST request to the survey page about 10-20 seconds after the participant loads it (unbeknownst to them). This service actually submits the survey as if a real person was taking the survey, including submitting values for the survey questions. This means that for public surveys it is submitting false responses like a bot, and for private/unique survey links it is actually submitting the survey for the user, in which the participant is not able to enter their own response if they wait 10-20 seconds before submitting the survey themselves because this service has already completed the survey for them. To prevent this odd behavior by Microsoft Outlook Safe Links, REDCap survey pages now block all POST requests that originate via the IP address range 40.94.*.*, in which it immediately returns an error message.
  • Bug fix: When record auto-numbering is enabled in a project, the process used to generate new record names is 2-5x slower than it should have been due to some inefficient structuring of SQL queries being used. This fix results in a performance improvement, especially for very active public surveys.
  • Bug fix: If a project's "record list cache" is currently being built, which is done automatically via a back-end process, at the same time that new records are being created in the project, it might cause the cache not to be built for many minutes or hours (due to repeated failures while building the cache) if the project has lots of activity, all of which could cause the project to get extremely slow and might affect the performance of the overall system.
  • Bug fix: In certain situations, such as public surveys being taken by hundreds or thousands of participants in a very short period of time, a project's "record list cache" (which is built automatically via a back-end process) might mistakenly get reset/reverted, which causes the record auto-numbering mechanism to mistakenly use a very slow SQL query for generating the next proposed record name. This can cause the public survey to get increasingly slow as more participants attempt to take it.
  • Change: The section for "e-Consent Framework: PDF External Storage Settings (for all projects)" on the File Upload Settings page in the Control Center has been moved to the Modules/Services Configuration page to be more consistent from an organizational standpoint with regard to other similar system-level features that utilize a separate SFTP or WebDAV server for securely storing files outside of REDCap.
  • Bug fix: If the system's "Auto logout time" is set to a value of 2 or less, it will cause the user interface to become mostly unusable due to all the auto-logout popups being displayed immediately on every page. The minimum value for "Auto logout time" has been set to "3" on the Security & Authentication page to prevent this issue from occurring. (Ticket #102319)
  • Bug fix: When a survey participant is taking an Adaptive or Auto-scoring instrument from the REDCap Shared Library, if a survey question contains stem text at the beginning of the question text (e.g., "In the past 7 days"), the stem text was not being as displayed sufficiently separated from the rest of the question text. Certain validated instruments require that they be more separated.
  • Bug fix: When building a list of participants on the Participant List, a database query on that page was suboptimal and was causing the page to load slowly for some projects. That query has been modified to be faster.
  • Change: For convenience, a hyperlink to the To-Do List was added inside the blue box at the bottom of the Project Modification Module page where an administrator reviews the drafted changes before approving/rejecting them.
  • Bug fix: If a project contains File Upload fields but no records have any files uploaded to those fields, a user can click the ZIP icon on the Other Export Options page to download a "ZIP file of uploaded files (all records)", in which it will correctly state a notice that there are no files to download. However, if during that same session the user goes and uploads a file and returns to download the ZIP of all files again, it will mistakenly still say there is nothing to download, which is incorrect. If they log out and log back in again, this issue goes away. (Ticket #103117)
  • Bug fix: A SQL query was slow and inefficient when determining if the "FHIR Statistics" link should be displayed on the Control Center's left-hand menu. This would sometimes cause all Control Center pages to load unnecessarily slowly.
  • Bug fix: If a user is viewing a survey response on a data entry form to which they have viewing access but do not have privileges to edit survey responses, any fields with @NOW, @TODAY, or other similar Action Tags would mistakenly have new values pre-filled for them on the page if those fields did not already have a value. This should not happen since the current user is not able to modify any values (i.e., they are not allowed to submit the form).
  • Bug fix: Data Quality rule H might fail to complete if the project contains a large amount (>300) calculated fields.
  • Bug fix: When uploading an image file to a File Upload field in which that field is piped somewhere using the ":inline" parameter, it would mistakenly not pipe the inline image successfully on the page if the image's file extension was not all lower-case. (Ticket #103473)
  • Bug fix: When using Missing Data Codes in a project, if multiple fields are embedded together inside another field on a data entry form, it would cause the click event of the "M" icon not to function correctly in which the Missing Data Code popup would mistakenly fail to open for those particular fields. (Ticket #103213)

Version 10.8.5 (released on 2021-03-05)

CHANGES IN THIS VERSION:

  • Improvement: The upload max file size for File Upload fields and general file attachments can now be increased or decreased on a per-project basis if needing to be different from the system-level settings as defined on the "File Upload Settings" page in the Control Center. This can be changed at the bottom of the Control Center's "Edit a Project's Settings" page for any given project.
  • Minor security fix: Removed the outdated and unused JavaScript library YUI Charts.
  • Change/improvement: The institution name is now included in the email subject for all emails sent regarding user expiration and account suspension due to inactivity. This is done to provide greater clarity to the user regarding which REDCap installation is being referenced in the email.
  • Bug fix: When clicking "Cancel" inside the Logic Editor dialog, it might mistakenly revert the value of the text box being modified to the value of another text box that was previously edited via the Logic Editor while on that same page. (Ticket #101200)
  • Updates to various third-party PHP packages.
  • Bug fix: The rich text editors used for setting system-level custom text settings at the bottom of the General Configuration page in the Control Center would cause the custom text to display in its appropriate places but would mistakenly display a blank message when the custom text is blank, in which it should not display anything at all when the custom text is left blank.
  • Bug fix: Calculations or conditional logic containing >1000 variables might mistakenly cause PHP to crash while processing and parsing them.
  • Bug fix: Multi-page surveys that contain calculated fields might mistakenly take an unnecessarily long time to load each survey page due to inefficient calculation/logic processing on the server side.
  • Change: More tweaks to improve the style of the text displayed inside the rich text editors because they still did not quite match the general style and CSS classes of text on REDCap webpages.
  • Change: The language of the "Stop Action" prompt (displayed on survey pages when a Stop Action has been triggered) has been slightly modified to be more succinct and clear.
  • Bug fix: When adding a new Table-based user on the "Add Users (Table-based Only)" page in the Control Center, it would mistakenly allow admins to create usernames with spaces or apostrophes when not using LDAP or LDAP+Table authentication, which is the only time that spaces and apostrophes are allowed in usernames. (Ticket #101773)
  • Bug fix: When using the Smart Variables [survey-date-completed] and [survey-time-completed] in the Custom Record Label, they would mistakenly not have their date displayed according to the user's preferred date format (as defined on their My Profile page) but instead would display it always in Y-M-D date format. (Ticket #102141)
  • Bug fix: Since calculations typically do not expect fields to have a ":value" signifier attached to field variables (because it is assumed), an error message would occur on a data entry form or survey page if any fields in branching logic, calc fields, or pseudo-calc fields (@CALCTEXT) have ":value" appended to the field variable (e.g., [race:value]). REDCap will now allow ":value" to be appended to field variables in branching logic or calcs/pseudo-calcs and will treat them as equivalent to using just the field variable. (Ticket #102149)
  • Bug fix: The "Check For Identifiers" page was mistakenly displaying any HTML that existed in a field label, thus making it unreadable on the page in certain instances. It now strips all HTML from the field label when displaying it.
  • Bug fix: When setting up the REDCap cron job on the Control Center's "Cron Jobs" page on a Windows server, the page failed to mention the important fact that the cron job's scheduled task needs to be set to "Run a new instance in parallel", which can be set under the Settings tab in the Windows Task Scheduler.
  • Bug fix: On the Browse Users page in the Control Center, the "Display User List" button on the "View User List By Criteria" would fail to load the user list table if using Internet Explorer 11. (Ticket #90646)
  • Bug fix: Clicking on the "Perl" tab at the bottom of the API Playground page when the "Import A File" API method has been selected would cause a fatal PHP error in PHP 8 and certain versions of PHP 7, thus causing that page to crash. (Ticket #102291)

Version 10.8.4 (released on 2021-02-26)

CHANGES IN THIS VERSION:

  • New feature: Export Data Quality rule results - After running a data quality rule, users may export the results/discrepancies of the rule as a CSV file. The CSV file will be structured exactly like a date export/import file, which should allow for faster and easier cleaning of data so that values can be fixed and then re-uploaded as a data import.
  • Improvement: The rich text editor is now utilized when editing the following system-level custom text settings on the "Edit a Project's Settings" page in the Control Center: "Custom text to display at top of Project Home page in project" and "Custom text to display at top of all Data Entry pages in project".
  • Change/improvement: The custom text settings "Custom text to display at top of Project Home page in project" and "Custom text to display at top of all Data Entry pages in project" no longer default to being contained in a DIV with class="green" but can be styled with any color container (or none) using the rich text editor on the "Edit a Project's Settings" page. Any custom text values that existed beforehand will be grandfathered in and will still be displayed with the green class, but they can be modified after the fact to remove/change it.
  • Change: The input element for @CALCTEXT fields was made wider on survey pages and data entry forms to be able to fit more viewable text.
  • Bug fix: When displaying Action Tags beneath fields in the field view in the Online Designer, the last letter of the Action Tag name would mistakenly get removed for certain Action Tags.
  • Bug fix: When a user is using the My Profile to reset their password while using certain versions of Internet Explorer, it might mistakenly fail to reset their password due to various JavaScript errors occurring on the page. (Ticket #100595)
  • Bug fix: Fixed issue with text and embedded images displayed for an item on the Help & FAQ page. (Ticket #101384)
  • Bug fix: Clicking on the "Past Day", "Past Week", etc. buttons near the top of the project Logging page might mistakenly add the "seconds" component of the timestamp into the time range filter fields, thus causing an error message to display on the page if the user puts their cursor inside the field and then then tabs out of the field. (Ticket #101369)
  • Bug fix: If the survey setting "Save a PDF of completed survey response to a File Upload field" is enabled on a survey that also has the e-Consent Framework enabled, and the File Upload field specified for the "Save a PDF" setting exists on that same survey (often hidden by @HIDDEN-SURVEY), the PDF of the completed survey response would fail to be saved to the specified File Upload field when the participant completes the survey.
  • Bug fix: When using an Adaptive or Auto-Scoring instrument from the REDCap Library (e.g., PROMIS, Neuro-QoL), the "reset" link next to each question's radio buttons would mistakenly fail to reset the radio button, if selected.
  • Bug fix: The API Playground's example R code for the API Import File method was not correct and has been fixed. (Ticket #101454)
  • Bug fix: The API Playground's example R code for the API Export File method was not correct and has been fixed. (Ticket #101454)
  • Bug fix: When setting a survey's text-to-speech value to "English (United Kingdom) Female" on the Survey Settings page, it would mistakenly fail to save that setting correctly, thus preventing it from working as expected on the survey. (Ticket #101419)
  • Bug fix: When an administrator is processing a "Move to production" request on the To-Do List page, clicking the "Check For Identifiers" link in the dialog while processing the request would mistakenly make the dialog go blank/empty. It will now open a new browser tab. (Ticket #101426)
  • Bug fix: When a slider field is the first field displayed on a data entry form, the field receives focus when the form loads (which always occurs for the first field on any form), which makes it appear as if the field might already have a value. If the user misunderstands this and doesn't enter a value because they think it already has one (when it does not), data loss could result. Thus slider fields will no longer receive focus by default on a data entry form when they are the first field on the form. Note: This does not apply to surveys. (Ticket #101420)
  • Change: Small change to text describing the Designated Email Field on the Project Setup page.
  • Bug fix: If an Adaptive (CAT) survey has been downloaded into a project from the REDCap Shared Library, and the setting "Allow participants to skip questions?" has been set to "Yes" on the survey's Survey Settings page, a participant attempting to skip a survey question without answering it would mistakenly receive an error message saying that an unknown error occurred and that they cannot continue with the survey.
  • Bug fix: When fields are embedded using the ":icons" parameter in order to additionally embed the field's associated icons, depending on how the embedded fields are laid out on the page, the SPAN tag containing the icons might mistakenly wrap to the next line and appear below the embedded field rather than displaying to the right of the field. (Ticket #101466)
  • Bug fix: When the Smart Variable [survey-queue-link] or [survey-queue-url] is used in the email body of an Automated Survey Invitation or an Alert, if the record is being created via the API, which then triggers the sending/scheduling of the invitation or alert, the link/URL of the record's survey queue would mistakenly be blank (not displayed at all) inside the email body. (Ticket #101536)
  • Bug fix: When a REDCap administrator attempts to add Stop Actions for a Dynamic SQL field on a survey instrument in the Online Designer, an error message would mistakenly be displayed, thus preventing them from doing so.

Version 10.8.3 (released on 2021-02-19)

CHANGES IN THIS VERSION:

  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into the username field on the REDCap login form when logging in as a valid user for the very first time using an external authentication method, such as LDAP or Shibboleth. (Ticket #101037)
  • Bug fix: The “Instant Adjudication” panel in CDP-enabled projects would mistakenly not be displayed on the CDP field mapping page in projects with record auto-numbering disabled.
  • Bug fix: When copying a project that contains surveys with the e-Consent Framework enabled, it would mistakenly not copy over some e-Consent settings, such as the "force signature" fields and "Allow e-Consent responses to be edited by users".
  • Bug fix: When running Data Quality rule H's "Fix calcs now" button, if any fields listed in the discrepancy list are calc or pseudo-calc fields that exist on a survey that was completed using the e-Consent Framework, it would not change the values of those fields (as expected) but would mistakenly not return any error messages regarding why the values weren't changed, which could be confusing to users. It now displays error messages (if any) after clicking the "Fix calcs now" button for DQ rule H.
  • Bug fix: When an Automated Survey Invitation is set to be triggered by survey completion OR conditional logic, in which the ASI is set to send "Immediately" and also has the "Ensure logic is still true" checkbox checked in the ASI setup, if a user/participant completes the trigger survey while the conditional logic still evaluates as FALSE, it would mistakenly fail to send the survey invitation, but it would correctly schedule any reminders for that survey invitation if the ASI has reminders defined. (Ticket #100770)
  • Change: In addition to the stock Action Tags that come bundled with REDCap, the field view in the Online Designer now displays custom action tags (in pink text below the field) that are utilized by hooks or external modules. (Ticket #101045)
  • Bug fix: When using X-instance Smart Variables in report filter logic (e.g., [current-instance] = [last-instance]), in which the report is returning data for multiple repeating instruments in the project, the report might mistakenly display rows of repeating instance data that should not be returned. (Ticket #100577)
  • Bug fix: Fixed PHP 8 fatal error caused when parsing certain logic or calculations. (Ticket #101033)
  • Bug fix: Descriptive fields could not successfully be embedded if the Descriptive field's field label does not contain any HTML tags and was not created using the rich text editor. (Ticket #101130)
  • Bug fix: When opening an existing field for editing in the Online Designer, it would mistakenly convert <br> tags that exist in the "Action Tags/Field Annotation" text into literal line breaks. (Ticket #101178)

Version 10.8.2 (released on 2021-02-12)

CHANGES IN THIS VERSION:

  • Change: New “Applications Overview” video added to Training Videos
  • Change/improvement: When viewing the Survey Settings page for a repeating instrument, the "Location of the button on survey" option for the "Allow respondents to repeat the survey" setting now includes a new choice not to display the repeating survey button at all on the survey page. This is useful if users are utilizing the Survey Queue as the path for participants to enter new responses for the repeating responses instead of displaying the repeating survey button on the survey page itself.
  • Bug fix: When importing data from a CDISC ODM XML file (whether it be a Project XML file with data or a data-only ODM export file), in which the file contains data for repeating instruments, only the first repeating instance of any repeating instrument would get successfully imported.
  • Bug fix: When importing data from a CDISC ODM XML file (whether it be a Project XML file with data or a data-only ODM export file), in which the file contains data for repeating events, only the last repeating instance of any repeating event would get successfully imported and would mistakenly get saved into the first repeating instance of the event.
  • Bug fix: If a signature field is embedded on a survey page or data entry form, depending on where it is embedded, the signature image might mistakenly not be displayed directly above the download link after the user/participant adds their signature. It should always be displayed directly above the download link.
  • Bug fix: In a longitudinal project that contains calculated fields whose equations reference fields on other events, Data Quality rule H might fail to return discrepancies for events that do not contain any data for any fields.
  • Bug fix: Auto-calculations (i.e., the server-side processing of calculated fields) would mistakenly try to include all the fields in the project when assessing if calculated fields are being triggered and thus need to be updated, rather than only considering the fields that are being updated at that moment, such as during a data import or data entry. This could cause certain data imports to take much longer than they should.
  • Improvement: Performance improvements for the "datediff+today/now" cron job for Alerts & Notifications
  • Bug fix: A fatal PHP error would occur in certain situations when running PHP 8.0. (Ticket #100549)
  • Bug fix: A fatal PHP error would occur in certain situations when running PHP 8.0. (Ticket #100456)
  • Bug fix: A fatal PHP error would occur in certain situations when running PHP 8.0 while performing a data import via the API Import Records method. (Ticket #100416)
  • Bug fix: The "Quick Add" dialog on the "Create New Report" page might mistakenly not work correctly if a data collection instrument's name/label contained a backslash.
  • Bug fix: When viewing the Survey Invitation Log for a project displayed in a non-English language, the "Delete all selected" button might mistakenly not be displayed on the page. (Ticket #100480)
  • Bug fix: When using advanced filter logic for reports, the logic would not get interpreted correctly if it contained certain Smart Variables, especially if it contained only Smart Variables with no field variables (e.g., [current-instance] <> ""). With this issue fixed, users may now utilize X-instance Smart Variables in a more intuitive way for filtering reports, such as the following: 1) Display only repeating instance data - [current-instance] <> "", 2) Display only non-repeating instance data - [current-instance] = "", 3) Display only the first instance of only repeating instance data - [current-instance] <> "" and [current-instance] = [first-instance], and so on. (Ticket #45618)
  • Change: Added a tip in Step 3 when creating a new report to inform users how to use [X-instance] Smart Variables to filter repeating data. This tip is only displayed in projects that have repeating instruments and/or repeating events.
  • Bug fix: On a project's Project Setup page, some things would mistakenly display incorrectly (or display when they should not) if an administrator was using the "View project as user" feature.
  • Bug fix: If using the survey setting "Save a PDF of completed survey response to a File Upload field" in which an Alert is set to send "Immediately" with the PDF as an attachment on the alert, the PDF would mistakenly not get attached to the alert. However, if the alert was set to send after a delay of any kind, the PDF would correctly get attached.
  • Bug fix: When copying a project via the Copy Project page, in which the Survey Queue settings are being copied, the following Survey Queue settings would fail to be copied to the new project: "Custom text to display at top of survey queue" and "Keep the Survey Queue hidden from participants?".
  • Bug fix: Calculated field values were mistakenly not getting saved via cross-form or cross-event calculations (via Auto-Calculations) if the calculation was based on the value of a field being blank when the field's value was not being changed.
  • Bug fix: When an action tag has text enclosed inside escaped apostrophes (e.g., @PLACEHOLDER=\'DD-MM-YYYY\'), it would cause the Online Designer page to crash and throw a fatal PHP error. (Ticket #100543)
  • Bug fix: It was recently discovered that due to a security fix added to REDCap 10.3.3 (Standard) and thus to all subsequent versions, some survey-specific features in REDCap do not function correctly if not using MySQL/MariaDB 5.5.5 or higher. Anyone using a version lower than MySQL/MariaDB 5.5.5 should upgrade their database to v5.5.5 or higher. The Configuration Check page now reflects MySQL/MariaDB 5.5.5 as being the minimum required database version that REDCap supports.
  • Bug fix: When a project has thousands or more records and has several records being created every minute, there might exist a slight lag in the back-end Record List Cache immediately after creating a new record, in which it could cause REDCap to mistakenly assume that a record doesn't exist yet when in fact it was just created. This might cause a record's data to get duplicated as a new record if a user is not paying attention while attempting to create another record.

Version 10.8.1 (released on 2021-02-05)

CHANGES IN THIS VERSION:

  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into the URL of the Survey Settings page when enabling an instrument as a survey.
  • Bug fix: If an API user belongs to a Data Access Group, the project's back-end Record List Cache would mistakenly get reset every time the user would import a batch of records via the API. This would cause performance degradation of the project if many API imports are occurring for the project in a relatively short amount of time.
  • Various fixes and updates for the External Module Framework
  • Bug fix: When a project has enabled the "Delete a record's logging activity when deleting a record" setting, the action of deleting a record would correctly delete the record's logging activity with regard to what can be viewed via the front-end user interface, but it was mistakenly not additionally deleting the back-end SQL logging details that are stored in the database log_event tables (even though this information can only be accessed if you have direct access to the database or via a special plugin or external module for doing such). (Ticket #100131)
  • Bug fix: When a calc field or @CALCTEXT field exists on a repeating instrument or repeating event, the calculation might not get triggered during a data import or when running Data Quality rule H, in which it will fail to find discrepancies for this field when some discrepancies exist (but only in specific situations depending on the calculation being used for the field). (Ticket #82961)
  • Bug fix: When a field has an @HIDDEN-PDF action tag in the Field Annotation/Action Tag text in which "@HIDDEN-PDF" is preceded with a line break with no space before the line break, the field would mistakenly not be hidden when downloading a PDF of the instrument.
  • Bug fix: When attempting to download a file that was just uploaded to a File Upload field on a survey page, it would display an error message and prevent the downloading of the file if the survey had not been saved yet (i.e., if the participant was still on page one of the survey, whether public or private). This should not occur at all when the participant is using a private/unique survey link. This error message now only displays on public surveys in which the survey has not been saved yet at all (before the record has been created), which is appropriate. (Ticket #99754)
  • Bug fix: When using cross-form or cross-event calculations or branching logic involving a DMY or MDY formatted date or datetime field, if the field referenced on the other instrument/event has a Missing Data Code saved for it, saving the current instrument would cause the "Invalid values entered!" warning to appear mistakenly. (Ticket #100238)
  • Bug fix: When a project has thousands or more records and has several records being created every minute, there might exist a slight lag in the back-end Record List Cache immediately after creating a new record, in which it could cause REDCap to mistakenly assume that a record doesn't exist yet when in fact it was just created. This might cause a record's data to get duplicated as a new record if a user is not paying attention while attempting to create another record.
  • Bug fix: In some rare cases for projects that have calculated fields on repeating instruments, running Data Quality rule H would return valid discrepancies, but clicking the “Fix now” button on the page would mistakenly fail to fix the calculations.
  • Bug fix: When attempting to download an instrument's Instrument ZIP file in the Online Designer when the instrument was created in Draft Mode but does not yet exist in the live version of the project, it would display a generic error message, which could be confusing to users. It now displays a more informative message regarding why exactly the zip file cannot be downloaded. (Ticket #100290)

Version 10.8.0 (released on 2021-01-29)

CHANGES IN THIS VERSION:

  • New feature: Instant Adjudication for Clinical Data Pull (CDP) with improved CDP Field Mapping page
    • Once enabled here for the whole system via the CDIS page, the Clinical Data Pull "Instant Adjudication" setting can be enabled on a CDP project's field mapping page, after which it will allow users to bypass the normal data adjudication process and will let them import and save all data into the project that has already been cached from the EHR system. This can save a great deal of time when importing lots of patient records. After Instant Adjudication is enabled in a CDP project, users with CDP-adjudication privileges will see the button to initiate this process on the Record Status Dashboard. After the button is clicked, it will begin adjudicating the EHR data for all records in real time, thus saving the data into records in the projects. On the CDIS page in the Control Center, administrators can enable or disable the Instant Adjudication feature for all CDP-enabled projects in the system. By default, the system-level Instant Adjudication option is enabled.
    • Also, the user interface for the CDP Field Mapping page in all CDP-enabled projects has been updated and improved to allow users to more quickly and easily map their REDCap fields to EHR fields for their CDP project.
  • Improvement: Custom ranges (min/max) for slider fields - Users may now set a custom minimum and/or custom maximum integer value for slider fields. The default min and max is still 0 and 100, respectively. If no value is entered for the min or max value, it will assume the default value. These can be set via the Edit Field popup in the Online Designer, and via the “Text Validation Min” and “Text Validation Max” columns in the Data Dictionary.
  • New feature: New API “Export Logging” method - This new API method allows users to export a project’s logging via the API using very similar methods and filters as in the project’s user interface. See the documentation for all filter parameters that are available.
  • New feature: Ability to to import/export user rights via a CSV file on the User Rights page - Users can download a CSV file to view all the user privileges of the existing users in a project, including their instrument-level user rights. Users can upload a CSV file to grant new users access to the project and/or to modify the user privileges of existing users, including their instrument-level user rights.
  • Improvement: The rich text editor is now utilized when editing the following system-level custom text settings in the Control Center: Custom login text, Homepage announcement custom text, Homepage informational custom text, Help & FAQ custom text, Custom message when creating/copying project, and Custom message when moving project to production.
  • Improvement: The Email Users page in the Control Center now has a new quick-select link to select and email only the currently logged-in users. (Ticket #99532)
  • Bug fix: When using the ":link" piping option for a File Upload field on a survey or data entry form, in which the field being piped exists on that same page, if a user initially uploads a file for that File Upload field, it would mistakenly pipe the value instead of the hyperlink for downloading the file. However, if the page is reloaded or revisited later, the piping works correctly to display the hyperlink. This issue only occurs at the moment in which the file is uploaded when piped on the same page.
  • Bug fix: In specific cases when using the “:inline” piping option for a File Upload field that has a PDF uploaded to it, instead of displaying the PDF inline on the page, it would mistakenly cause the PDF to be auto-downloaded by the user’s browser. (Ticket #99572)
  • Bug fix: When a REDCap administrator is using the "View project as user" feature to impersonate a user when viewing an "initial survey" in the Participant List while the project is in production, it would mistakenly not disable the "Enable" button for the Participant Identifier column in the Participant List. In this scenario, that button should remain disabled since it would be disabled for the user being impersonated.
  • Bug fix: The style of the text displayed inside the rich text editors did not match the general style and CSS classes of text on REDCap webpages (e.g., the text in the editors were much larger). This made it more difficult to accurately determine what the resulting text would actually look like on the page.
  • Bug fix: When using the Field Bank feature, some specific field types that are imported into a project might mistakenly have choices that belong to other fields that appear in the Field Bank search. However, this only appears to occur when searching in the 'REDCap Catalog of Common Data Fields', which was deprecated in REDCap 10.7.1 and thus is no longer accessible. (Ticket #99552)
  • Bug fix: When the text inside the @CALCTEXT action tag contains an opening parenthesis inside quotes but does not contain a closing parenthesis inside those same quotes (and vice versa), the @CALCTEXT equation would mistakenly not get parsed correctly and might cause an error to display on the survey/form or might cause the @CACLTEXT field to display as a normal editable text field instead of a pseudo-calc field.
  • Bug fix: When a required field is left empty/blank on a survey or data entry form, in which the required field has no field label defined, instead of displaying a bullet point with no text in the error prompt, which is confusing, the variable name of the field will be displayed as an alternative. (Ticket #99551)
  • Bug fix: When using the ":link" or ":inline" piping options pointing to a File Upload field, in which the field is from a different event than the event where it is being piped, the user would receive an error message when attempting to download or view the file. (Ticket #99754)
  • Change/improvement: The maximum repeating instance number that can be added for a repeating instrument or repeating event has been increased from "9999" to "32767".
  • Bug fix: When running the "Re-evaluate Alerts" feature on the Alerts & Notifications page in a longitudinal project, in which the alert is set to be triggered on "[Any event]" if an instrument is saved with a Complete status, it would mistakenly trigger alerts for records that do not have a Complete status for the instrument. If the alert is set to be triggered by completing the instrument on a specific event (rather than on "[Any event]"), this issue does not occur. (Ticket #99889)
  • Bug fix: Data Quality rule F would mistakenly return false positives if the project is a multi-arm longitudinal project and a field's branching logic references fields/events in arms where the record currently doesn't exist. (Ticket #99922)

Version 10.7.1 (released on 2021-01-22)

CHANGES IN THIS VERSION:

  • New feature: New “:link” piping option for File Upload fields - If piping using the ':link’ option for a File Upload field, such as [my_field:link], the file's filename will be displayed as a clickable hyperlink for downloading the file, which works on webpages and also inside the body of email text (i.e., survey invitations or Alerts & Notifications).
  • Improvement/change: When using the “:inline” piping option for File Upload files inside an email body (e.g., survey invitations, alerts), if the uploaded file is not an image file, it will still attach the file to the email but will display the file's filename in the email text as an alternative to displaying it as an inline image.
  • Major bug fix: A race condition can occur when two records are being randomized at the exact same time, in which it is possible that they both mistakenly receive the same allocation and same value for the randomization field in the project. (Ticket #99159)
  • Minor security fix: In several places where a user can download a CSV file of various settings (e.g., export of Data Quality rules), it might be possible for a malicious user to perform CSV injection in a CSV file that is downloaded and opened in Microsoft Excel by another user, in which dangerous code could be injected and executed unknowingly by the user on their computer.
  • Change: In order to help emphasize the "NIH/NLM Catalog" more in the new Field Bank feature, the "REDCap Catalog of Common Data Fields" has been removed indefinitely as an option in the Field Bank dialog in the Online Designer.
  • Change: The Field Bank feature in the Online Designer can now be disabled at the system level on the "Modules/Services Configuration" page in the Control Center. Once disabled, the "Import from Field Bank" button will no longer appear in the Online Designer for any user.
  • Change: Some language on the Survey Settings page was modified for clarity with regard to the Time Limit for Survey Completion feature to note that it is not applicable to survey links sent via Alerts & Notifications.
  • Bug fix: In some situations where embedded fields have branching logic that is triggered by other embedded fields, if the parent field of those embedded fields is itself triggered by branching logic, then some of the embedded fields inside the parent might mistakenly be displayed when they should be hidden by branching logic.
  • Bug fix: When using the ":inline" piping option to display a PDF file inline on a webpage after it had been uploaded to a File Upload field, in specific circumstances with regard to the text/HTML surrounding the piped field, the inline piping of the PDF file may fail to display on the page.
  • Bug fix: When using the ":inline" piping option to display a PDF or image file inline on the same instrument on which the File Upload field itself exists, the inline piping of the PDF/image would fail to work. However, it would coincidentally work if the File Upload field was using the @INLINE action tag.
  • Bug fix: When clicking the "Send-It" link to send a file from inside a project (e.g., a data export file or a file from File Repository), after submitting the page to send the file to the desired recipients, an error message would mistakenly display saying that the user does not have permission to the file. Thus the file would not be sent. Note: This does not affect the main Send-It page that is accessible via the tab on the main REDCap home page, etc.
  • Bug fix: When a survey participant is taking a PROMIS, NeuroQoL, NIH Toolbox, etc. assessment that is adaptive or has auto-scoring, the "Anchor Text" would mistakenly not be displayed on the survey page for the first and last choices of the survey question (assuming anchor text exists for the question).
  • Bug fix: When using the Custom Record Label and/or Secondary Unique Field in a project that contains many records (i.e., thousands or more), running Data Quality rules would mistakenly take an inordinate amount of time to return the results.
  • Bug fix: When using the Custom Record Label and/or Secondary Unique Field in a project that contains many records (i.e., thousands or more), the Resolve Issues page (available when using the Data Resolution Workflow) would mistakenly take an inordinate amount of time to load.
  • Bug fix: The Configuration Check page might mistakenly display a yellow recommendation saying that the MySQL/MariaDB query cache is not enabled but mistakenly does not tell the user that they should set the setting query_cache_type to "ON" or "1" in their My.cnf or My.ini config file. It now checks the query_cache_type setting to recommend that it be enabled.
  • Bug fix: On a data entry form or survey, it might be possible in very specific situations for hidden radio elements to mistakenly be selected and be somewhat visible on the page. This would not affect any data but might cause confusion to the user. (Ticket #99271)
  • Bug fix: Fixed a fatal PHP error that occurs on certain pages in PHP 8 only. (Ticket #99323)
  • Bug fix: If an embedded checkbox field has the @READONLY action tag, it would mistakenly be possible to check/uncheck the checkbox and thus change its value by clicking its choice label, although clicking the checkbox element itself would do nothing and would remain read-only, as expected. (Ticket #99322)
  • Bug fix: If a file that is uploaded for a File Upload field or for a message in REDCap Messenger exceeds the maximum file size as defined by the server or by REDCap's configuration, the file's metadata would mistakenly remain in the database and (if the file size exceeded the REDCap limit but not the server limit) the file might still remain on the server. It will now set the file to be removed from these places when this occurs. (Ticket #99324)
  • Bug fix: When piping a field into a label on a data collection instrument in a longitudinal project in which the piped field variable is prepended with the [previous-event-name] Smart Variable, the piping would fail to work in certain specific contexts, such as if the instrument of the field being piped is not designated on the previous event when viewing a different instrument on the next event. In these cases, it would mistakenly display six underscores (as if there is no value) rather than the real value. (Ticket #99342)
  • Change: For longitudinal projects that are in production, the Define My Events now displays an extra warning that warns that renaming events could cause disastrous effects if any unique event names are utilized in conditional logic, branching logic, calculations, reports filters, data quality rules, etc.
  • Bug fix: In the field-view in the Online Designer, the floating help boxes on the right of the page might mistakenly overlap some of the instructional text. (Ticket #98688)
  • Bug fix: When a multi-page survey has fields utilizing the @CALCTEXT or @CALCDATE action tag, in which those fields themselves are used in a calculation or branching logic on a separate page that also does not display the fields utilized inside the @CALCTEXT or @CALCDATE logic, it would mistakenly display an error message on the survey page. (Ticket #98545)
  • Bug fix: If a user is attempting to enable the Secondary Unique Field on a field that somehow has records with blank values (for the "value" column) saved for that field in the database, REDCap would mistakenly not allow the user to enable the Secondary Unique Field for the field. (Ticket #83279)
  • Bug fix: If utilizing certain Smart Variables inside the query of a Dynamic SQL Field (e.g., [record-name]), the Smart Variable would mistakenly not get escaped in the query, which might cause the query to fail and not return the desired results.
  • Bug fix: When editing logic in the Logic Editor for the Survey Queue or Automated Survey Invitations, if a syntactical error exists in the logic, it might mistakenly create an infinite loop where the error popup keeps displaying and is not able to be fully closed, thus causing the user to have to reload the page. (Ticket #99412)

Version 10.7.0 (released on 2021-01-14)

CHANGES IN THIS VERSION:

  • New feature: Field Bank - When adding new fields via the Online Designer, users will see an "Import from Field Bank" button, which will allow them to search different standardized catalogs of commonly used fields, such as in the U.S. National Library of Medicine catalog. The Field Bank helps users add new fields quickly and easily to their data collection instruments. Over time, more standardized catalogs of fields will be added to the Field Bank.
  • New feature: @INLINE action tag - Allows a PDF file or image file (JPG, JPEG, GIF, PNG, TIF, BMP) that is uploaded to a File Upload field to be displayed in an inline manner on the survey page or data entry form so that the PDF/image can be viewed by the user or survey participant without having to download it.
    • The PDF/image will be displayed inline on the page immediately above the download link for the field and will be displayed with 100% width by default (i.e., 100% width of the area in which it is contained).
    • Images will be displayed with their native width:height ratio, although PDFs will be displayed with a 300 pixel height by default. If you wish to manually set the width and/or height of the image/PDF, you may put the width/height values inside parentheses after the action tag in the following manner: @INLINE(width) or @INLINE(width,height). The width/height can be a percentage value (e.g., 50%) or a number representing size in pixels (e.g., 400). Thus @INLINE(50%) will display an image at 50% size for the area in which it is contained on the page, and @INLINE(400,100) would display the image always at 400px tall and 100px wide. To make an inline PDF appear taller on the page, you might use @INLINE(100%,600) since 300px is the default height for inline PDFs.
    • The @INLINE action tag also works if the File Upload field is embedded inside another field on the page.
    • Thanks to Andy Martin for his inspiration for this feature, in which it is based on his “Image Viewer” external module. NOTE: Upgrading to REDCap 10.7.0 will *not* automatically disable the “Image Viewer” module if it is installed and enabled on any projects, nor will it conflict with the “Image Viewer” external module.
  • New feature: New “:inline” piping option for File Upload fields
    • If piping using the ':inline' option for a File Upload field, such as [my_field:inline], in which the uploaded file is a PDF file or image file (JPG, JPEG, GIF, PNG, TIF, BMP), the file will be displayed in an inline manner so that it is viewable on the page.
    • The ':inline' option DOES work inside emails, so you can pipe a field with ':inline' inside the email body, thus allowing you to display inline images inside survey invitations or Alerts & Notifications.
    • The @INLINE action tag does not need to be used on a field in order to utilize the “:inline” piping option.
    • Note: Inline images are not able to be displayed inside a downloaded PDF of a survey/instrument that contains data.
  • Improvement: In the Online Designer, any fields that have action tags will have those action tags listed immediately below the field in the table on that page. This makes it easier to know if a field has a certain action tag without having to open the Edit Field dialog for the field.
  • Major bug fix: On a survey page or data entry form, if a slider field already has a value saved for it before the time that the page is loaded, and a user then modifies the slider field value, while it would appear that the slider's value has changed, it mistakenly has not. Bug emerged in REDCap 10.6.2. (Ticket #98450)
  • Change: PHP 7.0.0 is now the new minimum PHP version that is required for running REDCap. Thus all versions of PHP 7 and PHP 8 are currently supported.
  • Bug fix: The Configuration Check page was mistakenly displaying MySQL database configuration suggestions for the MySQL query cache setting even though the query cache is deprecated in MySQL 5.7.20+. It will now no longer suggest changes to the query cache if using MySQL 5.7.20+. Note: This issue was supposedly fixed in REDCap 10.6.3 but mistakenly was not. (Ticket #97786)
  • Bug fix: If using an if() function inside the @CALCTEXT action tag, in which the if() function is outputting text that contains a comma, it would mistakenly display an error message on the survey page or data entry form.
  • Bug fix: If a longitudinal project's Automated Survey Invitation (ASI) has conditional logic that contains datediff() with "today" or "now" as a parameter and also has a field in the logic that is prepended with any "event-name" Smart Variable, then the ASI cron job that runs every 4 hours might mistakenly schedule invitations when it shouldn't or might mistakenly remove some already-scheduled invitations (but only if the "Ensure logic is still true before sending invitation?" option is checked).
  • Bug fix: The option “UNK, Unknown” was missing from the “race” field options when using the Clinical Data Pull (CDP) feature.
  • Bug fix: Two Laboratory fields (including a COVID-related one) and their associated LOINC code were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: In some cases, the @CALCDATE action tag might mistakenly return the value "NAN" when it should return a blank/"" value. This often happens when one or more of the parameter values for @CALCDATE are blank. Bug emerged in REDCap 10.6.3.
  • Bug fix: In a longitudinal project, if a field on a repeating instrument or repeating event has branching logic that contains a field name appended with the Smart Variable "first-instance" or "last-instance", the branching logic might mistakenly not get parsed correctly and would display a branching logic error popup on the survey page or data entry form. (Ticket #98427)
  • Change: The "Help & FAQ" page was updated with new content.
  • Bug fix: In certain situations where an [X-instance] Smart Variable in piping, it would cause PHP to crash with a fatal error if using PHP 8. (Ticket #98920)
  • Bug fix: Ways were found where a user could access a file uploaded to a File Upload field that exists in another project, specifically via the Send-It link on data entry forms or via downloading the "ZIP file of uploaded files (all records)". However, this could only be done if the user has access to that other project.

Version 10.6.3 (released on 2020-12-30)

CHANGES IN THIS VERSION:

  • Database performance improvements: New cron job was added to check the percentage of database connections being used, in which it will notify the REDCap administrator if more than 2/3 of MySQL's max connections have been used. Also, to preserve system performance, the cron job will automatically kill any long-running database queries (queries running longer than 30 minutes or any sleeping connections that are more than 60 minutes old).
  • Improvement: Field embedding can now be used for embedding a Descriptive field inside another field (even though descriptive fields do not have an actual input element for saving data). Embedding a descriptive field would merely relocate the field's label to the new location where it is embedded. This is typically only useful if the descriptive field has branching logic, in which you could use branching logic to make the descriptive field's text appear conditionally in a specific place on the page.
  • Improvement: A link to the "REDCap Language Library" has been added to the Control Center's left-hand menu. The Language Library is a centralized place where administrators can download and share language files where the stock text in REDCap has been translated into another language.
  • Major bug fix: If using the datediff() function in a calculated field or in the @CALCTEXT action tag, if the returnSignedValue parameter is provided and has a TRUE value in the function but the dateFormat parameter is not provided, then the calculation might mistakenly return a positive number value on the page if the value is actually a negative number. Note: This could be fixed if running Data Quality rule H.
  • Bug fix: If a survey participant sends an SMS message to a Twilio phone number that is set up for a REDCap project, REDCap would reply simply with "Please enter your access code to begin the survey", which might be unexpected in some situations, such as if the participant sent the SMS to this number by accident or if they sent it before they were invited to take the survey. More response text has been added to the message now to provide more clarity to the respondent in these situations. (Ticket #97520)
  • Bug fix: When clicking the "M" icon to open the Missing Data Code menu for an embedded field on a data entry form, it would mistakenly not display the menu at all or it would display it on the wrong location on the page.
  • Bug fix: Fatal PHP error occurs in some branching logic parsing if running PHP 8.0. (Ticket #98045)
  • Bug fix: When using Twilio telephony services for Alerts & Notifications, the Notification Log would mistakenly fail to display the recipient's phone number on the page if a phone/number field is being used as the recipient's phone number. Instead it would merely display the unpiped variable name in the Recipient column.
  • Bug fix: When using Twilio telephony services for Alerts & Notifications and viewing a scheduled or sent notification via the View Notification dialog on the Notification Log, it would mistakenly fail to display the recipient's phone number in the dialog if a phone/number field is being used as the recipient's phone number. Instead it would merely display the unpiped variable name.
  • Bug fix: When viewing the Notification Log for Alerts & Notifications, it might mistakenly fail to display unsent/scheduled notifications in the log in certain cases if the "End time" filter is set to a blank value. This might make it appear as if the notification has not been scheduled.
  • Bug fix: The Configuration Check page was mistakenly displaying MySQL database configuration suggestions for the MySQL query cache setting even though the query cache is deprecated in MySQL 5.7.20+. It will now no longer suggest changes to the query cache if using MySQL 5.7.20+. (Ticket #97786)
  • Bug fix: If users cannot create projects on their own but must request that admins create them on their behalf, an administrator creating the project for a user mistakenly needs to have the "Allow this user to request that projects be created for them by a REDCap administrator?" privilege enabled for their user account. This should not be required but should be implied via their status as an admin. (Ticket #98128)
  • Bug fix: When performing a data import of a CDISC ODM (XML) file that contains only data (i.e., metadata not included), in which the XML file contains base64-encoded binary files for File Upload fields, those File Upload files would mistakenly be ignored during the import process and would not be imported with the rest of the data. (Ticket #96800)
  • Bug fix: When creating a new REDCap project using a Project XML file, in which the XML file contains surveys and fields with Stop Actions, the Stop Actions would mistakenly not get added to the fields for the new project created. (Ticket #97959)
  • Bug fix: When performing a data import where the uploaded data set contains checkbox fields, REDCap would mistakenly allow values of "1.0" and "0.0" (and other approximations of "1" and "0") to be imported for checkbox fields. This would also cause the values not to save correctly for these fields, even though the logging implies otherwise. It should only explicitly allow values of "1" and "0" for checkboxes. (Ticket #97972)
  • Bug fix: When editing conditional logic for surveys in the Survey Queue dialog on the Online Designer, if the logic contains a syntactical error, it might persistently keep opening the Logic Editor over and over, thus preventing the user from successfully closing it and saving their changes. (Ticket #98213)
  • Bug fix: If a project has Double Data Entry enabled and DDE person #1 or #2 is viewing a custom record status dashboard, the dashboard will mistakenly return incorrect results on the page for custom dashboards that have filter logic defined. (Ticket #97174)
  • Bug fix: In a longitudinal project that contains repeating instruments and/or repeating events, if a custom data quality rule has logic that contains a field whose data collection instrument exists in both repeating and non-repeating contexts in the project, the data quality rule might not always return all the discrepancies that exist. (Ticket #97508)
  • Bug fix: If a project was marked as Completed, any Alerts & Notifications or survey invitations that had been previously scheduled would mistakenly continue to send. They should not send if a project is marked as Completed.
  • Bug fix: If reordering Report Folders inside the Report Folder dialog while using PHP 8.0, it would fail with a fatal PHP error. (Ticket #98217)
  • Bug fix: The language in the Account Expiration email to users (and their sponsor, if applicable) has been modified to provide more clarity to the user receiving the email. (Ticket #58767)
  • Bug fix: If a project has Double Data Entry enabled and DDE person #1 or #2 is viewing the record status dashboard, the Custom Record Label (if enabled) would fail to display on the page next to the record names. (Ticket #97116)
  • Bug fix: If a data collection instrument's unique instrument name contains a triple underscore, in which its name was manually set via Column B in a data dictionary upload, when entering data for this instrument on the data entry form, the value for the instrument's form status complete field would fail to save successfully and thus would always get set to Incomplete ("0"). Note: This would not affect data imports or surveys but only data entered on the data entry form. (Ticket #96547)
  • Bug fix: If using the @NONEOFTHEABOVE action tag on a checkbox field that is embedded inside another field, the @NONEOFTHEABOVE functionality would not function correctly if the user clicked the checkbox label to check/uncheck the option (as opposed to clicking the checkbox element itself). (Ticket #98269)

Version 10.6.2 (released on 2020-12-18)

CHANGES IN THIS VERSION:

  • Improvement/change: REDCap is now compatible with PHP 8.0
  • Improvement: Field variables and Smart Variables can now be piped into the "src" attribute of HTML image tags ("img"). Previous versions did not allow this but would allow the piping of values into the "href" attribute of hyperlinks. Now both are possible. Note: The value being piped into the "src" attribute must have already been saved prior to the page loading, which is how piping for the "href" attribute has always worked.
  • Minor security fix: Due to a vulnerability in the third-party JavaScript library "Handlebars", the library was updated to the latest version. (Ticket #97725)
  • Minor security fix: Due to a vulnerability in the third-party library TinyMCE, the library was updated to the latest version. (Ticket #97725)
  • Minor security fix: The "Prevent Clickjacking" security feature would mistakenly not work successfully on a certain page when that page is called in an unexpected manner without a "pid" parameter in the URL. (Ticket #97736)
  • Minor security fix: A Cross-Site Request Forgery (CSRF) vulnerability was discovered where a malicious user could potentially bypass the CSRF check by adding a specific parameter to HTTP requests in the application.
  • Bug fix: If a user clicks on a status icon for a repeating instrument on the Record Status Dashboard, in which there are many repeating instances for the record-instrument, it might display the popup list of repeating instances so that they mistakenly run off the top of the page, making it impossible to close the floating popup or to view it completely.
  • Bug fix: If a radio button or slider field has a Missing Data Code as its value, clicking the "reset" link next to the field would mistakenly not remove the Missing Data Code label from the user interface below the field, even though it would correctly set the value to blank/null for the field. (Ticket #97028)
  • Bug fix: If a slider field has a value and is being hidden by branching logic, in some scenarios it might mistakenly display the "survey errors exist" error on surveys or might keep displaying the "erase value" prompt repetitively in an infinite loop on a data entry form. (Ticket #97395)
  • Bug fix: If a survey participant clicks the “Survey Queue” icon at the top right of the survey page, in which the queue contains a lot of items so much that the queue is taller than the page itself, the queue would mistakenly run off the top or bottom of the page and would not be closable. (Ticket #96613)
  • Bug fix: If a survey title contains HTML tags, the tags would mistakenly be displayed in the drop-down list of surveys in the Participant List.
  • Bug fix: When an Automated Survey Invitation is triggered by a data import where a new record is being create, and the ASI email body contains a [survey-link] or [survey-url] Smart Variable that points to a survey other than the current one for which the ASI is being triggered, it would mistakenly not pipe the survey link/URL successfully into the email body. (Ticket #96305)
  • Bug fix: If the REDCap web server is running a version of PHP that is higher than the recommended PHP versions supported by REDCap, the "Server info" text at the top of the main Control Center page might mistakenly display a warning with incorrect text about the need to upgrade PHP. (Ticket #96749)
  • Bug fix: When using the SendGrid API to send emails from REDCap, the Reply-To email header would mistakenly not get set correctly and would thus cause all replying emails to be sent to the Global "From" Email Address instead of the actual sender's email.
  • Bug fix: If a date or datetime field is embedded inside the choice label of a checkbox field, clicking the Today/Now button for the embedded date/datetime field would mistakenly check or uncheck the checkbox choice in which it is embedded. (Ticket #97719)
  • Bug fix: On the Alerts & Notifications page, when modifying an alert that previously had the option set to send it "Every time the form/survey in Step 1B is X", and then when the alert was later opened after being saved, if it was changed in Step 1A (selecting the third radio option) so that that choice was no longer viable and was hidden in the dialog, it would still keep the alert listed as a recurring alert in the backend database table, which could cause it to not get triggered or sent at the correct times. Note: This fix will prevent this issue from occurring in the future and will also retroactively fix any alerts that have been saved incorrectly due to this bug. (Ticket #97507)
  • Bug fix: 13 Laboratory and Vital Signs fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: When calling the "Export List of Export Field Names" API method or the REDCap::getExportFieldNames() method for a project that has Missing Data Codes defined, it would mistakenly fail to add the Missing Data Codes as extra choice options for checkbox fields (excluding fields with the @NOMISSING action tag). (Ticket #96240)
  • Bug fix: When a project is being permanently deleted (either by an administrator on the Browse Projects page or via the cron job 30 days after a user has "deleted" the project), it would mistakenly fail to log the very last event for the project (i.e., that the project is itself being permanently deleted), which should include the following info about the project in this last logged event: the project title, project ID, number of fields, number of records, current project status, and list of current project users.
  • Bug fix: When processing a user request on the To-Do List page, in which the user making the request has an apostrophe in their email address, it might cause the request not to load successfully in the dialog on the To-Do List page. This only affects certain types of requests, such as moving a project to production. (Ticket #96958)
  • Bug fix: When a matrix field is embedded inside another field on a survey page or data entry form, in which some other fields on the page contain branching logic that reference the embedded matrix field, the branching logic might silently fail to show or hide the other field correctly. (Ticket #97114)
  • Bug fix: When accessing the REDCap server from a domain that is not the domain seen in the REDCap Base URL value (i.e., when using REDCap over multiple domains), the HTTP redirecting that occurs when REDCap is building a project's record list cache (which is an automatic process), would mistakenly redirect the user to the other domain that is set in the REDCap Base URL. Thus the user ends up on the other server/domain by mistake. It now keeps the user on the current domain during this redirect process. (Ticket #97777)
  • Bug fix: When an administrator is using the "View Project as User" feature, the "Dynamic Query (SQL) Field" option would mistakenly be displayed for them when adding a new field in the Online Designer. (Ticket #96865)
  • Bug fix: The Java code that is auto-generated by the API Playground mistakenly had some missing closing parentheses in the MyClass constructor. (Ticket #96565)
  • Change/improvement: Small changes to improve the overall web accessibility of REDCap, especially on survey pages, such as increasing the contrast ratio of many light-colored labels and adding/removing "aria-X" HTML attributes where appropriate.
  • Bug fix: The Java code that is auto-generated by the API Playground mistakenly had some syntactical errors for certain API methods. (Ticket #97855)
  • Bug fix: In a longitudinal project where a field is used both in a non-repeating context and in a repeating instrument or repeating event, if a calculation or branching logic references the field in which it has the Smart Variable "[current-instance]" appended to it, the calc/logic might not get parsed correctly in the non-repeating context and thus would cause the calculation/branching logic not to evaluate correctly. (Ticket #96777)
  • Bug fix: When a field is embedded using the ":icons" attribute (e.g., {date_of_birth:icons}), it might not display correctly on the page, in which it might be displaying too widely or creating unnecessary text wrapping. (Ticket #96838)

Version 10.6.1 (released on 2020-12-10)

CHANGES IN THIS VERSION:

  • Improvement: The Logging page in a project now defaults to only displaying the logged events from the past week, although users can always adjust the filter settings to expand the time range values after initially loading the page. This change makes the Logging page load much faster when initially loaded by a user.
  • Improvement: The Logging page in a project now has helpful buttons to quickly adjust the time range filters to Past Day, Past Week, Past Month, Past Year, and all time (“no limit”) to make it easier for users to view the logging from various time ranges.
  • Improvement: The Logging page in a project now has more download options for exporting the logging. In addition to exporting all logged events, there are now the following new buttons: 1) Export all pages using current filters and 2) Export current page.
  • Improvement: When downloading a PDF of a data collection instrument containing a File Upload field that is embedded in another field, it will now display the file name of the uploaded file in the PDF rather than the doc_id number (i.e., the raw data value). This change only involves embedded fields since normal/non-embedded File Upload fields already display the file name of the file in the PDF.
  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags and/or JavaScript event attributes in a very specific way into the URL on certain REDCap pages. (Ticket #97362)
  • Minor security fix: A Blind SQL Injection vulnerability was found on the User Rights page, in which a malicious user could potentially exploit it by manipulating an HTTP request on that page. (Ticket #97347)
  • Minor security fix: An Unrestricted File Upload vulnerability was found on the API Playground page, in which a malicious user could potentially exploit it by manipulating an HTTP request on that page for the Import File API method. (Ticket #97372)
  • Bug fix: When viewing certain adaptive instruments that have been downloaded from the REDCap Shared Library, in which one of the multiple choice options has both a code and value of "0", the label for that choice would mistakenly not be displayed next to its radio button, so it would appear not to have a label.
  • Bug fix: For the Data Mart and Clinical Data Pull services, the action “Fetching data from FHIR endpoint” was mistakenly getting logged on the project Logging page for every time that REDCap would make a call to the EHR, even when no new data is stored in REDCap from the EHR. It should not have been logging that but instead only logging when data points are actually imported.
  • Bug fix: For unknown reasons, the Ace Editor library (used by the new Logic Editor) is not compatible with Bootstrap dialogs when using the Firefox browser. This prevents the Logic Editor from being usable on the Alerts & Notifications page. To deal with this conflict (until a solution has been found), if a user is using Firefox, the Logic Editor will not be used on the Alerts & Notifications page. (Ticket #96992)
  • Bug fix: When a calc field or pseudo-calc field (e.g., @CALCTEXT) has an equation that references a multiple choice field that contains dashes in one or more of its choice values/codes, in which the value/code is greater than a certain length, the calculation may return a blank value rather than the correct value. (Ticket #97055)
  • Bug fix: When moving a project to production and deleting all records in the process, or if a user clicks the "Erase all data" button in a development project, any records that have been locked at the record level would mistakenly still have their locked status maintained after the record deletion. This could cause issues in the future if a record is created afterward and has the same record name as a previously-locked record. (Ticket #97167)
  • Bug fix: When a plugin, hook, or external module calls the method REDCap::getProjectXML(), it would mistakenly not include the "redcap::SurveysGroup" entry and other project-level information in the resulting XML. (Ticket #97151)
  • Bug fix: When viewing a data entry form that has drop-down fields with the auto-complete option enabled, the drop-down list might mistakenly be displayed incorrectly as if it is very narrow and has no options to select. Note: This issue occurs on data entry forms but not on survey pages.
  • Bug fix: The survey-date-complete or survey-time-complete Smart Variable would mistakenly not work correctly in some calculations and in many cases would display a calculation error message. Bug emerged in REDCap 10.0.29 LTS and 10.5.2 Standard. (Ticket #97057)

Version 10.6.0 (released on 2020-11-30)

CHANGES IN THIS VERSION:

  • New feature: New logic editor for conditional logic, branching logic, calculations, report filters, etc. In every place where users might add/edit logic or calculations, the new logic editor will be displayed in a modal dialog to provide a better user experience for entering their logic. The logic editor provides much more space for entering large amounts of logic, including a fullscreen mode to take maximum advantage of their screen’s real estate. It also provides bracket-matching and parentheses-matching where it will highlight a pair of matching brackets/parentheses to make it easier for users to gauge which brackets/parentheses belong together in the logic, thus reducing possible errors in the logic when typing.
  • New feature: Auto-numbering of repeating instances for data imports - When using repeating events or repeating instruments, it may be difficult when performing dynamic imports of data for these because it is not easily known how many repeating instances already exist in a project for a given repeating event/instrument, thus often forcing users to invent clever ways to determine this, such as performing data exports beforehand and then dynamically determining what the next repeating instance number should be. However, that is no longer necessary. When performing a data import now for a repeating event/instrument, users may use the literal value “new” as the value for the “redcap_repeat_instance” field in their data import. By doing so, REDCap will perform the instance auto-numbering on its own to increment the repeating instances properly based on the highest numbered instance that already exists in the saved data in the project.
  • New feature: New survey option “Save a PDF of completed survey response to a File Upload field” - On the Survey Settings page in the Online Designer, users may select a File Upload field in the project where a static PDF file of a participant’s survey response will be stored immediately after they complete the survey. For longitudinal projects, if the target field exists on multiple events, users may set this feature so that it stores the PDF in the selected field in the current event (default) or else in a specific event in the project. Thanks to Philip Chase and his team at University of Florida for their inspiration for this feature, in which it was based on their “Save Survey PDF to Field” external module. NOTE: Upgrading to REDCap 10.6.0 will *not* automatically disable the “Save Survey PDF to Field” module if it is installed and enabled on any projects, nor will it transfer the saved settings of that module into this new feature in REDCap.
  • Improvement: File Upload fields and Signature fields may now be used in piping. If you are piping *from* a File Upload field or Signature field, the field's numerical value will be piped by default, but you may pipe the original filename of the uploaded file by appending the ':label' option, such as [my_field:label].
  • Improvement: The REDCap::saveData method for plugins/hooks/modules now has an alternative way of passing parameters to the method. Rather than providing the method's parameters individually, they instead may be passed to the method in an associative array, in which each key in the array exactly matches the parameter names listed above (must match case). Note: Not all the parameters have to be included in the array, but only the ones one wishes to set explicitly. Example: $params = array('dataFormat'=>'json', 'type'=>'flat', 'data'=>'[{"record_id":"1","age":"41","dob":"1978-07-20","form_1_complete":"0"}]');$response = REDCap::saveData($params);
  • Change/improvement: Users are now permitted to import data values for Biomedical Ontology fields. In previous versions, this was not allowed and would return an error message when a user attempted this. The Data Import Tool now displays a warning (instead of an error) that informs users that importing data for such fields is allowable but is not recommended because the value might not display correctly if viewed afterward on a report or in the data entry interface, in which this is caused by the fact that the label is missing because it has not been fetched via the BioPortal web service and then cached in REDCap's database tables. (Ticket #8096)
  • Bug fix: If a user has REDCap Messenger opened and is viewing the System Notifications or the General Notifications channel, if they navigate from page to page while leaving Messenger opened, the messages in either of those channels would mistakenly fail to display until they clicked the "System Notifications" or "General Notifications" links in the Messenger window.
  • Bug fix: If a user is using REDCap Messenger, the height of the Messenger window might not get calculated correctly and thus might mistakenly run off the bottom of the page (making it impossible to read all the messages) or else might leave unnecessary extra space at the bottom of the page.
  • Bug fix: When importing the value for a field that is referenced inside the @CALCTEXT action tag of another field, the import process would mistakenly fail to update the @CALCTEXT field. (Ticket #96419)
  • Bug fix: In a longitudinal project where a checkbox field is referenced in the branching logic and/or calculation of another field on the same instrument, in which the branching logic or calculation references that checkbox field on the same event and also on other events (i.e., cross-event logic/calc), the branching logic and/or calculation will evaluate correctly when the page is initially loaded, but if the checkbox's value gets modified on that page by checking/unchecking any of its choices, the branching logic and/or calculation might begin not to evaluate correctly anymore on that page until the page is refreshed or returned to at a later time. (Ticket #95744)
  • Bug fix: Forty-three Laboratory fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Change: On the Survey Settings page, the e-Consent Framework setting "Allow e-Consent responses to be edited by users?" is now pre-selected by default when enabling the e-Consent Framework.
  • Bug fix: When importing data for pseudo-calc fields (i.e., fields with the @CALCDATE or @CALCTEXT action tag), it would mistakenly allow values for such fields to be imported. It should instead prevent values for pseudo-calc fields from being imported since their value will be calculated automatically during the import process. Similar to calculated fields, any pseudo-calc fields will be ignored during the data import process. If values for pseudo-calc fields need to be updated en masse, this can be done by running Data Quality rule H.
  • Bug fix: The "View project as user" feature would mistakenly not work correctly on the Other Functionality page in a project, and thus it might display some things that it should not and also might hide some things that should be displayed.
  • Bug fix: The "Time Limit for Survey Completion" option on the Survey Settings page would mistakenly not function correctly if using MySQL 8. (Ticket #94256)
  • Bug fix: When a repeating instrument is enabled as a repeating multi-page survey in a longitudinal project, and all the fields on a given survey page are hidden by branching logic, in which the the fields in the branching logic does not have [current-instance] appended to them, then in certain circumstances a survey page might mistakenly get skipped while a participant is taking the survey. (Ticket #96426)
  • Bug fix: The ontology Current Procedural Terminology (CPT) was removed from the list of BioPortal Ontology Services since that ontology is no longer usable by the BioPortal service due to licensing reasons.

Version 10.5.2 (released on 2020-11-20)

CHANGES IN THIS VERSION:

  • Improvement: The "E-signature and Locking Management" page in a project now displays information with regard to record-level locking, whereas in previous versions it only displayed information for instrument-level locking. (Ticket #95496)
  • Bug fix: In the Add/Edit Field popup in the Online Designer, if the user selects "Slider" from the Field Type drop-down, whenever they have their cursor inside any of the fields in the "Labels displayed above slider" section in the popup and then they click Enter on their keyboard, it would mistakenly display an unrelated popup dialog about SQL Fields. (Ticket #96061)
  • Bug fix: The action tags @CALCDATE and @CALCTEXT might fail to work correctly or might display an error on the form/survey page if they are referencing a field from another event in a longitudinal project. (Ticket #95993)
  • Bug fix: If using the Smart Variables [form-link], [form-url], [survey-link], [survey-url], [survey-queue-link], [survey-queue-url], [survey-time-completed], or [survey-date-completed] in branching logic or in a calculated field's equation, an error message might mistakenly display on the data entry form or survey page saying that there is something syntactically incorrect about the logic/calculation. (Ticket #96080)
  • Change: Added more informative text in the Biomedical Ontology information popup regarding the use of the BioPortal API web service and also how to contact BioPortal directly if a user has specific questions about their service.
  • Bug fix: When new records are created rapidly in a project, especially when they are created nearly simultaneously, it could cause the record list cache on the database back-end to mistakenly get out of sync, thus causing record dashboards, reports, etc. to display the records in an incorrect order. (Ticket #94027)
  • Bug fix: If a field with variable name "title" is used in the branching logic of another field, it would mistakenly display a branching logic error on the page. (Ticket #96154)
  • Bug fix: If a data entry form or survey page has many fields with branching logic, the page might load unexpectedly slow because of an inefficiency with the process of checking if any embedded fields exist on the page. The inefficient code has been fixed so that if field embedding is not being used on a data entry form or survey page, the branching logic of all fields on the page will be processed 10x-30x faster than in previous versions of REDCap 10.X, thus making the page load much more quickly, especially when the instrument contains many fields. (Ticket #92556)
  • Bug fix: If a Signature field or File Upload field is embedded inside another field on an instrument, if the field is Left-aligned (LV or LH) and the instrument has been taken as a survey, in which the survey participant has uploaded a file for the field, the field would fail to embed and would appear invisible when viewed on a data entry form prior to the user clicking the "Edit response" button.
  • Bug fix: If the record name is very long for a record in a project, the record name in the Action column of the Logging page might overflow onto other text in the Logging table, thus sometimes making it unreadable.
  • Bug fix: If a survey has the e-Consent Framework enabled and is using a survey theme, the e-Consent certification box and text on the last page of the survey would mistakenly not respect the survey theme colors. (Ticket #96277)

Version 10.5.1 (released on 2020-11-12)

CHANGES IN THIS VERSION:

  • Major bug fix: If a user is in a classic/non-longitudinal project and selects an instrument after clicking the "Show data collection instruments" link on the left-hand menu, the instrument page displaying the record drop-down lists would mistakenly be only partially displayed due to a fatal PHP error on the page.
  • Bug fix: On the Configuration Check page, it was mistakenly displaying MySQL database configuration suggestions for the MySQL query cache setting even though the query cache is deprecated in MySQL 8.0. It will now no longer suggest changes to the query cache if using MySQL 8.0. (Ticket #95873)

Version 10.5.0 (released on 2020-11-12)

CHANGES IN THIS VERSION:

  • New action tag: @PREFILL - Sets a field's value to static text or dynamic/piped text whenever a data entry form or survey page is loaded, in which it will always overwrite an existing value of the field. The format must follow the pattern @PREFILL="????", in which the desired value should be inside single or double quotes. A field with @PREFILL will always be read-only, thus its value cannot be modified manually on the data entry form or survey page. For text fields, you may pipe and concatenate values from other fields in the project - e.g., @PREFILL='Name: [first_name] [last_name], DOB: [dob]'. For checkbox fields, simply separate multiple checkbox values with commas - e.g., @PREFILL='1,3,[other_field:value]'. NOTE: The piped value does *not* get applied during any data imports (via API or Data Import Tool) but only operates when viewing survey pages and data entry forms. NOTE: A field with @PREFILL will have its value updated ONLY when the page loads, which means that its value will not be updated in real-time if you modify other fields on the same page that are piped into the @PREFILL tag. NOTE: If being used on a date or datetime field, the date value inside the quotes must be in Y-M-D format - e.g., @PREFILL='2007-12-25' - regardless of the field's set date format. NOTE: The only difference between @PREFILL and @DEFAULT is that @DEFAULT is only applied when an instrument has no data yet, whereas @PREFILL will always be applied on an instrument, meaning that @PREFILL will ALWAYS overwrite the value if a field value already exists. TIP: To pipe the value of one multiple choice field into another multiple choice field, make sure you append ':value' to the variable being piped - e.g., @PREFILL='[my_dropdown:value]'.
  • New special functions: left(), right(), mid(), length(), find(), trim(), upper(), lower(), and concat(). These nine new functions can be specifically used when dealing with text values and may be especially useful when using them in conjunction with the @CALCTEXT action tag. To learn more and to see some practical examples of their usage, click the blue 'Special Functions' button in the Online Designer in any project.
    • left (text, number of characters) - Returns the leftmost characters from a text value. For example, left([last_name], 3) would return 'Tay' if the value of [last_name] is 'Taylor'.
    • right (text, number of characters) - Returns the rightmost characters from a text value. For example, right([last_name], 4) would return 'ylor' if the value of [last_name] is 'Taylor'.
    • length (text) - Returns the number of characters in a text string. For example, length([last_name]) would return '6' if the value of [last_name] is 'Taylor'.
    • find (needle, haystack) - Finds one text value within another. Is case insensitive. The "needle" may be one or more characters long. For example, find('y', [last_name']) would return '3' if the value of [last_name] is 'Taylor'. The value '0' will be returned if "needle" is not found within "haystack".
    • mid (text, start position, number of characters) - Returns a specific number of characters from a text string starting at the position you specify. The second parameter denotes the starting position, in which the beginning of the text value would be '1'. The third parameter represents how many characters to return. For example, mid([last_name], 2, 3) would return 'AYL' if the value of [last_name] is 'TAYLOR'.
    • concat (text,text,...) - Combines/concatenates the text from multiple text strings into a single text value. For example, concat([first_name], ' ', [last_name]) would return something like 'Rob Taylor'. Each item inside the function must be separated by commas. Each item might be static text (wrapped in single quotes or double quotes), a field variable, or a Smart Variable.
    • upper (text) - Converts text to uppercase. For example, upper('John Doe') will return 'JOHN DOE'.
    • lower (text) - Converts text to lowercase. For example, lower('John Doe') will return 'john doe'.
    • trim (text) - Removes any spaces from both the beginning and end of a text value. For example, trim(' Sentence with spaces on end. ') will return 'Sentence with spaces on end.'.
  • Improvement: The Configuration Check page will now provide MySQL/MariaDB database configuration recommendations to improve database performance and stability. REDCap will check and compare various MySQL/MariaDB configuration settings to identify any settings that are not set correctly or should be changed. Most of the suggestions are based on the same recommendations from a popular open-source product named MySQL Tuner. If no recommendations have been identified, the Configuration Check page will display a green checkmark icon with a short message saying that the configuration settings appear sufficient for optimal performance and stability.
  • Bug fix: One Laboratory field and its associated LOINC code was not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: Certain third-party PHP packages used in REDCap were mistakenly not compatible with PHP versions lower than PHP 7.2.5, and this would prevent some REDCap installations from upgrading to a recent release.
  • Bug fix: When using Missing Data Codes in a project that has a drop-down field or a radio button field with a @NOMISSING action tag, in which one of the choice codings of the drop-down/radio is exactly the same as a Missing Data Code, if the field's value was set to a choice that corresponds to a Missing Data Code, after saving the data entry form and then returning to it later, the field would mistakenly be disabled on the page, thus preventing anyone from changing its value. In this scenario, the field should not be disabled if the @NOMISSING action tag is being used. (Ticket #95510)
  • Bug fix: When an admin is using the "View Project as User" feature in a project, it might mistakenly display the "External Modules" link on the left-hand menu, even though the user being impersonated would never actually see that link displayed. (Ticket #95371)
  • Bug fix: When exporting a PDF of saved data, if the PDF contains a survey response in which a Participant Identifier value had been entered into the Participant List for that participant, the PDF would mistakenly always display the Participant Identifier at the top right corner of the PDF. If a user that has De-Identified export privileges or Remove Identifier export privileges is exporting the PDF, or if a survey participant is exporting the PDF of their own responses, it should not display the Participant Identifier inside the PDF. (Ticket #95435)
  • Bug fix: When importing certain PROMIS instruments or batteries from the REDCap Shared Library in which the instrument contains a T-Score and Standard Error field, if the PROMIS instrument is viewed as a data entry form in the REDCap interface, it might mistakenly display a branching logic error on the page. In these cases, the bug cannot be fixed except by deleting the instrument from the project (beware: this might delete or orphan any already-collected survey responses for the PROMIS instrument) and then by re-downloading it from the Shared Library. Bug emerged in REDCap 9.10.0 Standard and 9.5.28 LTS. NOTE: This would not impact the display of the PROMIS instrument when being taken as a survey by a participant.
  • Bug fix: When assigning records to Data Access Groups via data import, in certain scenarios the records being imported would get assigned to DAGs properly but the Record List Cache would mistakenly not get updated during the import process, thus causing specific pages (e.g., reports, Record Status Dashboard) not to display those records when filtering by their DAG. If this issue occurred, the only thing that would fix it would be for an admin to know to click the "Clear the Record List Cache" button in the project. (Ticket #95133)
  • Change: Added the project PID to the prepopulated email subject field when clicking the blue "Contact REDCap administrator" button on a project's left-hand menu.
  • Change: When uploading a file to the File Repository and when uploading an attachment to an alert, it now specifies the max file upload size in each location.
  • Bug fix: The User Access Dashboard's drop-down list filter of project statuses mistakenly included "Archived" projects, which is a mistake since "Archived" is no longer a valid option for a project status as of REDCap 9.8.0.

Version 10.4.1 (released on 2020-11-06)

CHANGES IN THIS VERSION:

  • Bug fix: If a checkbox field whose variable name matches a PHP function (including REDCap-defined PHP functions) is used in conditional logic, report filter logic, branching logic, calculations, etc., it would not get parsed correctly, and the logic/calculation would mistakenly be considered syntactically invalid.
  • Bug fix: When viewing the project Logging page, any "Sent Alert" logged events that pertain to records would mistakenly not be displayedBug fix: When importing data via the Data Import Tool for a Text Field with min/max range validation, if the value being imported is out of range, it would correctly display it inside an orange box but would mistakenly fail to list the existing value in red below the new value if the field already contained an existing value. on the page when filtering by record name. (Ticket #95222)
  • Bug fix: When an administrator is approving Draft Mode changes for a production project in the To-Do List, the dialog popup on the page would mistakenly not close itself after an action was taken on that To-Do List item. (Ticket #95292)
  • Bug fix: When using certain Smart Variables inside @CALCDATE or @CALCTEXT, it might mistakenly cause a calculation error to occur on the data entry form or survey page.
  • Bug fix: When using the @DEFAULT action tag on an instrument that is not the first instrument, if the record has the record name "0" and is an existing record, the action tag would fail to work successfully. (Ticket #95296)
  • Bug fix: If an administrator sends a General Notification to users in REDCap Messenger, it might mistakenly send an email notification multiple times to each user when instead it should only send a single email notification (if the user's permissions dictate that they receive email notifications). Bug emerged in REDCap 10.4.0.
  • Change: On the Data Quality page, the text boxes used for adding/editing custom data quality rules were enlarged and are now resizable.

Version 10.4.0 (released on 2020-10-30)

CHANGES IN THIS VERSION:

  • New action tag: @CALCDATE - Performs a date calculation by adding or subtracting a specified amount of time from a specified date or datetime field and then provides the result as a date or datetime value - e.g., @CALCDATE([visit_date], 7, 'd'). The first parameter inside the @CALCDATE() function should be a text field with date, datetime, or datetime_seconds validation, in which you may specify (if needed) the event and repeating instance - e.g., @CALCDATE([baseline_event][visit_date], 7, 'd'). The second parameter represents the offset number amount that should be added or subtracted. It can be a decimal number or integer. Tip: To subtract (i.e., go backwards in time), use a negative number. The third parameter represents the units of the offset amount, which will be represented by the following options: 'y' (years, 1 year = 365.2425 days), 'M' (months, 1 month = 30.44 days), 'd' (days), 'h' (hours), 'm' (minutes), 's' (seconds). The unit option must be wrapped in quotes or apostrophes. NOTE: Both the source field and the result field must be a text field with date, datetime, or datetime_seconds validation. It is important to realize that a field with @CALCDATE will not be editable on the survey page or data entry form, and the field will function almost exactly like a normal calculated field, in which its value may get updated via a data import, when running Data Quality rule H, or in real-time during normal data entry on a form or survey.
  • New action tag: @CALCTEXT - Evaluates logic that is provided inside a @CALCTEXT() function and outputs the result as text, typically performed with an if(x,y,z) function - e.g., @CALCTEXT(if([gender]='1', 'male', 'female')). NOTE: It is important to realize that a field with @CALCTEXT will not be editable on the survey page or data entry form, and the field will function almost exactly like a normal calculated field, in which its value may get updated via a data import, when running Data Quality rule H, or in real-time during normal data entry on a form or survey. If desired, it is possible to return the value as a number - e.g., @CALCTEXT(if([age] >= 18, 'adult', 5*[other_field])).
  • New feature: Data Access Group import/export and DAG-User assignment import/export - The Data Access Groups page in a project now displays a drop-down list of options for users to import/export Data Access Groups, which allows users to bulk create or rename DAGs via a CSV file. It also allows for the import/export of DAG-user assignments via CSV file to bulk assign/reassign/unassign users from DAGs in a project. Note: The DAG-user assignment import affects only a user’s *current* DAG assignment; thus, it has no effect on the DAG Switcher assignments for the user.
  • New feature: Data Quality Rule import/export - The Data Quality page in a project now displays a drop-down list of options for users to import/export custom Data Quality rules via a CSV file. Note: This does not apply to the pre-defined DQ rules (rules A-I). Also, when DQ rules are imported, the process is additive only, meaning that the CSV upload cannot replace or edit existing DQ rules but will only add new ones to the project.
  • Improvement: On a user's My Profile page, there is a new setting under "Notification Preferences for REDCap Messenger" to enable/disable email notifications specifically for General Notifications and System Notifications. This setting will be enabled by default for all users. This is intended to help users who ignore messages from Messenger to become more informed about messages sent from administrators (via General Notifications) and to become more aware of new features (via System Notifications). Note: Users with this option enabled will not receive an email notification for General/System Notifications if they have not logged into REDCap in the past 6 months. Also, if you wish to automatically disable this setting for all users, simply run the following SQL immediately after the upgrade has completed: update redcap_user_information set messaging_email_general_system = 0;
  • Minor security fix: A Cross-site Scripting (XSS) vulnerability was discovered where a malicious user could potentially exploit it by inserting HTML tags with JavaScript event attributes in a very specific way into text that ultimately gets displayed on a webpage (e.g., via a message in REDCap Messenger, via field labels on a survey or data entry form).
  • Bug fix: If a checkbox field whose variable name ends with "round" is used in conditional logic, report filter logic, branching logic, calculations, etc., it would not get parsed correctly and would mistakenly be considered syntactically invalid. (Ticket #94109)
  • Bug fix: The "redcap_survey_complete" hook was mistakenly being called at incorrect/additional times on a survey when it should only be called when the survey had just been completed. (Ticket #93703)
  • Bug fix: In specific situations where both Field Embedding and branching logic are used together on a multi-page survey, in which fields on one page have branching logic referencing fields from previous pages, it might mistakenly display a branching logic error prompt on the page. (Ticket #94536)
  • Bug fix: The "View Project as User" feature was not behaving accurately on the "Designate Instruments for My Events" page in longitudinal projects. (Ticket #79227)
  • Bug fix: When exporting data to SAS, the "format" of a multiple choice field might not get represented correctly in the SAS syntax file, thus causing errors to occur when loading the data into SAS for certain types of REDCap projects and for certain SAS clients/versions.
  • Bug fix: In the API Playground, the example Ruby output was slightly incorrect due to a variable naming issue and would throw an error if someone attempted to run it. (Ticket #94486)
  • Bug fix: When utilizing Missing Data Codes in a project and performing a data export to a stats package (R, Stata, SAS, SPSS), in which the export contains a checkbox field that has a @NOMISSING action tag, the resulting syntax file for the stats package would mistakenly include the Missing Data Code options for the checkbox even though the CSV file would correctly omit them. This would cause an issue when loading the exported data into the stats package. (Ticket #94334)
  • Bug fix: If a user contains an apostrophe in their username (because LDAP allows this), the username search functionality and some buttons might not work on the Browse Users and Browse Projects pages in the Control Center. (Ticket #79647)Bug fix: REDCap might mistakenly fail to correctly parse logic (conditional logic, branching logic, calculations) in certain contexts if the logic contains Smart Variables that have parameters appended to them after a colon, such as [form-link:instrument]. (Ticket #93955)
  • Bug fix: The R code that gets auto-generated by the API Playground was out of date and was no longer valid.
  • Bug fix: In a project that has a project-level or survey-level designated email field, in which the project is longitudinal or has repeating events or instruments, if a designated email field is being updated via a data import for a given event or repeating instance, it would mistakenly fail to additionally update that email field in all events/instances that contain data for the given record being imported. This could cause records to end up with differing values of the email field on different events/instances, which should never happen. (Ticket #94408)
  • Bug fix: When running Data Quality rule B, it might mistakenly not return discrepancies that exist on repeating instruments or repeating events. (Ticket #94979)
  • Bug fix: When running Data Quality rule F, it might mistakenly return false positives for fields that exist on repeating events. (Ticket #94985)
  • Bug fix: When using the "Move multiple fields" functionality on the Online Designer, it would correctly move them all to the right position, but they would mistakenly be in reverse order.
  • Bug fix: When uploading a new Instrument Zip file via the Online Designer, if a field in the Instrument Zip file contains branching logic or a calculation that references a checkbox field, it might mistakenly not auto-fix the branching logic/calculation correctly if the checkbox field's variable name already exists in the project and is thus renamed on the fly. This would cause branching logic or calculation errors to be displayed on the new instrument when viewing on a data entry form or survey. (Ticket #95101)

Version 10.3.8 (released on 2020-10-23)

CHANGES IN THIS VERSION:

  • Medium security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they might be able to inject specific PHP code into conditional logic or calculations that get evaluated by PHP. Note: This same security fix from a recent release was not fully remediated in that previous version.
  • Minor security fix: A Cross-Site Request Forgery (CSRF) vulnerability was discovered where a malicious user (who must be logged in) could potentially exploit it by adding some specific parameters to POST requests in the application.
  • Minor security fixes: Various Cross-site Scripting and SQL Injection vulnerabilities were discovered where a malicious user (who must be logged in) could potentially exploit them by adding some specific parameters and values to GET and/or POST requests in the application.
  • Minor security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they might be able to pass possibly dangerous values into input parameters that eventually pass through PHP's unserialize() function, which could possibly be used for remote code execution. The usage of unserialize() has been modified to protect against dangerous values passed to it.
  • Improvement: When using the Clinical Data Mart feature in a project, it now contains a new setting (for Admins only) on the Project Settings page that will turn off the daily data fetch cron job at a specified date. In addition, a record-level version of this Data Mart cron job “kill switch” has been added as a new field on the “Project Settings” instrument in the Data Mart project that will stop running the daily cron job for specific records based on the date values (i.e., a beginning and end date) entered into fields for a given record. Note: If an existing Data Mart project already exists, you can add the variables fetch_date_start and fetch_date_end to the Project Settings instrument to utilize the record-level setting to only fetch data within a specified time period for a given record.
  • Change: Regarding a code change in v10.3.5 (Standard) that allowed PHP warnings (but not PHP errors) to be displayed on REDCap pages for development servers (and also for any servers where hooks or external modules were incidentally enabling the PHP error reporting on the server), this has been reverted so that PHP warnings will no longer be displayed anymore on any REDCap server except for the REDCap development team.
  • Bug fix: When a data entry form is being viewed for a record that has not been created yet, it was mistakenly displaying the "H" icon to view the Data History popup, which is nonsensical if the record does not exist yet. It no longer displays the "H" icon on the page until the record has been created. (Ticket #94427)
  • Bug fix: If a checkbox is being piped somewhere else on the same page as where the checkbox field itself exists, it might mistakenly not update in real time when the checkbox is checked or unchecked. However, it would pipe correctly whenever the page is loaded.
  • Bug fix: If the Clinical Data Mart feature is enabled at the system level but the Clinical Data Pull is disabled at the system level, then the user-level option to grant a user Data Mart privileges would mistakenly not be displayed on the Browser Users page in the Control Center.
  • Bug fix: When a matrix of checkboxes are embedded individually inside another field on the same page, any change to those embedded checkboxes (either checked or unchecked) would mistakenly not take effect and thus its value would not get saved appropriately. (Ticket #94519)
  • Bug fix: When using the "project_id" field for the “Custom Surveys for Project Status Changes” feature, specifically for the project creation process when users must request that admins create their projects on their behalf, the PID value of the new project would mistakenly not get stored in the project that contains the embedded survey and is used to capture project creation details. (Ticket #90873)
  • Bug fix: When using the PDF Auto-Archiver option for a survey, if the survey response is completed and then is later deleted via the Delete button on the data entry form, if that survey is taken again for that same record, then it would mistakenly not save a new PDF in the File Repository for the new response but would only retain the original one.

Version 10.3.7 (released on 2020-10-13)

CHANGES IN THIS VERSION:

  • Critical security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they could potentially manipulate the URL of certain project-level pages in REDCap and bypass authentication to view those pages without ever having logged in. Note: There is no known report of this vulnerability ever having been exploited in the wild on any REDCap installation. Given that this vulnerability is present in all versions of REDCap beginning with 9.1.16 (LTS) and 9.3.7 (Standard), and given the fact that a previously patched vulnerability affects all versions beginning with REDCap 6.18.0, it is recommended that anyone on REDCap 6.18.0 or higher should immediately upgrade to this version: 10.3.7 (Standard), 10.0.23 (LTS), or 9.5.36 (LTS).
  • Bug fix: When evaluating logic for large amounts of records, such as with the "datediff" cron jobs for both Alerts and ASIs, REDCap was making an inordinate amount of calls to the database and was also performing too much logic processing unnecessarily. These unnecessary processes have been removed, which should improve general performance of logic parsing/processing in REDCap. (Ticket #93787)
  • Various fixes for PHP warnings that only get displayed in non-production installations.

Version 10.3.6 (released on 2020-10-09)

CHANGES IN THIS VERSION:

  • Improvement: The filename of a file uploaded to a File Upload field will now be displayed in a downloaded PDF with saved data and also in the download button for File Upload fields displayed in reports. The filename will also be displayed as the value of a File Upload field in a data export (excluding CDISC ODM exports, including API exports).
  • Bug fix: If an SQL field is used in a Custom Record Label, it would mistakenly run that same SQL query for every record being displayed on the Add/Edit Records page and Record Status Dashboard, which could cause performance degradation to the REDCap server for larger projects.
  • Bug fix: If a Notes field has text data that contains tab characters, those tab characters would mistakenly be represented in an exported PDF as square box characters.
  • Bug fix: When exporting an instrument as a PDF with data, if a given page in the PDF ends with a Signature field displayed at the bottom (but not necessarily being the last field on the instrument or survey), it might get confused about inserting a page break directly after the signature, thus causing the next page to be overwritten on top of the first. This would typically make the two pages unreadable.
  • Bug fix: If a calculated field's equation begins with the function "log", "min", or "max", then the PHP-side processing of the calculations (via Data Import or Data Quality rule H) would cause the calculation to not return the correct result if one or more fields used in the equation contained a blank value. (Ticket #93169)
  • Bug fix: When upgrading REDCap to v9.6.0 or higher from a lower version, an SQL error might occur for the redcap_mobile_app_log table when running the SQL upgrade script. (Ticket #92240)
  • Bug fix: When a survey that has the e-Consent Framework enabled also has the option enabled to prevent users from editing e-Consent responses, if a user is on the data entry form at the same time that a respondent is consenting that instrument as a survey, then the user could mistakenly overwrite the respondent's survey results and nullify their consent if the user submits the page after the respondent does. Now in this scenario, if the respondent has already consented and the user attempts to save the data entry form, it will not save the data the user submitted and will instead display an error that explains why their data cannot be saved. (Ticket #92297)
  • Bug fix: When viewing the survey login screen for a survey on certain devices (e.g., Safari on iOS), the browser would mistakenly suggest to the participant that they should use the fields as if they are creating a new password, which is incorrect and confusing. (Ticket #93095)
  • Bug fix: When running a custom Data Quality rule that contains checkbox fields, the resulting display of discrepancies might mistakenly not display the checkbox fields but would display all other field types.
  • Bug fix: When using logic for report filters, ASIs, DQ rules, etc., in which the logic has an [X-event-name] Smart Variable that is prepended to a checkbox field, it might mistakenly not parse and process the logic correctly, thus possibly returning incorrect results. (Ticket #93534)
  • Bug fix: When using the Survey Queue in which a survey in the queue has been completed and is either 1) a repeating survey, or 2) a survey that allows the respondent to return and modify completed responses, the rows in the Survey Queue for such surveys might get hidden and thus can only be seen when clicking the "view all" link. This could prevent some respondents from finding these hidden surveys in the queue if the respondent needs to add another response for the repeating survey or to modify the completed, editable survey.
  • Change: When editing a field in the Online Designer, if the field's variable name is longer than 26 characters, the page no longer gives the warning popup about this when clicking the Save button in the Edit Field dialog but only at the point when the variable name is actually changed. This new behavior should be a lot less annoying to users with very long variable names.
  • Bug fix: When a checkbox field is a required field and is embedded inside another field that has an @HIDDEN action tag (including @HIDDEN-SURVEY or @HIDDEN-FORM), if the checkbox had some checkboxes checked (after being saved previously) and then a user saved the form/survey, it would mistakenly uncheck all the checked checkboxes for that hidden, embedded checkbox field. (Ticket #93766)
  • Change: Some warning text was added to the Edit Alert dialog on the Alerts & Notifications page in the event that the user selects the third radio option for Step 1A while selecting the "every instance of a repeating instrument" option in Step 1C, which can cause the alert to be triggered off of every new repeating instance that is added to *any* repeating instrument in the project. Such behavior is often not intended, and could mistakenly cause many unintended alerts to be sent. New warning text: "WARNING: It is generally not recommended to use 'Using conditional logic...' in Step 1A together with the option '...on every instance of a repeating instrument' in Step 1C. If these are used together, that means that this alert will be trigger by EVERY repeating instance that is saved for ANY repeating instrument in the project."

Version 10.3.5 (released on 2020-10-02)

CHANGES IN THIS VERSION:

  • Security improvement: The concept of “public projects” have been removed and thus the My Projects page will no longer display the list of public projects at the bottom of the page. This means that the first 13 projects in a fresh installation of REDCap (and subsequently any projects having “Public/None” authentication) will no longer be accessible via the “site_admin” user anymore. They will no longer be accessible to the public web. This feature has been removed to reduce the overall attack surface area in REDCap to protect against potential malicious users who would like to use these public projects as a testing ground. In general, public projects have not really been utilized very much in recent years, so removing this functionality would not seem to adversely affect many (if any) REDCap institutions.
  • Security improvement: The OpenID authentication method has been permanently removed from REDCap. This authentication method only supported OpenID version 1, which is very outdated, and the current third-party PHP package being used for OpenID authentication has some potential security issues.
  • Medium security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they might be able to read certain files from the web server’s filesystem by manipulating the URL for a file uploaded as a rich text file in an External Module’s configuration.
  • Medium security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they might be able to inject specific PHP code into conditional logic or calculations that get evaluated by PHP. Note: This same security fix in last week's release was not fully remediated in that version.
  • Minor security fix: A Blind SQL Injection vulnerability and a Cross-Site Scripting vulnerability were found on the To-Do List page, in which a malicious user could potentially exploit it by manipulating the query string of an HTTP request on that page.
  • Major bug fix: When two users are about to create a new record with the same record name on a data entry form, in which they both upload a file to a File Upload or Signature field on that form prior to pressing the Save button, the last file uploaded might mistakenly get attached to the first record and possibly also to the second record at the same time, thus orphaning the file originally uploaded to the first record. Note: This bug does not exist on surveys. (Ticket #89678)
  • Major bug fix: When using Twilio to send voice calls for Alerts & Notifications, the message of the voice call would mistakenly be blank, in which it would simply hang up after being picked up by the recipient. (Ticket #93384)
  • Improvement: The Clinical Data Pull and Data Mart features can now import the date/time of death of a patient (if deceased) as a mappable field.
  • Change/improvement: The Clinical Data Pull and Data Mart features can now import extra email fields (in addition to the primary email) for a patient using the new mapping fields “email_2” and “email_3” on the field mapping page. In previous versions, multiple email addresses might have been imported into the email field as semicolon-delimited text, but now they can be separated and imported as separate fields. Note: If any existing Data Mart projects already exist, the fields “email_2” and “email_3” must be added to the Data Mart project in order for the extra email addresses to be imported into any record.
  • Bug fix: If a field is embedded inside the choice label of a multiple choice field that is used in the Custom Record Label, it would mistakenly not embed the field correctly on the page at all. Bug emerged in the previous release. (Ticket #92551B)
  • Bug fix: Four Laboratory fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: If randomizing a record while the randomization field and/or a strata field on the page are radio button fields (as opposed to being drop-down fields), after the record has been randomized, those fields would mistakenly not appear to be selected until the page is reloaded or revisited later. This would not affect the data values of the fields at all but could be confusing to users because it seemingly implies that perhaps the randomization process was not completely successful. (Ticket #92825)
  • Bug fix: REDCap Messenger would mistakenly not open when on the External Modules page in the Control Center.
  • Bug fix: When copying a project and selecting the option to copy "All settings for Survey Queue and Automated Survey Invitations", it would mistakenly fail to copy the time lag fields of "before/after" and "the ASI has been triggered/[date or time field]" (if defined) for Automated Survey Invitations. (Ticket #92213)
  • Bug fix: When a project has some alerts set to send as SMS or Voice Calls, but the Twilio functionality has been completely disabled at the system-level in the Control Center, the REDCap page would mistakenly crash with a fatal PHP error when those alerts get triggered. (Ticket #92179)
  • Change: When a user submits production changes via Draft Mode in the Online Designer, if the changes are approved automatically, it no longer sends an email to the user themselves. This email was superfluous since the user was already notified of this in the user interface. (Ticket #91415)
  • Bug fix: When a user copies a project or creates a new project via a Project Template, in which a survey in the original project had enabled the Survey Confirmation Email and had its option "Include PDF of completed survey as attachment" checked, that checkbox option would mistakenly not be saved/checked in the new resulting project. (Ticket #92058)
  • Bug fix: The underlying code/logic that determines when PHP warnings in REDCap should be output to the page on development servers was not quite correct, although it does not appear to have had any adverse consequences.
  • Bug fix: When the system-level setting "Utilize the Display Name in all outgoing emails?" is turned off, the user interface on the Alerts & Notifications page would still mistakenly display the "Display name" text box in the "Create new alert"/"Edit alert" dialog. (Ticket #92245)
  • Bug fix: When creating/editing an Automated Survey Invitation and clicking the "Save & Copy to..." button, it would mistakenly fail to copy the time lag fields of "before/after" and "the ASI has been triggered/[date or time field]" (if defined) for the ASI. (Ticket #92213B)
  • Bug fix: When downloading or uploading a CSV file containing the settings for Automated Survey Invitations on the Online Designer, it would mistakenly forget to include the time lag fields of "before/after" and "the ASI has been triggered/[date or time field]" (if defined) for the ASIs in both the import and export files.
  • Bug fix: When an alert has been created in a project containing repeating instruments, in which the alert is to be triggered by both conditional logic and when a record is saved on a specific form/survey (i.e., the second radio button in Step 1A), specifically a repeating instrument, then if other repeating instruments exist in the project and contain data while the Trigger Limit value (in Step 1C) is set to "only once per record and also on every instance of a repeating instrument" and then a user clicks the "Re-evaluate Alerts" button on the Alerts & Notifications page, instead of sending/scheduling an alert for just the targeted repeating instrument, it would mistakenly send/schedule an alert for all repeating instruments that contain data for a given record. Note: This only occurs when clicking the "Re-evaluate Alerts" button.
  • Bug fix: When an alert has been created in a project containing repeating instruments, in which the alert is to be triggered when a record is saved on a specific form/survey (i.e., either the first or second radio button in Step 1A), if the specified instrument is a repeating instrument and a data import is being performed, in which the imported data contains repeating instances of that repeating instrument, then it would mistakenly trigger the alert. When an alert has either the first or second radio button selected in Step 1A, the alert should never be triggered by a data import (including API import or REDCap::saveData) but only when clicking a Save button on a survey page or data entry form.
  • Change: If the MySQL database is somehow in read-only mode, which means that REDCap will not function properly, REDCap will now display the database error message on the page so that an admin will be notified of this issue and fix it. (Ticket #93212)
  • Bug fix: If the Data Transfer Services (DTS) are enabled at the system level and the current user has access to a project that has DTS enabled, then a fatal PHP error would be displayed on the My Projects page if on PHP 7.3+. (Ticket #93190)
  • Bug fix: When viewing the My Projects page or Home page on a mobile device, the Send-It option would mistakenly not be visible in the pull-down navigation menu (i.e., 3-line button at top right).
  • Change/improvement: The External Service check on the Configuration Check page now returns an error if specific HTTP 4XX status codes are returned and also if any HTTP 5XX status codes are returned from a given external service. This will allow the checks to be more accurate for certain web server configurations.
  • Bug fix: On the Alerts & Notifications page, the red asterisk in Step 1A of the Edit Alert dialog did not have a corresponding explanation in that section regarding what the asterisk implies. It was mistakenly removed in a previous version, and has now been re-added.
  • Change/bug fix: When clicking the "Re-evaluate Alerts" button on the Alerts & Notifications page, it was only re-evaluating alerts that had only conditional logic and thus was not re-evaluating alerts that had the first two options selected in Step 1A of the Edit Alert dialog (i.e., "When a record is saved on a specific form/survey..."). The Re-evaluate Alerts now considers all three options in Step 1A when it is evaluating.
  • Bug fix: The datediff+today/now cron job for Alerts & Notifications that runs every 4 hours might mistakenly fail to remove any scheduled/unsent alerts if the alert's conditional logic no longer evaluated as TRUE at the time of the cron job running.
  • Bug fix: Signature fields would mistakenly not work (or not work well) or certain non-mobile touchscreen devices because the jSignature library being used was very out of date. (Ticket #67122)

Version 10.3.4 (released on 2020-09-25)

CHANGES IN THIS VERSION:

  • Medium security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they might be able to inject specific PHP code into conditional logic or calculations that get evaluated by PHP.
  • Bug fix: When loading a public survey for a project that contains 10K+ or 100K+ records, the initial loading of the survey page could be unnecessarily slow due to incorrect assumptions in the code regarding the employment of record auto-numbering for public surveys. Thus it should now load much faster.
  • Bug fix: When loading a public survey for a project that contains 10K+ or 100K+ records, the initial loading of the survey page could be unnecessarily slow if the project's back-end "record list cache" has not been recently built, which may occur if users have not been active in the project recently even while many participants are taking the public survey very often. This was caused due to incorrect assumptions in the code regarding when to trigger the auto-build process for the "record list cache". Thus it should now load much faster.
  • Bug fix: For some REDCap installations, especially those on older PHP versions (7.0 and below), a fatal PHP error might be thrown on the install page or upgrade page, thus preventing someone from installing or upgrading REDCap. Bug emerged in REDCap 10.3.3 (Standard). (Ticket #92141)
  • Bug fix: In longitudinal projects that contain repeating instruments, if the "designated email field for sending survey invitations" is used or else the survey-level designated email field is used, then it is possible that the designated email field might mistakenly receive repeating values even when its instrument is not a repeating instrument. In this case, the email field's instrument would mistakenly display a repeating instance status icon (i.e., the stack status icon) on the Record Status Dashboard, but would confusingly prevent the user from navigating inside that instrument for a given record on the dashboard page.
  • Bug fix: If clicking the pencil icon for a Signature field on the Codebook page, when it opens the field for editing in the Online Designer, it would mistakenly set it as a File Upload field rather than a Signature field, which would cause the field to be modified and saved incorrectly as a File Upload field if the user clicked the Save button in the dialog without changing the field type. (Ticket #92271)
  • Bug fix: In development environments, PHP warnings might mistakenly be displayed on some survey pages. (Ticket #92303)
  • Bug fix: If using the SendGrid Email API for sending outgoing emails, if the email subject, email sender, or email recipient is left blank, it would mistakenly crash with a fatal PHP error. This would halt the cron job if this occurred while the cron was running. (Ticket #92266)
  • Bug fix: When using Clinical Data Interability Services (CDP or Data Mart), all non-Integer record IDs would mistakenly not get inserted into the redcap_ehr_import_counts database table, which tracks the amount of data points/records that have had clinical data imported into them. (Ticket #92426)
  • Bug fix: If an existing Automated Survey Invitation is modified so that the "Ensure logic is still true?" option is checked (when previously it was unchecked), in which it is the only setting that was modified during this save, it would mistakenly not save that option being checked. (Ticket #92372)
  • Bug fix: If the survey confirmation email option is enabled for a survey, it would mistakenly include the participant's email address on the project logging page, which is a privacy concern because it makes anonymous survey responses no longer anonymous and also because it is inconsistent with the text listed below the survey's Completion Text that says "Your email address will not be stored". Instead of listing the participant's email on the logging page, it now displays "To: [undisclosed email address]" instead. (Ticket #92210)
  • Bug fix: If a field is embedded inside the choice label of a multiple choice field that is used in the Custom Record Label, it would mistakenly attempt to embed the field inside the blue/green row near the top of the data entry form. This would also cause an embedding error to be displayed on the page if the field were embedded elsewhere on that page. (Ticket #92551)

Version 10.3.3 (released on 2020-09-17)

CHANGES IN THIS VERSION:

  • Medium security fix: Since it has been determined that REDCap versions 10.3.1 Standard Release and lower and 10.0.17 LTS and lower contain security vulnerabilities that are still executable if those version directories continue to remain on the REDCap web server, the Configuration Check page in the Control Center now recommends that you remove those older version directories that contain specific major vulnerabilities that they cannot be exploited by a malicious user.
  • Minor security fix: To prevent potentially malicious users from harvesting Table-based usernames from REDCap via the Password Recovery page, it now displays a deterministic (but fake) security question if the username entered does not exist in the system. This behavior makes it impossible for the malicious user to determine if the username entered was a real username or not.
  • Bug fix: If a new user is accessing REDCap for the first time while using an external authentication method (i.e., not using Table-based authentication), the page that asks them to enter their name and email address would not get saved and would mistakenly display the "multiple tabs open" error message.
  • Bug fix: If using the Twilio telephony feature on the Public Survey Link page of a project to send an SMS message containing a link to the public survey, it would mistakenly omit the survey link in the content of the SMS if the content contains the Smart Variables [survey-url] and [survey-link] with no "instrument" parameter defined inside the square brackets.
  • Bug fix: If a data entry form contains a Descriptive field with an embedded audio or video file, it might mistakenly allow two users to access and modify values on that form at the same time, thus allowing them to mistakenly bypass the Simultaneous User Prevention feature. (Ticket #91334)
  • Change/improvement: When navigating through pages in the Control Center, it now only places the admin's cursor in the PID Search textbox on the main Control Center page (i.e., "Notifications & Reporting"). On other pages, such as URL Shortener, Browse Users, Browse Projects, and Add Users, it will automatically place the cursor in the first textbox on the page as a convenience. (Ticket #91939)
  • Change: The Configuration Check page now recommends that the web server setting "max_input_vars" be set to a value of at least 100000 in the PHP.INI configuration file.
  • Bug fix: If a field is embedded inside the choice label of a checkbox field, it might cause issues if the embedded field contains branching logic to hide/show it when its associated checkbox option is clicked. In many cases, clicking the embedded field might cause the parent checkbox to mistakenly uncheck itself, thus making normal data collection in this way impossible.
  • Bug fix: If a radio button field is embedded inside the choice label of a checkbox field, the radio field's "reset" link would mistakenly not uncheck a selected radio button.

Version 10.3.2 (released on 2020-09-11)

CHANGES IN THIS VERSION:

  • Critical security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they could potentially manipulate the URL of certain non-project pages in REDCap (e.g., Control Center pages, non-project External Module pages) to bypass authentication and view those pages without ever having logged in. And in very specific cases, the user might (if they have specialized knowledge of REDCap) be able to submit the page and actually affect system configuration settings. Note: There is no known report of this vulnerability ever having been exploited in the wild on any REDCap installation. This vulnerability is present in all versions of REDCap beginning with REDCap 6.18.0.
    • Manual code fix: If you are unable to upgrade REDCap but are able to modify the REDCap PHP files on your server, open the file /redcap_vX.X.X/Classes/System.php and in the function defineAppConstants(), modify the line if ($Route->get()) define("PAGE", $Route->get()); to replace it with if ($Route->get() && strpos(PAGE_FULL, "/redcap_v{$redcap_version}/index.php") !== false) define("PAGE", $Route->get());
  • Minor security fixes: Various minor security vulnerabilities (including SQL injection, Cross-site Request Forgery, and Cross-site Scripting) were found on various pages throughout REDCap and were remediated.
  • Major bug fix: If a survey participant's email address was added to an initial survey on the Participant List, and then the participant takes the survey using their private survey link, in which they fail to enter a value for a required field on the first page of that survey, it would mistakenly cause their partial survey completion status to be mistakenly orphaned (thus not displaying the partial response status icon but a red/Incomplete status icon) and might cause their email address to disappear from the Participant List. Additionally, it would cause the next record name in the project to be skipped, thus leaving a gap in the list of record names.
  • Change: If a project has Randomization enabled and is currently in production, REDCap administrators will not be allowed to move the project back to development status as they normally can on the Other Functionality page. This option is disabled in this case to prevent issues occurring with randomization, such as the fact that all values for the randomization field get erased when moving from development to production.
  • Bug fix: When a participant loads a public survey, if the tentative record name that was generated when the survey loaded somehow matches the record name of an existing record that has been locked via Record-level Locking, it would mistakenly display the erroneous message that the public survey cannot be taken because the record is currently locked, which is not correct.
  • Bug fix: If a user is running Data Quality rule H to fix calculations that exist on a survey that has been completed via the e-Consent Framework, although it might note that some calc fields' values need to be fixed, clicking the "Fix calcs now" button for DQ rule H would mistakenly not fix them and would not explain why.
  • Bug fix: Queries would mistakenly get displayed on the page momentarily right after logging in via Shibboleth or Shibboleth+Table. (Ticket #91504)
  • Bug fix: If a value is being entered into a "Phone (North America)" validated field, and the field's value is formatted slightly after being entered (to add parentheses, spaces, and dashes), any branching logic or calculations triggered by the field would mistakenly use the hand-entered value of the field rather than the final formatted value, which could cause issues in certain scenarios. (Ticket #91722)

Version 10.3.1 (released on 2020-09-03)

CHANGES IN THIS VERSION:

  • Major bug fix: If running PHP 5.5 or 5.6, it would not be possible to upgrade to a recent version of REDCap because it would throw a fatal PHP error on the upgrade page. (Ticket #91097)
  • Bug fix: When using Twilio, it would mistakenly not send SMS messages to U.S. phone numbers with an 854 area code. (Ticket #90686)
  • Bug fix: If a calc field is using the function sum, min, max, stdev, mean, or abs, and the variable names referenced inside those functions are not numeric-type fields (i.e., has number/integer validation, is a calc or slider field), it would not return a correct result if one of more of the fields referenced in the function had a negative value. (Ticket #90881)
  • Bug fix: The language has been made clearer in the popup that is displayed on the User Rights page when selecting the radio option "Locking / Unlocking with E-signature authority". (Ticket #90961)
  • Change: When REDCap is routinely deleting temporary files inside its internal "temp" directory, if a file there does not have the expected timestamp inside the file's filename to designate the file's time of creation, then the file's "last modification time" property will then be checked to determine its age to see if it should be deleted. This also includes files in subdirectories within the temp directory.
  • Change: Added the REDCap version number to the top of the Configuration Check page for those institutions that wish to print the page for version-specific documentation.
  • Bug fix: When adding choices that do not contain a comma for a multiple choice field in the Add New Field dialog on the Online Designer, it would not always automatically set the raw coded values correctly if the user provided a mix of numeric and non-numeric values for the options. (Ticket #83895)
  • Bug fix: If the e-Consent Framework is enabled on a one-page survey that contains a field that is required and is also embedded inside another field on the survey page, if the participant loads the e-Consent certification page and then clicks the "Previous Page" button, it would mistakenly delete the value of the field that was both required and embedded on the previous page. (Ticket #91139)
  • Change: The option to enable a twice-daily cron job (available to admins only) to automatically run the Clinical Data Mart in a project has now been changed to run only once per day due to various technical and scalability considerations.
  • Bug fix: The External Modules link on the left-hand menu both in projects and in the Control Center would mistakenly be a full link rather than a relative link to the page, which could cause some issues in specific situations. (Ticket #91223)
  • Bug fix: When entering a value into a field that has been designated as the Secondary Unique Field in a project, each time the user/participant leaves the field and then re-enters the field, it will cause the amount of SUF unique value checks performed to double each time (e.g., 1 check, then 2, 4, 8), when it should only be running once after entering a value in the field. This could cause the page to get really slow and unresponsive. (Ticket #91344)
  • Bug fix: When using Shibboleth or Shibboleth+Table for authentication, it might mistakenly not update a user's "Time of last login" as noted on the Browse Users page. (Ticket #85105)

Version 10.3.0 (released on 2020-08-27)

CHANGES IN THIS VERSION:

  • Critical bug fix: When collecting data using a public survey where multiple participants are entering data near-simultaneously, if piping is being performed on the first page of the public survey, a scenario may arise in which a survey participant may mistakenly see some piped data that was entered by another participant that had just saved their responses at the same time as (or moments before) the current participant had loaded the survey page. While this issue is fairly rare, the worst-case scenario could be that a participant ends up viewing another participant's response, thus possibly resulting in a privacy leak if private and/or identifying information (e.g., PHI) has been entered on the survey.
  • New feature: Added "Language of text to be spoken" for the "Text-To-Speech" survey functionality, which is available on the Survey Settings page. For several years, REDCap has had a Text-to-Speech feature for surveys that, when enabled, allows questions and other text on survey pages to be converted into natural-sounding audio for the participant to hear. Up until now, it supported English only, but now REDCap users may utilize the Text-to-Speech feature in a variety of non-English languages and voices, assuming that the survey text is in a non-English language. This includes Arabic, Brazilian Portuguese, English (UK and US), French, German, Italian, Japanese, and Spanish (Castilian, Latin American, and North American).
  • New feature: Users may re-evaluate some or all Automated Survey Invitations for all records in a project. If an ASI has been modified after data has already been entered in the project, users may click the “Re-evaluate Auto Invitations” button in the Online Designer, which will re-evaluate selected ASIs for all records to ensure that invitations get properly sent or scheduled based on the new conditions of the ASI (otherwise they could only be triggered if each individual record had data modified). If a user modifies the conditional logic of an ASI, it will recommend that they utilize the “Re-evaluate Auto Invitations” functionality. If an ASI has the “Ensure logic is still true…” option checked, then it is possible during this process that some already-scheduled invitations might get removed (and thus would no longer be scheduled) based on the new conditions.
  • New feature: Users may re-evaluate some or all Alerts & Notifications for all records in a project. If an alert has been modified after data has already been entered in the project, users may click the “Re-evaluate Alerts” button on the Alerts & Notifications page, which will re-evaluate selected alerts for all records to ensure that notifications get properly sent or scheduled based on the new conditions of the alert (otherwise they could only be triggered if each individual record had data modified). If a user modifies the conditional logic of an alert, it will recommend that they utilize the “Re-evaluate Alerts” functionality. If an alert has the “Ensure logic is still true…” option checked, then it is possible during this process that some already-scheduled notifications might get removed (and thus would no longer be scheduled) based on the new conditions.
  • Improvement: When deleting an invitation from the Survey Invitation Log (either as a single invitation or using the multi-select option to delete many invitations at once), it now provides a new option in the dialog prompt to “Permanently cancel this invitation?”, in which the phrase “permanently cancel” implies that the invitation cannot be re-triggered/scheduled again in the future even if the ASI conditions are met again. If the user chooses to uncheck the option, then the scheduled invitation will be removed, but could possibly get re-triggered in the future if the ASI conditions are met again (assuming it was originally scheduled via an ASI).
  • Improvement: The Survey Invitation Log has a new filter drop-down option to view “only deleted invitations” (i.e., permanently cancelled invitations).
  • New developer method: REDCap::reserveNewRecordID() - A thread-safe way to reserve a new record ID in a project prior to creating the record by using record auto-numbering or by manually providing a new record name to reserve as the $recordIdToReserve parameter. NOTE: This method will not create the record but will merely reserve the record ID so that it will not be used by any other processes in REDCap when creating a record in the near future. Once the record ID is reserved, it will remain reserved for up to 72 hours. When using this method, the assumption is that after reserving a new record ID, you should create a new record with that record name shortly thereafter.
  • Improvement: Import Records API method has a new parameter “csvDelimiter” to specify the delimiter character when sending data in CSV format. Options include: comma ',' (default), 'tab', semi-colon ';', pipe '|', or caret '^'.
  • Improvement: Large performance improvement when importing lots of records (via Data Import Tool, Mobile App, API, or REDCap::saveData) when record auto-numbering is enabled in a project and the import process is forcing the new records to be auto-numbered on the fly. (Ticket #90747)
  • Improvement: Smart Variables and regular field variables can now be piped into the URL of Project Bookmarks. Note: While many Smart Variables can be piped successfully outside of a record context (e.g., [redcap-base-url]), all field variables (e.g., [age], [dob]) and some Smart Variables (e.g., [record-name], [previous-event-name]) can only be piped into the URL while the user is inside a record context, such as viewing the Record Home Page or data entry form. (Ticket #75783)
  • Improvement: When using the “Custom Surveys for Project Status Transitions” feature (as seen near the top of the User Settings page in the Control Center), administrators may now create a new field having the variable name “project_id” in any of the custom survey projects, in which it will automatically save the PID value (Project ID) of the project for which the user is completing the survey. This will allow the survey responses for these custom surveys to be easily identifiable with the project for which each corresponds. Note: This will make project tracking much easier for these. Regarding the “project_id” field being added, if the custom survey project is longitudinal, the field must exist in the first event of the first arm in the project.
  • Improvement/change: When using the “Custom Surveys for Project Status Transitions” feature, the embedded "Create Project" survey is now utilized when a user is copying a project. In previous versions, the survey was only displayed with creating new projects on the Create New Project page. (Ticket #90911)
  • Change: When a user is using the E-signature feature at the bottom of a data entry form, the database query to determine the user's last login time was not optimized and might be very slow in certain circumstances.
  • Change: Slight re-organization of buttons at the top of the instrument list on the Online Designer.
  • Bug fix: If a longitudinal project is utilizing the randomization module and is randomizing by group/site by using Data Access Groups in Step B, then it would mistakenly display an erroneous message about erasing the randomization model because the event designation is missing for the randomization field or criteria fields.

Version 10.2.3 (released on 2020-08-21)

CHANGES IN THIS VERSION:

  • Improvement: When importing a CSV file of data on the Data Import Tool or when importing a CSV Data Dictionary, users may now specify the delimiter of the CSV file as a Comma (default), Tab, or Semicolon.
  • Improvement: In previous versions, the DAG Switcher would not be very performant if there existed very many users and/or Data Access Groups within a project, thus the DAG Switcher would (by design) be automatically disabled for projects in those situations, which was not ideal with regard to user experience. The DAG Switcher is now no longer limited in that way and will now function fully regardless of there being many users and DAGs in a given project.
  • Major bug fix: When exporting a report in ODM XML format or exporting an entire project as ODM XML Metadata & Data, and there exist 30 or more records in the project (or 30+ rows of data as seen in a report), it would mistakenly fail and erroneously display the "We are sorry, but apparently the data export is not able to complete successfully..." error message. Bug emerged in REDCap 10.2.1. (Ticket #90241)
  • Bug fix: When using an AWS-hosted REDCap installation that was deployed using the AWS Quickstart process, the REDCap Easy Upgrade process would not work successfully if Amazon Linux 2 had been used as the server operating system for the AWS deployment. This fix makes the REDCap Easy Upgrade process work with both Amazon Linux 1 and 2.
  • Bug fix: If a longitudinal project contains repeating events, in which a record has multiple repeating instances saved for a repeating event but the first instance of the repeating event was deleted, the Record Home Page would mistakenly still display a column for the first instance even though it has no data. It should not be displaying that column at all if it has no data.
  • Bug fix: When viewing a report containing multiple pages, the search feature for the report would mistakenly not display except on the first page. Bug emerged in REDCap 10.2.1. (Ticket #90262)
  • Bug fix: When upgrading to REDCap 10.0.0, the encoding/collation of a column in one database table might not get set correctly depending on the default collation setting of the REDCap installation. (Ticket #90343)
  • Bug fix: Small aesthetic issues with the width of contents inside the DIV color classes (e.g., red, blue, green).
  • Bug fix: If a survey page or data entry form has several Signature fields (i.e., Signature field type), if a user downloads a PDF of that instrument/survey, the PDF file might mistakenly cause the signatures not to be placed correctly inside the PDF, and in some more extreme cases might cause some of the signatures not to display at all depending on their placement relative to the end of the page in the PDF. (Ticket #90310)
  • Change: Due to the amount of users complaining about the fact that SAS exports will truncate long field labels and long multiple choice option labels, this behavior has been changed so that those will no longer be truncated in the SAS syntax file for SAS data exports. Note: This behavior to truncate labels in SAS exports was originally changed in REDCap 10.0.3.
  • Bug fix: If a field is embedded inside itself, which is not allowed, it would throw a JavaScript error and prevent the survey page or data entry form from loading fully. Instead it now displays a proper error on the page when this occurs. (Ticket #90394)
  • Bug fix: When using the Double Data Entry module in a project, if a DDE user attempts to create a new record that has already been created by the other DDE group, it would mistakenly re-number the record name to a new name (as if record auto-numbering were enabled) when saving the record *only if* some fields on the data entry form were required and were left blank. (Ticket #89152)
  • Bug fix: The variable "target" was added to the reserved list of illegal variable names because it might cause JavaScript errors to occur on a survey page or data entry form when a field with that variable name is being used in branching logic or a calculation.
  • Bug fix: Data Quality rule B might return false positives or might fail to return true discrepancies if a field with no value has certain branching logic. (Ticket #89337)

Version 10.2.2 (released on 2020-08-14)

CHANGES IN THIS VERSION:

  • Major bug fix: When on a survey page or data entry form, the Secondary Unique Field (if enabled in the project) would mistakenly not be checking for the uniqueness of the field's value when a value was entered/changed for that field on page. Note: This issue did not affect values being imported via Data Import Tool, API, or Mobile App.
  • Major bug fix: When using the randomization module and utilizing strata fields that exist on a different instrument and/or event from the randomization field, if a user adds or changes a strata field's value during the process of randomization, it mistakenly would not save the new values for the strata fields, thus leaving them with their value prior to when randomization took place. (Ticket #89686)
  • Bug fix: In longitudinal projects, the events listed at the top of the table on the Record Status Dashboard were mistakenly not being displayed.
  • Bug fix: When using the Smart Variable [survey-link] when the survey title is blank (i.e., has no value entered), it would mistakenly output an invisible hyperlink. In this particular case, it will instead now set the hyperlink label to be the URL of the link itself.
  • Bug fix: Seven Laboratory fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: When moving multiple fields at the same time in the Online Designer when the project is in Draft Module while in production, it might mistakenly throw a fatal PHP error. (Ticket #89734)
  • Bug fix: In certain unknown situations when importing large amounts of records at the same time into a project that contains Data Access Groups, in which a user that is not assigned to a DAG is performing the import and is assigning records to DAGs during the import process using the "redcap_data_access_group" field, the back-end Record List Cache might get out of sync and might cause some pages (e.g., Record Status Dashboard) to mistakenly show that the imported records are not assigned to a DAG. This situation would often require a REDCap administrator to have to clear the Record List Cache via the button on the Other Functionality page in order for the record(s) to display as if assigned to their proper DAG.
  • Bug fix: When viewing the Data History dialog of a field in a multi-arm longitudinal project, in which a record exists on multiple arms and then is deleted from one of the arms, it might mistakenly display the history of data values incorrectly in the Data History dialog. (Ticket #67037)
  • Bug fix: When using the randomization module while a project is in production status, and then a REDCap administrator moves the project back to development status and then back to production again, the randomization field's values do correctly get erased for all records when moving back to production; however, it mistakenly does not set all the records back to a pre-randomized state. Instead, all the records are still listed as having been randomized, even though they no longer have a value for the randomization field, which results in an error being displayed on the data entry form. (Ticket #89334)
  • Bug fix: The "Edit project settings" link next to the tabs on the Project Setup page would mistakenly disappear if the browser window was not very wide or if the user was using the text enlarge/zoom feature in the browser. (Ticket #89772)
  • Bug fix: When downloading very large data export CSV files, due to various server configurations, it might mistakenly result in a CSV file that is 0 bytes in size, thus preventing the user from actually downloading the exported data file. (Ticket #89117)
  • Bug fix: A foreign key on the "redcap_alerts" database table was not set up correctly.
  • Bug fix: While some of REDCap's pages were widened in version 10, the DIV color classes (e.g., red, blue, green) were not, thus causing some pages not to look like they are aligned correctly, especially if using custom banners at the top of the Home Page, login page, or My Projects page. (Ticket #89979)
  • Bug fix: When assigning a user to multiple Data Access Groups using the DAG Switcher, if the user's current DAG assignment has not been enabled for them in the DAG Switcher, it would mistakenly allow the DAG Switcher to work but could lead to a confusing user experience because the user would not be able to move themselves back to their original DAG assignment after moving out of it. This has been changed so that an error message is now displayed in this use case and informs the user how to address it.

Version 10.2.1 (released on 2020-08-07)

CHANGES IN THIS VERSION:

  • Major bug fix: When upgrading REDCap using the Easy Upgrade process, it would mistakenly not execute all the incremental upgrade scripts required during this process, thus resulting in the "YOUR REDCAP DATABASE STRUCTURE IS INCORRECT!" error message that would be displayed in the Control Center immediately after the upgrade. Note: This issue might still occur when upgrading to this version, but it will not occur when you upgrade to another version after this version. (Ticket #89382)
  • Improvement: The "Response Limit" option on the Survey Settings page now allows for the use of the rich text editor when defining custom text to display to respondents on the survey when limit is reached.
  • Improvement: The performance of the getAutoId() function has been improved, in which it can now determine the next auto-numbered record ID twice as fast (or faster), thus using less database resources during the process for large projects. (Ticket #89389)
  • Change: For the option "Survey-specific email invitation field" on the Survey Settings page, it adds a note that the survey-specific email field is not required to be set if a project-level email field has already been defined in the project. This was added to reduce confusion for users.
  • Bug fix: Depending on the type of deployment initially made in AWS via the REDCap AWS Quickstart, REDCap might not always be able to successfully determine if it is currently running on AWS Elastic Beanstalk.
  • Bug fix: When performing piping of a field with both ":value" and the Smart Variable [X-instance] appended to the field variable (e.g., [field:value][last-instance]), it would sometimes mistakenly not perform the piping at all. (Ticket #59671)
  • Bug fix: If a longitudinal project is utilizing the randomization module but randomization has not been fully set up yet, the Randomization Setup page would mistakenly display an erroneous message about erasing the randomization model because the event designation is missing for the randomization field or criteria fields.
  • Change: REDCap no longer suppresses PHP warnings when error_reporting is set to “E_ALL” in PHP by manually changing it in the REDCap code or when the REDCap server has been specifically designated as a “development server” in the Control Center. (Ticket #86767)
  • Bug fix: The Easy Upgrade feature might mistakenly display two columns for "Standard Release versions" (in which the second one is empty) when notifying an administrator that a new REDCap version is available. It should not display the second, empty column. (Ticket #89356)
  • Bug fix: Prevent a user's IP address from getting auto-banned if somehow the IP address is a blank/empty string value. (Ticket #89367)
  • Bug fix: When a report filter references a field from a repeating event or repeating instance, in which the filter logic is checking if the field's value is blank ([field] = "") or non-blank ([field] <> ""), it might mistakenly return too many rows in the report as false positives for the filter logic. (Ticket #89256)
  • Bug fix: The action tag @HIDECHOICE would fail to function correctly for a matrix of checkbox fields, thus mistakenly displaying all the checkboxes for the field in the matrix when it should instead be hiding some. (Ticket #88810)
  • Change: When viewing the Participant List page, if the survey has the "survey-specific email invitation field" enabled, it will now display a small notice about this fact near the top of the Participant List table to inform the user and provide more clarity regarding the source of the email addresses being used for that particular survey.
  • Change: A warning message is now displayed for users that attempt to use both the Survey Queue and Survey Auto-Continue features together in the same project. If one is already enabled while attempting to enable the other, the warning will inform the user that these two features can sometimes conflict with each other.
  • Bug fix: If the Secondary Unique Field is enabled in a project and its value is being pre-filled via 1) the @DEFAULT action tag, 2) the GET/query string parameter method for surveys, or 3) the POST parameter method for surveys, it would fail to perform the duplicate value check on the field when the form/survey initially loads, thus mistakenly allowing for duplicate values to be entered. (Ticket #88854)
  • Change: When creating a new Table-based user account or editing an existing user account, it would not allow the user's expiration date/time to be set to today's date. In some cases this is desirable, so this has been modified so that it merely gives a warning about this and no longer prevents the form from being submitted in this case. (Ticket #89376)
  • Bug fix: When using the "View project as user" feature, the left-hand menu would mistakenly not display only the reports to which the user being impersonated has access to view. (Ticket #82697)
  • Bug fix: When using the "View project as user" feature, some parts of the Other Functionality page would mistakenly be displayed to admins that the impersonated user normally would not see. (Ticket #88759)
  • Bug fix: If an instrument label is very long with no spaces or hyphens, it might cause the Data Entry Rights table in the Editing Existing User dialog on the User Rights page to spill over and push the radio buttons into incorrect places.
  • Bug fix: When sending SMS messages via Twilio for alerts or for survey invitations, if the Smart Variables [survey-link] or [survey-queue-link] are included in the SMS text, it will mistakenly remove the URL from the message but leave the link's label. (Ticket #89621)

Version 10.2.0 (released on 2020-07-31)

CHANGES IN THIS VERSION:

  • New feature: Integration of Paul Litwin's Stealth Queue external module
    • New ”Keep the Survey Queue hidden from participants?” setting in the “Set up Survey Queue” dialog on the Online Designer
    • This setting will keep the Survey Queue table hidden from participants, and will force Auto Start to be enabled for all queue-activated surveys. This is useful if users wish to use the Survey Queue to automatically guide survey participants to the next survey without displaying the queue of surveys.
  • New hook: redcap_survey_acknowledgement_page - Allows custom actions to be performed on a survey's acknowledgement/"thank you" page immediately after the survey has been completed. Note: This hook is different from the redcap_survey_complete hook because the redcap_survey_complete hook is not recommended if you wish to output HTML, CSS, or JS onto the survey page after the survey is completed (because the page may be redirected immediately after the survey is completed, thus the participant might never see anything output by this hook prior to the redirect). The redcap_survey_acknowledgement_page hook is recommended for outputting HTML, CSS, or JS onto the survey page after the survey is completed.
  • Improvements to the Data Resolution Workflow feature
    • When a user is opening a new data query and assigning the query to a user, there are new options to send a notification to the assigned user via email and/or REDCap Messenger to inform them about their query assignment.
    • Attachment files that have been uploaded to an opened data query may now be deleted after the fact, if needed. Note: As a precaution, only REDCap administrators may delete such attachments.
    • For existing data queries, users may now be assigned to an opened query after the fact, and if the data query already has a user assigned to it, it may be reassigned to another user.
  • Bug fix: When using the Clinical Data Interoperability Services with Cerner EHR, the FHIR results could mistakenly return as paginated, thus not returning the entire data set expected.
  • Bug fix: If an alert is set to be recurring or is set to send only once but not "Immediately", then if the alert fails to send (e.g., if the recipient's address is blank/has no value), it would mistakenly keep trying to send repeatedly every minute. And if the "Email to send email-failure errors" option is set, then the recipient defined for that option would mistakenly get sent an email every minute for every record upon which the alert has been triggered, which could mean that thousands or tens of thousands of emails will get inadvertently sent per day.
  • Bug fix: A bug fix was made in REDCap 9.5.26 LTS and 10.0.3 Standard to truncate long field labels and multiple choice labels for fields in any stats package file downloaded from the Data Exports page. However, this should have only been applied specifically to SAS exports since the truncation can cause issues in other stats packages when certain labels are very similar, thus making it difficult to tell fields apart from one another. This truncation of labels now only occurs during SAS exports.
  • Bug fix: When REDCap is using an SSL database connection, while most pages in REDCap will work normally, some pages might mistakenly crash due with a fatal PHP error for some types of database connections pertaining to the use of specific SSL certificate-related parameters. (Ticket #89096)
  • Bug fix: The "Redirect to a URL" survey termination option would allow survey URLs to be entered but would mistakenly not allow survey queue URLs to be entered.
  • Bug fix: When using the datediff() function in a calculated field or branching logic in which the date format parameter is not provided but the returnSignedValue parameter is provided as the fourth parameter, then it would mistakenly result in an error popup on the survey page or data entry form. Bug emerged in REDCap 9.9.2. (Ticket #89007)
  • Bug fix: When a REDCap administrator is adding or editing an alert in a project in which they are not a user, if the admin selects their own email address as the Email To, CC, or BCC for the alert, it would mistakenly not save their email address correctly for the alert, which would often prevent the alert from sending successfully upon being triggered. (Ticket #89226)

Version 10.1.5 (released on 2020-07-24)

CHANGES IN THIS VERSION:

  • Minor security fix: If a malicious user has knowledge of REDCap's infrastructure and code, they could potentially make calls to a specific REDCap end-point that is used to ping third-party web services that REDCap utilizes throughout the application, in which carefully-crafted calls to this end-point could cause service account information from the platform to be returned back and leaked to the user. This issue appears to only exist when hosting REDCap on certain cloud-based hosting platforms, such as Google Cloud.
  • Improvement/change: When running Data Quality rule H on a project with many hundreds or thousands of records, the rule might mistakenly time out or might crash due to a PHP memory limit error, in which none of the calculations could ever be corrected by rule H if it timed out or crashed. To prevent this, rule H will perform an internal batching of 100 records at a time to ensure that the rule will execute more efficiently and thus will finish successfully. Note: The internal batching process will occur invisibly, so nothing will appear different at all with regard to user experience.
  • Bug fix: If the [survey-link] Smart Variable is being utilized for an instrument that is not enabled as a survey, it would mistakenly return a blank value/string rather than of six underscores, and if custom text is provided as a parameter for the Smart Variable, it would return a hyperlink with a blank value for the "href" attribute.
  • Change: In the field-view display of the Online Designer, each field will no longer have a link to open the instructional popup for Field Embedding (since this is a bit repetitive), but instead there will be a single floating box on the right side of the page for informing users on how to utilize Field Embedding and for opening the popup. (Ticket #88418)
  • Bug fix: Addressed issues with regard to incremental upgrades in which SQL errors might occur when upgrading from very old versions.
  • Bug fix: When downloading a PDF of an instrument/survey containing data, if a single word in the text data of a Notes field exceeds the maximum width of the text in the PDF, such as if a long URL exists in the text data, it would mistakenly cause the text to get split up with one word on each line, thus making the text unnecessarily tall in the resulting PDF. (Ticket #86991)
  • Bug fix: If a longitudinal project is utilizing the randomization module, and somehow the event mapped for a strata field or randomization field has been set to NULL (missing a mapped event) on the backend (possibly due to various changes in the project after the randomization model had been saved), it would fail to display the randomization button on the data entry form for any event. To make users aware of this issue when this occurs, it will now display a warning message on the randomization setup page and inform the user how to correct the issue. (Ticket #88594)
  • Bug fix: The "email" field validation was slightly incorrect and would allow a period/dot to be entered immediately before the @ symbol in an email address that was entered in an email-validated field, in which this should not be considered a valid
  • Bug fix: On PHP 7.4.6+, some pages in REDCap (e.g. Add/Edit Records page) were loading much slower than expected. This fix should resolve this slowness; however, it has not been officially confirmed. email address.
  • Bug fix: When an embedded field has branching logic and is also a required field, if the embedded field is currently hidden by branching logic when the survey page or data entry form is submitted, REDCap will mistakenly display the "Some fields are required" message for that field. It should never display that message for fields hidden by branching logic. (Ticket #88864)

Version 10.1.4 (released on 2020-07-17)

CHANGES IN THIS VERSION:

  • Major bug fix: When piping is being performed or when logic is being evaluated that contains an event-based Smart Variable that is prepended to a field variable (e.g., [first-event-name][age]), it might not get parsed correctly and might mistakenly return an incorrect result.
  • Bug fix: When more than one auto-complete drop-down field is embedded inside another field on a data entry form or survey page, only the first embedded auto-complete drop-down in that table row would get enabled and function correctly. Thus all other drop-downs in that row would mistakenly not function.

Version 10.1.3 (released on 2020-07-17)

CHANGES IN THIS VERSION:

  • Change: The text was updated for the REDCap features listed on the REDCap Home Page.
  • Bug fix: When sending emails via the Mandrill Email API, the SendGrid Email API, or while using the Google App Engine platform for hosting, attachments on emails would mistakenly not retain their original file name in the email received.
  • Bug fix: In the API Playground, the example R code produced for API method "Export PDF file of instruments" was missing certain arguments (record, instrument, event), and also was mistakenly missing quotes around the API token value. (Ticket #88079)
  • Bug fix: When a calculation or branching logic references a field from a repeating instrument or repeating event, in which the instance number or an [X-instance] Smart Variable is explicitly provided (e.g., [field][current-instance] + [field][2] + [field][3]), the JavaScript version of calculations and branching logic that runs on a form/survey page might mistakenly assume the value as a string of text even when the field is a number/integer field type, thus resulting in an incorrect value displayed on the page. However, the correct value would be saved for a calculated field on the page after clicking the Save button. Note: For calculations, data imports and Data Quality rule H would still be correct and store the correct value. (Ticket #88143)
  • Bug fix: When a field is embedded inside another field that is being hidden by branching logic on the page, it might cause a "BRANCHING LOGIC ERRORS EXIST!" error to mistakenly appear on the data entry form or survey page. (Ticket #88134)
  • Bug fix: When importing a CSV of arms on the Define My Events page, it would mistakenly allow an arm's number to be imported with a value of "0", which is not allowed and causes issues with accessing records in that arm afterward in the user interface.
  • Bug fix: When using a calculation or conditional logic in a longitudinal project that contains repeating instruments and/or repeating events, if a checkbox field is referenced in the calc/logic and has an [X-instance] Smart Variable appended to it (e.g., [checkbox_name(2)][last-instance]), the calc/logic might mistakenly not get parsed correctly and might return an incorrect result. This only occurs for checkboxes on repeating instruments/events in longitudinal projects. (Ticket #88065)
  • Bug fix: When viewing the instrument/event options for Report B on the "Data Exports, Reports, and Stats" page in a project, the instrument/event multi-select fields would mistakenly be too narrow and would often prevent users from being able to distinguish which instruments/events they are selecting. (Ticket #88261)
  • Bug fix: CSV files that are exported for the following places might be exported as UTF-8 encoded but would mistakenly be missing the BOM (Byte Order Mark): export for randomization template allocation tables, export for Automated Survey Invitations in the Online Designer, and the export for the "E-signature and Locking Management" page. (Ticket #87787)
  • Bug fix: If users have bookmarked the link to the PDF archive tabs in the File Repository for either the survey PDF Auto-Archiver or the Record-level Locking Enhancement (PDF confirmation & automatic external file storage) feature, and either of those features have been disabled in a given project, the user would mistakenly be able to view those pages in the File Repository and possibly download PDF files from those pages if those features were previously enabled and utilized in the project.
  • Bug fix: When piping the [form-url] or [form-link] Smart Variable when they have an [X-instance] Smart Variable appended to them, in which the "instrument" parameter of [form-url] or [form-link] is not specified, it might mistakenly return a blank value instead of the URL/link.
  • Bug fix: When a slider field's value is being piped onto the same instrument or survey page in which the slider itself is located, it might mistakenly not update the piped value on the page when the user modifies the slider value, such as when initially clicking on the slider to activate it or when clicking the slider's "reset" link.
  • Bug fix: The documentation for the developer method REDCap::saveData() was incorrect with regard to what "item_count" represents in the returned response, specifically for type="flat" data. (Ticket #88378)
  • Bug fix: When a REDCap administrator is using the "View Project as User" feature on a user that has been assigned to multiple Data Access Groups via the DAG Switcher, the "Current Data Access Group" banner would mistakenly not be displayed at the top of the page for the administrator. (Ticket #88392)

Version 10.1.2 (released on 2020-07-10)

CHANGES IN THIS VERSION:

  • Major bug fix: If calculated fields in a project have the exact same calculation/equation as another calc field in that project, it could cause incorrect values to be returned and saved for those calc fields when submitting a form/survey, when importing data, or when running Data Quality rule H. Bug emerged in REDCap 10.0.7 (LTS) and 10.1.1 (Standard). This bug might also affect the results of custom Data Quality rules, but it is currently unknown if this is true. This would only affect calculations that were triggered by data changes after upgrading to 10.0.7 (LTS) and 10.1.1 (Standard), in which they can be fixed afterward by running Data Quality rule H in a given project.
  • Bug fix: Some language variables were duplicated and mistakenly overwrote some text on the Field Embedding instructional page/popup. (Ticket #87989)
  • Bug fix: The Easy Upgrade feature might mistakenly not execute the entire SQL upgrade script for certain web server or database server configurations (the ultimate cause is unknown). This could cause problems after the upgrade completes in which the Auto-Fix feature might not be able to fix it without some extra SQL needing to be run. (Ticket #87994)
  • Bug fix: The parsing of some conditional logic might mistakenly fail with a fatal PHP error for unknown reasons, possibly only for specific PHP versions. (Ticket #87983)
  • Bug fix: If a "Designated email field for sending survey invitations" is being used in a project, in which that email field exists on a repeating instrument or repeating event, then the Survey Invitation Log page would mistakenly fail to display the record name for a scheduled/sent invitation and would instead display the slash-eye icon to indicate that the record name is not displayable. (Ticket #87795)

Version 10.1.1 (released on 2020-07-09)

CHANGES IN THIS VERSION:

  • Critical bug fix: When collecting data using a public survey where multiple participants are entering data near-simultaneously (i.e., submitting the survey within the same fraction of a second), a scenario may arise in which those multiple responses could get partially merged together. When this occurs, it appears in the logging that two new records were created, but on some occasions the second participant ends up overwriting the first participant's responses. This issue only occurs when the project's back-end Record List Cache gets out of date and somehow doesn't include some of the new records created via the public survey. While this issue is fairly rare, it can cause data loss when a participant accidentally overwrites another's response, and the worst-case scenario could be that a participant ends up viewing another participant's response, thus possibly resulting in a privacy leak if private and/or identifying information (e.g., PHI) has been entered on the survey.
  • New feature: SendGrid Email API Integration
    • As an alternative for sending outgoing emails from REDCap (rather than using the standard settings in PHP.INI to send them natively from the web server), you may use SendGrid, which is a third-party paid service (owned by Twilio) that can send emails on behalf of REDCap.
    • The option can be configured on the General Configuration page in the Control Center. You merely have to provide the API key for your SendGrid account, and it will begin using the SendGrid Web API to send *all* emails going out of REDCap.
  • New feature: Select and modify multiple fields together on the Online Designer - Users may select multiple fields on the Online Designer by holding the Ctrl, Shift, or Cmd key on their keyboard while clicking on the field in the table, which will reveal the options to Move, Copy, or Delete all the selected fields. To make users aware of this feature, a floating note now appears near the right side of the page in the Online Designer with instructions on how to use this.
  • Improvement: Projects that have the Clinical Data Mart feature enabled will now be able to export the Clinical Data Mart settings in the Project XML file for the project and thus will be able to create new projects using that Project XML file as an alternate means of creating a Data Mart project. Note: Users will still be required to have system-level Data Mart permissions (granted by an admin) in order to use the XML file to create a Data Mart project.
  • Major bug fix: If a record has been locked at the record level and the record is renamed, the record will mistakenly no longer appear to be locked anymore.
  • Major bug fix: If a record has been locked at the record level and then the record is deleted and another record is created with the same name, the new record will mistakenly be initially locked after creation and have the same lock status and lock time as the original record bearing its name.
  • Bug fix: Branching logic now works for embedded fields - A JavaScript issue (which is resolved separately in this release) was affecting embedded fields and made it impossible for a field's branching logic to function if it was embedded inside another field. Now that the other issue has been resolved, it has unblocked the issue that prevented branching logic from functioning for embedded fields. Thus, fields embedded inside other fields will now be hidden/displayed appropriately according to their own defined branching logic, as was originally intended with the embedded fields feature. Note: The documentation regarding branching logic for embedded fields has been modified accordingly to reflect this change in behavior due to the fix.
  • Bug fix: If a slider or file upload field is being hidden by branching logic, they would mistakenly not get reset back to their original state with the slider placed back at mid-position and the file upload field reset back to the "Upload file" link, respectively. This would be very confusing to users if the fields were hidden by branching logic, in which their field was erased, and then while on the same page, the fields were revealed again looking as if they had a value when they actually did not.
  • Bug fix: Only administrators that have the specific admin privilege "Access to all projects and data" could create a General Notification in REDCap Messenger. This is a mistake. Instead it should be that a user that has at least one of any type of admin privilege can create a General Notification.
  • Bug fix: When clicking the "All custom" button on the Data Quality page, it would mistakenly execute rule I.
  • Bug fix: When using Data Access Groups in a project, if a user was added to the project's User Rights page with a capital letter in their username, then the Data Access Groups page would mistakenly display the user's username and name as blank (with only a comma displayed) in the "Users in group" column no the page. (Ticket #86811)
  • Bug fix: If a File Upload field is embedded in the choice label of a radio button or checkbox field, it would mistakenly overlap the choice label text.
  • Bug fix: When importing data via the API for a repeating instrument, many of the normal checks that ensure that the fields "redcap_repeat_instrument" and "redcap_repeat_instance" have valid values where mistakenly getting bypassed and thus not performing all the necessary checks to ensure the best data quality during the import. For example, importing a field on a repeating instrument but leaving the "redcap_repeat_instance" field blank would not return an error but would instead assume the value is "1", which should not be assumed. (Ticket #75854)
  • Change: When a user accesses a project for which their user privileges have expired, it now tells them to contact the project owner rather than telling them to contact the REDCap administrator.
  • Bug fix: When using the Clickjacking Prevention feature, it would mistakenly prevent REDCap from being embedded inside an EHR when using the Clinical Data Pull (CDP) EHR launch.
  • Bug fix: If using the Mandrill Email API integration to send emails from REDCap, it would mistakenly fail to add the appropriate file attachments (when applicable) to any outgoing emails and would instead send emails successfully without any attachments.
  • Bug fix: If a text field or notes field is embedded inside a radio button or checkbox field on a survey, in which the Enhanced Radio/Checkbox setting has been enabled for the survey, it would prevent participants from using the Space key when entering a text value for the embedded field.
  • Minor security fix: Prevention of CSV injection - Users or survey participants could enter +, -, @, or = at the beginning of a text field's value, and if a user is performing a CSV export of the data and opening the file in Excel (and possibly other spreadsheet software), it could cause that data to be inferred as a formula by Excel, which could have some security consequences. In these cases if a data value in a CSV Raw or CSV Labels export begins with one of those characters, a space will be prepended to the text value to prevent this issue from occurring.

Version 10.1.0 (released on 2020-06-30)

CHANGES IN THIS VERSION:

  • New feature: Granular administrator privileges - There now exist seven different categories of privileges that may be attributed to a REDCap administrator. If a user has at least one admin privilege, they are considered a REDCap administrator and thus will be able to access the Control Center; however, they will only be able to access the things to which they have been granted access. Note: Following the upgrade to v10.1.0, any users who were designated as REDCap administrators beforehand will now have all seven categories enabled. Thus they will not lose any privileges at all after the upgrade. Listed below are each of the admin privilege categories and an explanation of what they mean and where they apply.
    • Set REDCap Administrator Privileges – User can access the 'Administrator Privileges' page (i.e., this page), and can set admin rights for any user.
    • Access to all projects and data with maximum user privileges – User has full access to all REDCap projects in the system and has maximum privileges within those projects. Within the Control Center interface, the user can access and use the following pages that pertain to project administration: To-Do List, Survey Link Lookup, and API Tokens.
    • Manage user accounts – User can access, modify, and (if using Table-based authentication) create REDCap user accounts. The following pages can be accessed and utilized: Browse Users, Add Users, User Allowlist, and Email Users.
    • Modify system configuration pages – User can modify settings on all system configuration pages in the Control Center, which includes all pages listed under the 'Miscellaneous Modules' and 'System Configuration' sections on the left-hand menu. Note: If the user does not have this specific privilege but does have at least one other administrator privilege, they may still access and view the system configuration pages but only in read-only mode.
    • Perform REDCap upgrades – User can access tools used for upgrading the REDCap software, including notifications about new versions available and also accessing the Easy Upgrade feature (if enabled). Note: This admin privilege does not apply when upgrading REDCap using traditional methods (i.e., when not using the Easy Upgrade) because the traditional upgrade process occurs mostly outside of the REDCap user interface in a database client and via direct server access.
    • Install, upgrade, and configure External Modules – User has the ability to install External Modules from the REDCap Repo, and can enable and configure them at the system level. This does not apply to enabling and configuring an External Module in a project, which is governed by other user privileges. Note: If the user does not have this specific privilege but does have at least one other administrator privilege, they may still access and view the External Modules page in the Control Center but only in read-only mode.
    • Access to Control Center dashboards – User can access and utilize all pages listed under the 'Dashboard' section of the Control Center's left-hand menu.
  • Change/improvement: In Alerts & Notifications, the email "To" field that is used for an alert now allows fields having custom email validation (i.e., added manually in the redcap_validation_types database table) to be utilized as the recipient. Previous versions only allowed fields to be used that had the explicit "email" field validation.
  • Bug fix: When using the color-picker to edit the text color or background color of a Project Folder on the My Projects page, the text field to add/modify the hex color code would mistakenly be disabled when it should instead be editable.
  • Bug fix: If an External Module is calling REDCap::saveData() in a project using Twilio for surveys or Alerts & Notifications, depending on the context it might mistakenly throw a fatal PHP error if the call to REDCap::saveData() triggers a voice call or SMS message via Twilio.
  • Bug fix: On the System Statistics page, the number of Completed projects would mistakenly not get included in the count of Total Projects. (Ticket #86998)
  • Bug fix: The iOS version number would mistakenly not be detected accurately for iPads running iOS 13. (Ticket #87081)
  • Bug fix: If the Clickjacking Prevention setting is enabled on the "Security & Authentication" page in the Control Center, it might prevent the Clinical Data Pull feature from working correctly when performing an EHR Launch in which a REDCap window is embedded inside an EHR user interface.
  • Bug fix: When editing an alert on the Alerts & Notifications page, the "Email From" drop-down might mistakenly list the current user's email address twice, in which the second instance might have the text "[email no longer belongs to a project user]" appended to it.
  • Bug fix: When adding a new Table-based user via the "Create User (bulk upload)" tab on the "Add Users (Table-based Only)" page in the Control Center, it might give an inaccurate and confusing message if that user account already exists. (Ticket #87143)
  • Change: Support for Internet Explorer 9 has been removed.

Version 10.0.4 (released on 2020-06-23)

CHANGES IN THIS VERSION:

  • Improvement: In REDCap 10.0.2, a new feature was added to the Online Designer’s “Add/Edit Branching Logic” dialog to help users modify branching logic for many fields at once if they had the exact same branching logic. Now this has been improved further so that if users do not want to keep seeing this prompt when editing branching logic, a new checkbox in the dialog that says “Do not show this message again” can be checked, which will prevent the prompt from being displayed in that project for that user during the remainder of their REDCap session.

  • Change: When using the new Break the Glass feature as part of the CDIS (Clinical Data Interoperability Services) functionality, it now requires that you enter your password for your REDCap account for increased security as part of the Break the Glass process.

  • Various fixes and updates for the External Module Framework

  • Bug fix: If Missing Data Codes are utilized in a project and a number-validated or integer-validated text field is used in branching logic in which the value of that number/integer field is a non-numerical Missing Data Code, the branching logic might not behave as expected. Bug emerged in REDCap 9.9.2. (Ticket #86841)

Version 10.0.3 (released on 2020-06-19)

CHANGES IN THIS VERSION:

  • Change: To be more inclusive in our community, all references to the terms “blacklist” and “whitelist” have been replaced with “blocklist” and “allowlist”, respectively, in the REDCap user interface, the REDCap code, and in all database table names and columns.
  • Bug fix: If using the HTML tags OL or UL inside the choice label of a left-aligned radio button or checkbox field, the labels might mistakenly overlap on top of the bullets and make them hard to read. This was supposedly fixed in the previous version, but that fix only addressed right-aligned radios/checkboxes.
  • Change: When exporting data to a stats package (R, Stata, SPSS, SAS), if a field contains a long field label, it now truncates the field label in the center of the text (i.e., putting an ellipsis in the middle) to make it more compatible with and easier to read in certain stats packages.
  • Bug fix: When performing an "EHR Launch" for the Clinical Data Pull feature, it would fail to load the REDCap window inside the EHR user interface due to a fatal PHP error. Bug emerged in REDCap 10.0.2.
  • Bug fix: The "reset" link for embedded radio button fields would mistakenly be left-aligned instead of right-aligned.
  • Bug fix: If Field Embedding is used on an instrument in which the field being embedded is a required field, the user would not receive the required field warning if the embedded field was left empty when the instrument was saved.
  • Bug fix: When viewing the Sponsor Dashboard page, if the user is a sponsor of many users, then when the page is scrolled downward, the table header would mistakenly get obstructed and covered by the top navbar.
  • Bug fix: On the My Projects page, the field count hyperlink in the Fields column would mistakenly link to the Online Designer even if the user did not have Project Setup & Design privileges, which would result in an "Access Denied" message when following that link. In that case, it now links to the Codebook instead. (Ticket #86602)
  • Change: When copying a project via the Copy Project page, Alerts & Notifications will now be automatically set to "Deactivated" status in the newly created project, similar to Automated Survey Invitations when copying a project. This is to ensure that they do not start getting triggered and start sending if all the project records were copied from the original project.
  • Bug fix: When sending an Alert as an SMS message via Twilio, the SMS would mistakenly only go to one recipient (and perhaps multiple times to that same recipient) if more than one SMS recipient was listed for the Alert. (Ticket #86623)
  • Bug fix: If a survey title contained HTML tags, those tags would mistakenly get displayed as escaped characters in the Survey Queue setup dialog and on a record's Survey Queue page.
  • Bug fix: When an administrator is resetting the password of a Table-based user's account on the Browse Users page, it would mistakenly send the email with the From as the admin's name/email when it should instead send it with the From as the general administrator name and email address that is defined for the system.
  • Bug fix: When adding users to a project using the API Import Users method, the format of the usernames were mistakenly not being checked and thus would allow usernames containing invalid characters to be added to projects.
  • Bug fix: When a radio button field is embedded via Field Embedding in another field on an instrument, and that instrument is enabled as a survey and has the Enhanced Radios/Checkboxes option enabled, then if a participant is taking the survey and selects a choice for the field and then clicks the "reset" button to de-select it, although this action would correctly remove the radio value, it would appear as if it hadn't been de-selected, which is confusing. (Ticket #86645)
  • Bug fix: When using Twilio telephony services for surveys, in which the default invitation preference for new survey participants has been set to a value other than "Email", when new records are created in the project specifically via the API Import Records method, those participant's invitation preference in the Participant List would mistakenly not get set to the correct value but would always get set to "Email". Note: If importing data via the Data Import Tool, the invitation preference would get set correctly. (Ticket #86673)
  • Change: In previous versions, date fields that have Y-M-D date format would allow M/D/Y format values (i.e., American format dates with slashes instead of dashes) to be entered, in which it would automatically reformat the value to a Y-M-D format date with dashes. This is a very old behavior from the earliest days of REDCap that was meant to be a convenience for users, who were mostly from the U.S. at that time. However, since that time REDCap has grown internationally, and it is no longer U.S.-centric as it was in the early days. It makes more sense at this time to remove this old behavior so that Y-M-D date formats only accept Y-M-D formatted values. (Ticket #86446)
  • Bug fix: If the Save & Return Later feature has been enabled on a survey but participants are not allowed to return once they have completed the survey, then there is a scenario in which a participant could mistakenly erase all their survey responses after having completed the survey. If they partially complete the survey and then return back to the survey page, in which it asks them to either enter their Return Code or erase all their responses and start over, if that page is opened twice in two different browser tabs, and then the participant completes the survey in one tab and then later views the other tab and clicks the "Start Over" button, it would mistakenly erase all their responses, even though they should not be able to modify their responses after having completed the survey.
  • Bug fix: When an alert has the option "Using conditional logic during a data import or data entry" selected in Step 1 in the "Edit Alert" dialog, in which the alert's conditional logic contains the datediff() function with "now" or "today" as a parameter, if the project is longitudinal and the logic also explicitly references a field in a specific event (i.e., has the unique event name prepended to the field variable), if that particular event being specified has no data in it, then the logic would mistakenly not get evaluated correctly, and the alert would not get triggered/scheduled correctly by the "AlertsNotificationsDatediffChecker" cron job. (Ticket #86689)

Version 10.0.2 (released on 2020-06-11)

CHANGES IN THIS VERSION:

  • Improvement: Integration of Günther Rezniczek’s “My Projects Tweaks” External Module - Improvements for the My Projects page
    • Adds project PIDs (for REDCap Admins only): Adds a new PID column (in between Project Title and Records). The PIDs are links that lead to the Edit Project's Settings page.
    • Link to Online Designer: Adds links to the Online Designer page of projects in the Fields column.
    • Link to Record Status Dashboard: Adds links to the Record Status Dashboard in the Records column.
    • Collapse All: Adds a Collapse All button next to the Organize button that collapses all project folders.
    • Organize Projects filtering: Adds a filter in the Organize Projects pop-up.
  • Improvement: When editing a field’s branching logic in the Online Designer’s “Add/Edit Branching Logic” dialog, when saving the branching logic for a given field, it will now check if any other fields in the project have identical branching logic and will prompt the user to ask them if they want to change the branching logic accordingly for all fields having the same branching logic.
  • Change: The Control Center page "Find Calculation Errors in Projects" has been removed. It served a purpose several years ago to address specific issues with calculation errors that occurred during that time, but it has not been needed in quite a long time. If any calculation errors might exist in a project, as always they can be dealt with using Data Quality rule H.
  • Bug fix: If a hyperlink is used inside a field label or section header text for a field on a survey or data entry form, in which the hyperlink is merely an anchor link to point to another place on the current page, then in some cases clicking the link would mistakenly prompt the "Save your changes?" dialog to be displayed unnecessarily if data had been added/modified on the page. (Ticket #85880)
  • Bug fix: When the survey option "Allow survey respondents to view aggregate survey results after completing the survey?" is enabled on a public survey and a respondent completes the public survey, it would mistakenly not display the button to allow the respondent to view the aggregate survey results. Bug emerged in REDCap 9.10.0 Standard and 9.5.28 LTS.
  • Bug fix: If a vertically-aligned radio button field is embedded in a table in a section header, the choice labels would mistakenly cover the radio button elements themselves and make them either hard to see and/or hard to utilize.
  • Bug fix: Some math functions used in calculations and branching logic (e.g., max, min, sum) might mistakenly yield an incorrect result (often a blank value) if a multiple choice field is referenced inside the function in which the multiple choice field has all numerical codings but at least one of the codings is a negative number. Bug emerged in REDCap 9.9.2.
  • Bug fix: The API method "Export a Survey Queue Link" would mistakenly fail with a fatal error. Bug emerged in REDCap 10.0.1 Standard and 9.5.30 LTS. (Ticket #86155)
  • Bug fix: If using the HTML tags OL or UL inside the choice label of a radio button or checkbox field, the labels might mistakenly overlap on top of the bullets and make them hard to read.
  • Change: When viewing an Automated Survey Invitation in which the From address belongs to a user that no longer has access to the project, it would display the note "[email no longer belongs to a project user]" next to the email address, but it would not display that note for Administrators. It now displays it to both regular users and Administrators to eliminate any confusion.
  • Change: When viewing an alert on the Alerts & Notifications page in which the alert's From address belongs to a user that no longer has access to the project, it now displays the note "[email no longer belongs to a project user]" next to that email address in the drop-down list.
  • Bug fix: When using the Twilio telephony services for surveys in a project, if the "SMS Conversation" option has not been enabled in the project but a participant mistakenly replies back to an SMS they received from REDCap, it would begin the survey as if using the "SMS Conversation" option, which is incorrect. In this case, it now will reply back to them with an SMS saying "Auto-Reply: This SMS phone number is not monitored". (Ticket #61331)
  • Bug fix: When the Save & Return Later option for a survey has been disabled but somehow a user has enabled the sub-option to "Allow respondents to return without needing a return code" for the survey, it would create a scenario via the Survey Queue in which the survey participant might be able to return to the survey even with Save & Return Later having been disabled.Bug fix: In some very specific cases when an External Module is calling the REDCap::evaluateLogic() method in a repeating event context, it might not mistakenly parse the logic correctly if the logic contains a stand-alone [X-instance] Smart Variable (i.e., when it is not appended to a field variable). (Ticket #85914) (Ticket #85891)
  • Bug fix: When executing Data Quality rule E ("Outliers for numerical fields") for a project that has Missing Data Codes defined, it might mistakenly return discrepancies for records that have a numerical Missing Data Code. It should instead be ignoring Missing Data Code values in this DQ rule. (Ticket #85991)

Version 10.0.1 (released on 2020-06-05)

CHANGES IN THIS VERSION:

  • Improvement: New “Break the Glass” feature for CDIS (used for both CDP and Data Mart)
    • This feature is only for installations that have Epic as their EHR, and it is an add-on to the existing Clinical Data Interoperability Services (CDIS) in REDCap. If clinical data is being pulled via the FHIR services from Epic, and REDCap determines that data cannot be pulled for a given patient because the glass needs to be broken for that patient (because they are staff, a VIP, etc.), REDCap will keep a list of these patients, in which they can be selected afterward and have their glass broken by the user on the REDCap side. The user will be given a “break the glass” prompt very similar to the one that users would see inside Epic Hyperspace, and when they break the glass in REDCap, it will make a web service call to Epic to perform the “break the glass” action on behalf of the user, in which case it will get logged appropriately in Epic’s activity logs.
    • NOTE: Because the REDCap “Break the Glass” feature allows users to perform glass-breaking for many patients at once, this feature (once enabled at the system level) is DISABLED by default at the project level due to the possibility of abuse. So an administrator will need to enable this feature for a given project
    • The Break the Glass settings can be set on the Clinical Data Interoperability Services page in the Control Center. It must be enabled and set appropriately for the given Epic installation. Note: The Break the Glass web services must be enabled on the local Epic Interconnect server in order for this feature to work in REDCap.
  • Improvement: Survey pages are now considered ADA Section 508 compliant. The REDCap Development Team at Vanderbilt has been collaborating with the CDC to improve the accessibility of REDCap overall. While the user-facing side of REDCap (i.e., non-survey pages where users must authenticate) is not 508 compliant, it continues to be improved with regard to accessibility over time. But according to the CDC's recommendations and testing of REDCap, survey pages in REDCap do meet the minimum requirement for ADA Section 508 compliance.
  • Bug fix: If upgrading to 9.10.0 from a version lower than 9.9.2, it would result in duplicate queries being added to the upgrade script, thus resulting in MySQL errors during the upgrade. (Ticket #85303)
  • Bug fix: If two users load the same data entry form in a project (i.e., same record, event, instrument, instance), in which one of the users has clicked the plus/minus icon on the left-hand menu to collapse/uncollapse a menu section after loading the form, it would mistakenly not display the Simultaneous User Prevention warning and thus would allow both users to have edit access on that from. (Ticket #85305)
  • Change: Permanently removed some PHP global functions files (form_renderer_functions.phpsurvey_functions.php) since they have been gutted and no longer utilized for several months.
  • Bug fix: Some CSS styling in REDCap's style.css file was mistakenly overwriting CSS used specifically by DataTables, which could affect the look and style of any DataTables used in a plugin or external module. The CSS has been reverted so that it no longer overwrites the DataTable CSS. Bug emerged in REDCap 9.9.0 (Standard). (Ticket #85306)
  • Bug fix: If a field is embedded via Field Embedding into the choice label of a radio button or checkbox field and then is viewed on a survey in which the Enhanced Choice survey option is enabled for radios and checkboxes, then an error message would mistakenly get displayed on the survey page saying that the field had been embedded more than once, which is not true.
  • Bug fix: A JavaScript error might occur on a survey page where it tries to call the undefined function displayFormSaveBtnTooltip(). This error does not seem to cause any issues on the survey though.
  • Bug fix: For certain screen widths, the search box displayed above a report might mistakenly be displayed too far to the right on the page. (Ticket #85415)
  • Bug fix: If Field Embedding is used in which a text field is embedded inside the choice label of a checkbox field, then if the checkbox is checked or unchecked by clicking its choice label (rather than by clicking the checkbox element itself), then it would fail to change the value of the checkbox field despite the fact that it looks like its value has changed. (Ticket #85387)
  • Bug fix: The database query used to generate the list of a record's repeating instances for a given instrument was not correctly optimized and was causing major performance issues for certain projects on certain installations. (Ticket #84936)
  • Change: The @READONLY action tags now display the field labels as slightly less faded out (using 60% opacity instead of 50% as in previous versions), and the text of drop-downs, text boxes, and textarea boxes that have a @READONLY action tag now have a darker text to make them more readable despite being disabled on the page. (Ticket #85396)
  • Bug fix: When sending an Alert as an SMS message, if there is an email address selected for errors to be emailed to a project user in the event that the SMS fails to send for that Alert, it would mistakenly send the error email every time an SMS is sent rather than only when an error occurs.
  • Bug fix: When a Yes-No or True-False field is piped into an Alert's email subject or message text, in which the alert is set to be sent after a delay (not immediately) and/or on a recurring schedule, then the value of the Yes-No or True-False field would fail to be piped into the text and instead would be replaced with 6 underscores as if the value did not exist.
  • Bug fix: Reports that are very wide and very tall would have the fixed headers and fixed first column behavior automatically employed on the report table, but often times the scrollable width of the resulting table would be too wide and would run off the page, thus causing the user to have to scroll the main viewport first and then scroll the table second. It now tries to ensure that the scrollable table itself will fit on the page so that only one instance of horizontal scrolling is required.
  • Bug fix: When upgrading to version 10.0.0 from a previous version, it would mistakenly place the v10.0.0 upgrade SQL queries before the other cumulative upgrade SQL queries for previous versions that were being upgraded through (the in-between versions). The SQL queries being out of order might cause some issues during the upgrade process. (Ticket #85668)
  • Bug fix: The Easter Egg functionality of appending ""&__display_errors=1" to the URL in order to force output a PHP error onto the webpage has now been removed for all cases except for authenticated REDCap administrators because it is a potential security issue.
  • Bug fix: Nearly 200 Laboratory and Vital Signs fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: When using the Smart Variable [survey-queue-link] in a context where the current record does not yet exist (e.g., on the first page of a public survey), it would mistakenly return a URL that might not actually be associated with the record after the record has been created. Instead it now returns a blank value if the record does not yet exist. (Ticket #85602)
  • Bug fix: If Field Embedding is used for at least one field on a survey or data entry, it would cause all auto-complete drop-down fields not to display correctly. (Ticket #85744)
  • Bug fix/change: The Field Embedding feature now notes in the documentation that the Record ID field cannot be embedded, and if a user tries to embed it, it will now display a warning on the survey or data entry form. (Ticket #85739)
  • Bug fix: The REDCap hook named "redcap_survey_complete" would get mistakenly called when a survey participant would attempt to return to a completed survey that has the "Save & Return Later" option enabled when the sub-option is enabled to allow respondents to return without needing a return code - i.e., when it displays the message "Thank you for your interest, but you have already completed this survey". (Ticket #80109)

Version 10.0.0 (released on 2020-05-29)

CHANGES IN THIS VERSION:

  • New feature: Field Embedding
    • Field Embedding is the ultimate way to customize surveys and data collection instruments to make them look exactly how you want. Field Embedding is a Shazam-like feature that allows you to reposition field elements on a survey page or data entry form so that they get embedded in a new location on that same page. Embedding fields gives users greater control over the look and feel of your instrument. Users may place fields in a grid/table for a more compact user-friendly page, or they can position fields close together in a group if they are related.
    • To use Field Embedding, users simply need to place the REDCap variable name of a field inside braces/curly brackets - e.g., {date_of_birth} - and place it in the Field Label, Field Note, Section Header, or Choice Label of any other field on that same instrument. Field embedding will not work across instruments but only on the current instrument/survey being viewed. If on a multi-page survey, then the embedded field must be on the same survey page as its host field.
    • No action tags or custom HTML is required to use Field Embedding. Users can simply use the rich text editor in the Online Designer to design their layout and then place the field variables inside that layout. The layout does not have to be a table/grid (although tables are common for this), and fields can be embedded inside *any* field type (not just Descriptive fields).
    • We wish to thank Andy Martin (Stanford) because his popular Shazam external module served as the conceptual inspiration of the Field Embedding feature.
    • Note: When installing or upgrading to v10.0.0, a new project “Field Embedding Example Project” will be automatically added as a project template to allow users and admins to easily see some examples of Field Embedding in action.
  • Change: A new link to "REDCap Administrator Videos" has been added to the Control Center's left-hand menu under the "Administrator Resources" section, in which this link points to a page that consolidates many REDCap videos aimed at administrators on various topics.
  • Change: Removed the thick black border seen on input fields that have focus for Chrome 83 and higher, which was by default adding the black border to all input fields on all webpages.
  • Change/improvement: Added better error detection to make the data import process more accurate and informational by ensuring that any datetime_seconds values that are missing a “seconds” component will be reformatted to append “:00” and if any datetime values are missing a “minutes” component it will be reformatted to append “:00”, in which it will display a warning to the user on the Data Import Tool page to inform the user that these modifications are happening. Also, if the first two digits of the “year” component are missing for a date or datetime value, it now displays a warning to inform the user that the full year value will be estimated and will note the resulting estimated year value.
  • Change: On the Survey Settings page, The Save & Return Later option "Allow respondents to return without needing a return code" now has a note immediately below it to encourage users not to use this survey option if they are collecting identifying information (PHI, PII) on their survey.
  • Change/improvement: If the Twilio SMS and Voice Call services are enabled at the system level, the Twilio module can now be disabled (if desired) at the project level by an administrator on the "Edit a Project's Settings" page in the Control Center. If disabled for a given project, all references to the Twilio functionality will no longer appear in the project.
  • Bug fix: Clicking on the "What is an E-signature?" link in the "Editing existing user" dialog on the User Rights page would mistakenly not do anything and would result in a JavaScript error.
  • Bug fix: If a project does not contain any date or datetime fields, then when creating/editing an Alert or Automated Survey Invitation, the third "send time" setting's text would mistakenly be missing the text "after time lapse of" immediately after the text "Send the invitation/alert", which could cause confusion for users. (Ticket #84929)
  • Bug fix: Report B would return incomplete returns when viewed on a webpage (but not when exported) under certain conditions, especially if the project is longitudinal. (Ticket #84937)
  • Bug fix: When piping data into a drop-down field on a survey or data entry form that is a repeating instrument or exists on a repeating event, although piping would occur correctly when initially loading the page (using saved values), it would mistakenly not perform real-time piping on the page as fields were modified if those modified fields' values were being piped into drop-down fields on that same page. (Ticket #84951)
  • Bug fix: When the Double Data Entry module is enabled in a project, the Current Users table on the Project Home page might mistakenly get partially covered by the Project Statistics table. (Ticket #84903)
  • Bug fix: When setting a Missing Data Code for a field, it would mistakenly hide all buttons in that row instead of only the Today/Now button for date/datetime fields. (Ticket #84909)
  • Bug fix: When composing multiple batches of survey invitations on the Participant List page without refreshing the page in between batches and the user uses their mouse to highlight the existing email body text and then pastes new text using Ctrl-V into the email body without typing on the keyboard while the cursor is inside the email body text box, then the new pasted text might mistakenly not be used in that batch of invitations being sent, but instead it would send invitations using the default email body text. (Ticket #84351)
  • Bug fix: When executing a custom Data Quality rule that has logic containing fields from both repeating and non-repeating contexts, in some cases the hyperlink for the data value displayed in the discrepancy dialog popup might mistakenly be pointing to a repeating context (e.g., URL contains "&instance=??") even though the field does not exist on a repeating instrument or repeating event. (Ticket #84934)
  • Bug fix: The left-hand instrument menu in a project would mistakenly denote the maximum instance number of a repeating instrument rather than the total count of repeating instances, which can be confusing to users if some instances had been deleted after having been created. If the total count of repeating instances does not match the maximum instance number, then it will now display "max: X, total: Y" next to the instrument name to provide this distinction. Also, the "plus" icon next to a repeating instrument on the left-hand menu would mistakenly not appear if the first instance of the instrument had been deleted (this would occur when viewing the left-hand menu while on another instrument). Additionally, if a repeating instrument had its first repeating instance deleted, the form link on the left-hand menu would still mistakenly point to the first instance by default, which is not intuitive. It now points to the lowest existing instance of that instrument as the default. (Ticket #84943)
  • Bug fix: The note "You may use HTML formatting in the email message..." was mistakenly still being displayed below the rich text editors when composing survey invitations in various places in a project. That note no longer makes sense now that the rich text editor must be used in these places, so the note has been removed.
  • Change: If enabling the Survey Login feature in a project containing repeating instruments or repeating events, it now displays the clarifying message in the Survey Login setup dialog to users so that they are aware: "NOTICE: Fields existing on repeating instruments/events will not work as login fields". (Ticket #85208)
  • Bug fix: In some situations where a data entry form or survey is being submitted after an External Module has relocated some fields on the page (e.g., Shazam), it may prevent the page from being saved successfully due to a JavaScript error. (Ticket #47120)
  • Bug fix: The color picker popup used for Project Folders and for Survey Themes would not be displayed correctly after being opened, so the preset color palette of squares in the color picker had to be removed since they could not otherwise be fixed.
  • Bug fix: When using Missing Data Codes in a project and a radio button or checkbox field has been assigned a missing data code for a given record, and then the user clicks one of the seemingly disabled choices of the field and then clicks Save, it would mistakenly change the value of the field to the choice that was clicked, even though it did not appear as if the field's value changed prior to saving it. (Ticket #85220)
  • Change: The REDCap cron job now logs all events in the redcap_log_eventX table using the current time that the activity is logged - via PHP’s date(“YmdHis”) - whereas previous versions would log all cron activity using the time at which the cron job script began. This is more optimal since cron jobs can sometimes last for many minutes, which makes it more difficult to troubleshoot the timing of certain issues with cron jobs. Regular non-cron scripts will still continue to log events using the time at which the script began.

Version 9.10.0 (released on 2020-05-21)

CHANGES IN THIS VERSION:

  • New feature: Record-level locking feature
    • This feature allows users to lock an entire record (as opposed to locking individual instruments) so that none of the record’s data can ever be modified unless someone with record-level locking/unlocking privileges goes and unlocks the record again.
    • The old “lock all forms for all events” feature has been changed into this new record-level locking feature, which is distinguishable from the existing instrument-level locking feature. Now the instrument-level locking can only be used while on a data entry form (using the Locking checkbox at the bottom of the form). Whereas the record-level locking feature is available as an option on the Record Home Page and on the project’s left-hand menu after a record has been selected.
    • While records have always been able to be locked (i.e., made read-only) for individual data collection instruments in a project, you may now easily lock an ENTIRE record so that no data in the record can ever be modified while it is locked.
    • WHAT HAS CHANGED? It is important to note that the old user privilege "Lock all forms" has now been converted into the new record-level locking feature, which works completely independently from instrument-level locking (i.e., the checkbox at the bottom of data entry forms). Instead of that particular user privilege allowing you to lock all forms individually (which was the previous behavior), it will now serve in a slightly different capacity as the record-level locking user privilege to lock an entire record fully.
    • HOW TO USE IT: You may lock an entire record via the "choose action for record" drop-down on the Record Home Page or by clicking the "Lock Entire Record" link on the project's left-hand menu when viewing a record. Note: Since the record locking and instrument locking are completely separate features, they both may be used together in a project, if you wish. However, please note that since record locking is a higher-level locking than instrument locking, an entire record may be locked or unlocked while one or more instruments are currently locked, but an instrument cannot be locked or unlocked while the entire record is locked.
  • New feature: Record-level Locking Enhancement: PDF confirmation & automatic external file storage (project-level setting) - requires PHP 5.6.0
    • This feature allows users to utilize extra functionality regarding the use of record-level locking in a project. It must first be enabled at the system level (at the bottom of the Modules/Services Configuration page in the Control Center). It is disabled by default for all projects, but users with 'Project Setup & Design' rights can enable it for a project in the Additional Customizations popup on a project's Project Setup page.
    • How it works: When enabled for a project, if a user goes to lock an entire record, they will be presented on the page with an embedded PDF of the entire record’s data, and after confirming that the record is correct, the record will be locked at the record level and a PDF copy of the entire record will be stored in a “PDF Archive of Locked Records” section of the File Repository of the project and additionally will be stored on a secure external server via WebDAV or SFTP storage.
    • The connection to the external file server can be set up as WebDAV or SFTP, in which the details/credentials must be provided when enabling this system-level setting at the bottom of the Modules/Services Configuration page in the Control Center.
    • This feature may be utilized for projects wishing to adhere to certain regulatory compliance, such as 21 CFR Part 11 for FDA trials. Please note that enabling this feature does not make the feature or your REDCap installation automatically “Part 11 compliant”. It is assumed that if using this for Part 11 compliance that you have already gone through all the processes of documenting and validating your REDCap environment (or parts of it) to validate it as “Part 11 compliant” beforehand.
  • Major bug fix: When submitting a one-page public survey, in some specific scenarios after completing the survey, a participant could incidentally cause the survey to get resubmitted (minutes, hours, or even days later), thus creating a duplicate record in the project. This appears to occur mostly for certain mobile devices, in which returning to a tab containing the completed survey might mistakenly cause the survey to get resubmitted somehow. (Ticket #75626)
  • Major bug fix: If a calculated field's equation contains a field with "Number (comma as decimal)" validation or "Number (X decimal places - comma as decimal)" validation, the calculation would mistakenly fail and would often result in an error prompt on the page stating that a syntactical error exists in the calculation, which is untrue. Bug emerged in REDCap 9.9.1. (Ticket #84622)
  • Change: The project ID (PID) of a project is now displayed immediately after the project title at the top of every project page. This will make it easier for users to obtain their project's PID when attempting to identify their project to administrators.
  • Bug fix: When using the Survey Login and clicking the "Show value" link for one of the login fields on the survey login form, it would fail to remove the password mask from the login field. Bug emerged in REDCap 9.9.0. (Ticket #84417)
  • Bug fix: When using the Clinical Data Pull feature and viewing the embedded REDCap page in an EHR user interface, it would mistakenly display some escaped HTML on the page. (Ticket #84422)
  • Bug fix: When uploading an MP3 audio file to be embedded in a Descriptive field on a survey page or data entry form, it might mistakenly not play in Internet Explorer.
  • Bug fix: Seven Laboratory fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: If a project is longitudinal and has either repeating instruments or repeating events, in which a field exists on both a non-repeating event/instrument and on a repeating event/instrument, then if that field is used as a report filter, the report might mistakenly return partially incorrect results. Part of this issue was caused by another fix in REDCap 9.9.1 Standard and 9.5.26 LTS, and the other part is a longer-standing issue caused by difficulty in parsing logic referencing different repeating and non-repeating contexts. (Ticket #84330)
  • Bug fix: For longitudinal projects, the project Logging page would mistakenly display the name of the first event next to the record name for logged events related to Data Access Group assignments for records. It should not display the event name because assigning DAGs is performed at the record level and not at the event level, so displaying the event name for the logged event is misleading.
  • Bug fix: The cron job to routinely reset the record list cache for all active projects was mistakenly not resetting the cache as often as it should.
  • Bug fix: If a calculated field's equation contains certain Smart Variables (e.g., [project-id]), when saving the calc field in the Online Designer, it would note that it is syntactically incorrect, which is untrue. (Ticket #84524)
  • Bug fix: When importing an instrument from the REDCap Shared Library, in which the instrument contains a checkbox field that is used in branching logic or in calculations in the imported instrument, and also that checkbox field's variable name already exists in the project as an existing variable, then when the variable is being automatically renamed during the instrument import process to prevent a conflict with the existing variable, it would mistakenly fail to perform the renaming successfully for checkbox fields, which require a slightly different syntax when being referenced in calc fields and branching logic.
  • Change: If a project contains a large number of users and/or Data Access Groups, it now automatically disables the DAG Switcher feature. This is done because if the table becomes very large, it can cause a major slowdown in the user's browser and possibly cause it to crash. So any projects where Users X DAGs > 10K, the DAG Switcher will be disabled and will not be usable. Also, if a project has a count of Users X DAGs between 5K and 10K, it will still display the DAG Switcher, but it will auto-disable the floating headers and search features on the DAG Switcher table in order to prevent browser slowness. (Ticket #84610)
  • Bug fix: The User Whitelist would fail to work when using external authentication methods (e.g., LDAP). (Ticket #83958)
  • Bug fix: In the Required Fields dialog on data entry forms and surveys, one of the buttons mistakenly did not have its language abstracted for translation. (Ticket #81638)
  • Bug fix: Downloaded PDFs would mistakenly result in the error "AddMBFont: ERROR Encoding [SJIS] Undefine" if the project's "Character encoding for exported files" setting was set to "Japanese (Shift JIS)".
  • Bug fix: When exporting data to SAS while using Missing Data Codes in a project, if any fields contain the @NOMISSING action tag, such fields would mistakenly not be made exempt from the Missing Data Codes when importing the data into SAS. (Ticket #83910)
  • Change: When exporting data to SAS, the line "OPTIONS nofmterr;" is now added to the SAS script to prevent any formatting issues from throwing fatal errors.
  • Bug fix: When rendering a report or performing a data export in which the report contains some report filters, some extra processing was being done unnecessarily that was making the report slower than it should have been. This unnecessary code was removed, which now makes reports load faster (up to 2x faster in some cases) for reports with report filters.
  • Bug fix: When a project that has record auto-numbering enabled exceeds 25,000 records in the project, then the text input field that is displayed (in lieu of a drop-down list) on the Add/Edit Records page would mistakenly allow users to free-form type a new record name that might not comply with the record auto-numbering scheme. To prevent this issue, it now checks to ensure the record being typed already exists.

Version 9.9.2 (released on 2020-05-15)

CHANGES IN THIS VERSION:

  • Improvement: New PDF customization to hide the Record ID from the PDF header. In the "PDF Customizations" section of the "Additional Customizations" dialog on the Project Setup page, users may set this option to display or hide the record name in the top header of every PDF page when downloading a PDF with data for a record. This is a project-level setting, so setting it applies to all PDFs generated for records in the project.
  • Improvement/change: A new "Clear the Record List Cache" button has been added to the Other Functionality page in a project, in which this button is only available to administrators to use. If there appear to be records missing from the project (in reports, record status dashboards, or elsewhere), then the Record List Cache (a secondary list of all record names) might be out of sync and thus might need to be cleared. Clearing the cache will cause the Record List Cache to regenerate and bring back records that appear to be orphaned/missing in the project. Clicking this button will clear the cache and fix the record list. NOTE: This is normally not needed, but there have been instances in which unknown factors caused the Record List Cache to get out of sync, which could cause major problems for some projects.
  • Improvement: A new field “Preferred language” has been added to projects that are created as Clinical Data Mart projects. This field will serve as the location where a patient’s preferred language will be imported as freeform text (e.g., “English”) from the EHR. If a Data Mart project was created in an earlier version of REDCap, this field can simply be added after the fact by adding the variable name “preferred_language” as a Text field with no field validation on the Demography data collection instrument.
  • Improvement/change: The sending of a survey confirmation email now gets logged on the project Logging page when a confirmation email has been set to send to a survey participant after having completed a survey, in which the logged event will note the record name, the To address, the From address, the email subject, and whether or not the email contained attachments (including the PDF of the participant's survey responses).
  • Changes for long-standing quirks with calc fields and branching logic
    • Change: In previous versions, calculated fields could only utilize either numeric fields or date/datetime fields in the calculation. Now non-numeric fields may be used, most notably inside IF statements. For example, if ([field1] = “A”, 0, 99).
    • Change: In previous versions, using > or < in branching logic would not always work as expected. For example, [a] > [b] would have to be formatted as [a]*1 > [b]*1 to work correctly 100% of the time, which is not intuitive. This is no longer required, in which [a] > [b] will work as one would expect in branching logic. Note: This does not apply to calc fields, which have never had this problem.
    • Change/improvement: The datediff() function used in branching logic and calc fields no longer requires the date format parameter (“ymd”, “mdy”, “dmy”). This was required for datediff() in calc fields and branching logic but was not required elsewhere, such as in report filters, DQ rule logic, ASI/Alert conditions, etc. The $returnSignedValue parameter (if provided) can now be provided as the fourth parameter - e.g., datediff([dob], “today”, “y”, true). NOTE: Both of the date/datetime fields used in the datediff function must still be in the same date format (“mdy”, “dmy”, or “ymd”), so that is still a requirement.
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on the project Logging page where a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into the record name of a record imported via the API or Data Import Tool.
  • Change: When creating a new Clinical Data Mart project, the “mrn” field is automatically set as the Secondary Unique Field in the project to ensure that each patient corresponds to one record in the project and prevent duplicates.
  • Bug fix: If the foreign key of a database table is not defined correctly in the REDCap database, the SQL provided by the Control Center warning "Your REDCap database structure is incorrect" would mistakenly fail to fix the issue and would keep appearing after being run. It now provides the correct SQL to run in order to fix the database structure issues. (Ticket #83951, #84054)
  • Bug fix: When using Twilio Telephony Services to send SMS messages from a Short Code phone number, it would fail to send the messages because REDCap would mistakenly prepend a "+" to the Short Code when attempting to send it via Twilio's API.
  • Bug fix: The "redcap_survey_complete" hook would mistakenly get called when a survey participant loads their survey queue when navigating directly to their queue as opposed to navigating there after completing a survey.
  • Bug fix: When using the Dynamic Data Pull (DDP) Custom module to import data from an external data source, the cron job that runs routinely to import data into projects might mistakenly crash with a fatal error.
  • Bug fix: The REDCap installation page would mistakenly crash with a fatal PHP error and would prevent anyone from going through the full installation process. Bug emerged in the previous version. (Ticket #84111)
  • Change/improvement: Added "PARTICIPANT OPTED OUT" as a new valid option that will be logged in the Survey Invitation Log when an SMS fails to be sent via Twilio telephony services because a blacklist rule is violated (as noted by the Twilio service). Documentation regarding how a participant may opt out of receiving SMS messages from Twilio can be found here and here.
  • Bug fix: If an alert on the Alerts & Notifications page contains attachment files in which two or more attachments have the exact same file name, then it would mistakenly not attach all the files to the email but only the last one listed. (Ticket #83903)
  • Bug fix: Two Laboratory fields and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: The sum() function would mistakenly not work as expected and would return a blank value for a calculated field if one or more of the fields used inside sum() have a blank value. (Ticket #84284)
  • Bug fix: In certain cases, if new records are being created in a project while the project's Record List Cache is being built, it might mistakenly cause new records to appear orphaned (as if they were never created) and not appear in reports, dashboards, etc. in the project for a few days (or until the cache is rebuilt). (Ticket #84159)
  • Bug fix: When performing a data import into a repeating instrument, in which all the fields in the row in the data import file have blank values (excluding the record id field, redcap_repeat_instance field, and redcap_repeat_instrument field), it would return a confusing error message and prevent the import from completing. (Ticket #84359)
  • Bug fix: When exporting a Project XML for a longitudinal project, in which the project contains reports with report filters that have the "in All Events" drop-down option selected for a given filter field, the resulting XML file would contain advanced filter logic that would work successfully in a new project created from the XML file, but if a user went to modify that report afterward in the newly created project, REDCap would note that the logic was not syntactically correct (even though the filter logic would work correctly when displaying the report). This is due to the fact that in the XML file it was mistakenly not prepending "[event-name]" to all fields in the advanced logic that did not already have a prepended unique event name. For longitudinal projects with advanced filter logic, all fields must have a prepended event name or else must have [event-name] prepended to the field.
  • Bug fix: If the setting "Email to send email-failure errors" has been defined for an alert in Alerts & Notifications, the email received after an error occurs would mistakenly not contain the real error message of why the alert did not send and also would not contain the alert number of the alert being triggered. (Ticket #84004)
  • Bug fix: When running Data Quality rule D ("Field validation errors (out of range)"), it would mistakenly return discrepancies for valid number values if a field had "Number (comma as decimal)" validation. (Ticket #84004)

Version 9.9.1 (released on 2020-05-08)

CHANGES IN THIS VERSION:

  • New feature: Integration with Mandrill Email API
    • As an alternative for sending outgoing emails from REDCap (rather than using the standard settings in PHP.INI to send them natively from the web server), you may use Mandrill, which is a third-party paid service that can send emails on behalf of REDCap.
    • The option can be configured on the General Configuration page in the Control Center. You merely have to provide the API key for your Mandrill account, and it will begin using the Mandrill API to send *all* emails going out of REDCap.
  • Improvement: A new send-time option has been added when setting up Automated Survey Invitations and Alerts & Notifications. When defining when the ASI/Alert should be sent, the option “Send after a lapse of time” has a new setting added so that, if desired, the user may set the time lapse relative to the value of a date or datetime field in the project. In previous versions, the time lapse setting could only be set relative to the time in which the ASI/Alert was triggered. That is still an option, but now users may also opt to send the ASI/Alert a certain amount of time either before or after the date/time of a specific field. This new setting will allow users to have greater control with regard to setting when ASIs/Alerts will be sent without getting too complicated in their setup, such as having to use complex logic (with datediff, etc.).
  • Improvement: When using the Clinical Data Mart, you may now choose specific MRNs for which to fetch data if you do not want to fetch data for all records in the project.
  • Improvement: When using the Clinical Data Mart, if the project is set to only allow users to fetch clinical data once (which is a project-level setting), this now applies to each record. So if a fetch was done for existing records, and then new records were created later, the user would still be able to fetch data at least once for those new records. Whereas in previous versions, it would only limit users to fetching data once for the entire project (and never again) rather than keeping track of how many times data has been fetched for each individual record.
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered where a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags and/or JavaScript into the query string of a data entry form or record home page.
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered where a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into the uploaded CSV data file on the Data Import Tool page.
  • Change: For external module and hook developers, the location of where the redcap_save_record hook is called has changed very slightly. In previous versions, that hook was called after a record had been saved and also after the following things: the triggering of Automated Survey Invitations, of Alerts & Notifications, and of the Data Entry Trigger. This has now been changed so that the hook is still called immediately after the record has been saved but *before* ASIs, Alerts, and DETs are called. This does not have any negative consequences but comes with the advantage of allowing module/hook developers to manipulate data via the redcap_save_record hook so that the data may then be utilized via piping or conditional logic by ASIs, Alerts, and/or DET afterward. (Ticket #83095)
  • Bug fix: Certain menu toggles, such as the "hamburger menu" at the top right of the My Projects page when using a mobile device, were not working correctly due to a breaking change in jQuery 3.5.0 in REDCap 9.9.0 Standard and 9.5.25 LTS. A makeshift patch has been applied to fix this in lieu of a proper fix from jQuery. (Ticket #83490)
  • Bug fix: When creating a new record via the Schedule module in a project, especially if the user creating the record belongs to a Data Access Group, the record would mistakenly not appear in record lists, record status dashboards, or reports for up to several days due to a record list caching issue, in which the cache was not getting updated appropriately when creating the record via the Scheduling module. (Ticket #83478)
  • Bug fix: When using an API script to send the "authkey" value for an Advanced Link type of Project Bookmark, the script would mistakenly fail and would have a fatal PHP error returned to it. (Ticket #83498)
  • Bug fix: On the Data Access Groups page in a project, the "Table not displaying properly" link in the DAG Switcher section might mistakenly be superimposed onto the instruction text in certain circumstances. (Ticket #83416)
  • Bug fix: If some Alerts & Notifications had been created in a longitudinal project, in which recurring alerts had been scheduled for some records, it might prevent a user from deleting an event on the Define My Events page due to foreign key restrictions in the back-end database. (Ticket #83438)
  • Bug fix: When moving a project to production and selecting the option to "delete all data", if the Survey Queue is enabled in the project and some existing records had had a survey queue link generated for them, then even though the records would correctly get deleted when moving to production, the survey queue links for those deleted records would mistakenly not get cleared out of the back-end database and thus could mistakenly get reused by new records. (Ticket #83341)
  • Bug fix: When using a Missing Data Code value of "0", "1", or "2" in a project, the Missing Data Code would mistakenly get used on the Form Status Complete field on any given instrument and thus cause issues with being able to set that field's value correctly. (Ticket #83423)
  • Bug fix: When branching logic or a calc field references a checkbox choice that has been hidden by the @HIDECHOICE action tag, it would mistakenly display a branching logic/calculation error alert on the survey page or data entry form. (Ticket #83376)
  • Various updates and fixes for the External Module Framework.
  • Bug fix: If an Automated Survey Invitation has conditional logic using the datediff() function with “today” or “now” as a parameter, in which “today” or “now” are not in lowercase form, the ASI Datediff cron job would mistakenly not run for these ASIs, thus causing invitations not to get scheduled at the appropriate time.
  • Bug fix: The cron job for scheduling Automated Survey Invitations that contain datediff+today/now in their conditional logic and are set to send "Immediately" would mistakenly send invitations immediately in real time by that cron, which can be a slow process and delay the scheduling of other invitations in some situations. Instead, the cron job should have been only scheduling the invitations and then letting the email-sending cron job actually send those scheduled invitations. (Ticket #83596)
  • Bug fix: When entering an X-event-name Smart Variable into conditional logic for an ASI, report filter, etc., when validating the logic, it might mistakenly return a confusing error saying that the syntax is not valid even when it is.
  • Bug fix: If one or more External Modules have been enabled in a project and have a link displayed for a module page in the "External Modules" section on the project's left-hand menu, then if Report Folders have been created in the project and a user toggles a Report Folder to open or close the folder, it would mistakenly cause the reports section on the left-hand menu to be moved below the "External Modules" section when it should instead remain above it.
  • Bug fix: For a project where Missing Data Codes are defined, when exporting data to a stats package (R, Stata, SAS, SPSS) when the export file contains checkbox fields and the report being exported is set to include the Missing Data Codes, the extra fields/columns for the Missing Data Codes for the checkbox would mistakenly not get added to the stats package syntax file, even though they get added to the CSV data file, thus causing the data not to load properly into the stats package because of the column number mismatch. (Ticket #83329)
  • Bug fix: If running Data Quality rule A or B in a project, in which a blank field has branching logic based off of another blank field, then in certain cases it might not return discrepancies correctly for all the fields with blank values. (Ticket #82655)
  • Bug fix: When downloading a PDF of an instrument, sometimes rich text might mistakenly not display well in the PDF, such as paragraphs and tables being too far spaced out.

Version 9.9.0 (released on 2020-04-30)

CHANGES IN THIS VERSION:

  • New feature: DAG Switcher
    • Users assigned to Data Access Groups (DAGs) can optionally be assigned to multiple *potential* DAGs, in which they may be given the privilege of switching in and out of specific DAGs on their own whenever they wish.
    • When assigned to multiple DAGs, the user will see a blue banner at the top of every project page, which will present them with the option to switch to another DAG. NOTE: Users may not move themselves into another DAG unless someone with rights to this page has explicitly granted them privileges to be in multiple DAGs.
    • To assign a user to multiple DAGs, navigate to the Data Access Groups page in a project where you will see the DAG Switcher near the bottom of the page. Then follow the directions provided there. The DAG Switcher feature is completely optional and can be used in any project that has Data Access Groups.
    • NOTE: The DAG Switcher feature does not override a user's current DAG assignment, as set on the Data Access Groups page or on the User Rights page.
    • This feature is the result of integrating the “DAG Switcher” external module that was built by Luke Stevens. We thank him for his contribution and for agreeing to let us integrate this useful module into REDCap. NOTE: Because the “DAG Switcher” external module is not compatible with this integrated functionality in v9.9.0, when upgrading REDCap to 9.9.0 or higher, if the “DAG Switcher” external module is already installed and enabled on your REDCap system, it will be automatically disabled at the system level during the upgrade process to prevent a conflict.
  • Minor security fix: Due to a Cross-Site Scripting (XSS) vulnerability, the JavaScript library jQuery 3.4.1 was updated to version 3.5.0. (Ticket #82867)
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered where a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags and/or JavaScript into the query string of the Data Access Groups page.
  • Improvement/change: Users are now able to utilize dots/periods/full stops in the codings of choices for checkbox fields. In previous versions of REDCap, this was not allowed for checkbox fields. (Ticket #83002)
  • Improvement/change: By popular demand, users may once again utilize dots/periods/full stops in Missing Data Codes. They are no longer forbidden. They were originally allowed for Missing Data Codes, but then removed in REDCap 8.5.0. Now that checkboxes can have dots/periods in their codings as of v9.9.0, it is no longer an issue for Missing Data Codes to use them too. (Ticket #83002)
  • Bug fix: When using the Dynamic Data Pull (DDP Custom) module and clicking the Save button in the adjudication dialog, it would correctly save the data but might mistakenly crash and display an error message in the dialog afterward. Note: This issue does not affect the CDP or Data Mart modules. (Ticket #82879)
  • Bug fix: The Missing Data Codes in the Additional Customizations popup on the Project Setup page could mistakenly be modified or removed while collecting data in production, which could cause issues with the saved data during analysis and in reports. It now displays a warning prompt to the user beforehand to inform them that re-labeling or removing Missing Data Codes after data collection has begun could cause data issues, but they will still be allowed to make modifications to the codes if they wish. (Ticket #82977)
  • Bug fix: When using Missing Data Codes in a project and selecting a missing data code for a radio button field on a data entry form, the missing data codes popup would mistakenly not close after the code had been clicked. (Ticket #82977)
  • Bug fix: When exporting data to Stata, it would mistakenly output the incorrect syntax in the .do file for text fields with datetime_seconds validation. (Ticket #83001)
  • Bug fix: When using a Super API Token for the API method "Export REDCap Version", it would mistakenly fail with a fatal PHP error. Bug emerged in REDCap 9.8.0. (Ticket #83068)
  • Bug fix: If upgrading to 9.5.24 LTS or higher or upgrading to 9.8.5 Standard or higher, the upgrade SQL script might throw a MySQL error during the upgrade process due to a foreign key constraint on a database table. (Ticket #83098)
  • Bug fix: Slider fields that are vertically aligned and have the "Display number value (0-100)?" option enabled will mistakenly display the number value field too narrowly and thus will not display the full value if its value is "100". (Ticket #83234)
  • Bug fix: If running REDCap on the Google App Engine platform and the email quota has been exceeded when sending outgoing emails, it would mistakenly crash with a fatal PHP error. It now continues to run and finish the script instead of halting the script with an error.

Version 9.8.5 (released on 2020-04-24)

CHANGES IN THIS VERSION:

  • Medium security fix: A Cross-Site Scripting (XSS) vulnerability was discovered where a malicious user or survey participant could potentially exploit it by adding some specific HTML tags and JavaScript into a Text field on a survey page or data entry form, after which such HTML would get reflected back on the page and get executed for another user.
  • Major bug fix: If a multi-arm longitudinal project is collecting data via public surveys across multiple arms at a time, in which each public survey has its own URL that corresponds to a distinct arm, then if survey participants are submitting a survey at near the same time but for a different arm, then it is possible that those two responses might mistakenly get saved with the same record name, even though the records exist in different arms. This is easily remedied by renaming the record in one of the arms afterward, but it may be hard to detect when it occurs and might be confusing for users when it does.
  • Major bug fix: If a user in a longitudinal project clicks the "Delete data for this form only" button at the bottom of a data entry form, in which multiple instruments on the current event contain data for the current record, if all the data on that event had been imported via data import *and* no values for form status fields were imported during the data import process *and* no user ever clicked a Save button on an instrument in that event after the import was performed, then all the data on all instruments in that event would mistakenly get deleted, when instead it should only delete the data from the current instrument.
  • Bug fix: When using the Twilio telephony services in a project, specifically for surveys, if someone replies back to an initial SMS message they received in order to begin a survey, it might mistakenly reply back to them saying "Auto-Reply: This SMS phone number is not monitored".
  • Bug fix: If the Twilio telephony services have been enabled at the system level but have been set to be hidden to normal users on the Project Setup page, then even though Twilio had been enabled for a given project, it would still hide the Twilio option to the user on the Project Setup page. It now displays it if it is already enabled for the project. Additionally, if an administrator was using the "View project as user" setting and impersonating a project user with Project Design/Setup privileges, they would still see the Twilio option on the Project Setup page even when Twilio is not enabled yet in the project, in which the Twilio option is set at the system level to be hidden from all normal users.
  • Change/improvement: If MariaDB 10.4.6 is being used, which is known to have issues regarding the "optimizer_switch" configuration value and thus sometimes not returning some query results correctly from the database, a warning message will be displayed in the Control Center recommending that MariaDB be upgraded to a newer version. (Ticket #72984)
  • Bug fix: When entering conditional logic for Automated Survey Invitations or adding branching logic via the Online Designer, if the logic contained certain Smart Variables (.e.g., [survey-date-completed]), the logic check status displayed immediately below the logic text box would mistakenly state "Error in syntax" even when the logic's syntax is correct.
  • Bug fix: In certain cases, if a large amount of external modules have been installed at the system level in REDCap, it could prevent the REDCap installation from reporting its weekly stats to the REDCap consortium.
  • Bug fix: If a large amount of HEAD requests hit a survey page, it might cause a disproportionate amount of load to be put on the web server and database server. (Ticket #82501)
  • Bug fix: If questions are being prepopulated on a survey using the @DEFAULT action tag, in which those fields are also being piped to other places on that same survey page, then the piping would mistakenly not occur when the survey page loads but only after one of the piped fields' values are modified on the page. Bug emerged in REDCap 9.8.0. (Ticket #82678)
  • Bug fix: When clicking the "+ Add new" button to add a new repeating event for a record on the Record Home Page in a longitudinal project, it might cause the entire instrument/event table to disappear from the page. Bug emerged in REDCap 9.8.0.
  • Bug fix: The advanced function isblankormissingcode() would mistakenly not work correctly when used in the equation of a calculated field. (Ticket #82653)
  • Bug fix: When a survey participant attempts to close their browser window by clicking the "Close survey" button on the page after completing the survey, if their browser prevents the tab/window from being closed, then the text displayed on the page afterward would mistakenly always be in the language of the system-level language setting rather than the project-level language. (Ticket #82631)
  • Bug fix: The generic "Alert" jQuery UI dialog would often have its title and/or buttons displayed in hard-coded English rather than using the language file's text for that particular project in which it is being displayed. (Ticket #81638)
  • Bug fix: Dots/periods were mistakenly allowed to be used in the raw coded values for Missing Data Codes. Dots/periods are not compatible to be used in checkbox codings and thus cannot be used as Missing Data Codes. (Ticket #82476)
  • Bug fix: When using a field from a repeating instrument in the logic of a Data Quality rule, in which the logic is trying to find instances of the field where its value is blank (e.g., [field] = ""), it might mistakenly not return the expected results in the discrepancy list. (Ticket #82201)
  • Bug fix: When using Data Quality rule I to find Missing Data Codes, the rule would mistakenly ignore checkbox fields and not include them in the results. (Ticket #82636)
  • Bug fix: When using the "View project as user" feature, the left-hand menu would mistakenly display all the reports in the project rather than displaying only the reports to which the user being impersonated has access to view. (Ticket #82697)
  • Bug fix: When setting up Randomization in a project that is not longitudinal and then later the project is converted to a longitudinal project, it would cause issues and might prevent the randomization process from working properly. (Ticket #82757)

Version 9.8.4 (released on 2020-04-17)

CHANGES IN THIS VERSION:

  • Major bug fix: If running certain versions of PHP (PHP 5.5 and 5.6 are suspected), then no pages will load and thus will throw a fatal PHP error when navigating into a REDCap project. (Ticket #82421)

Version 9.8.3 (released on 2020-04-16)

CHANGES IN THIS VERSION:

  • Improvement/change: Statistics regarding the counts of EHR data values imported into REDCap via Clinical Data Mart and Clinical Data Pull are now stored more efficiently in the database back-end.
    • This allows the overall CDM and CDP stats to display faster on the System Statistics page in the Control Center.
    • Also, a new FHIR Statistics page has been added to the Control Center for viewing tables and graphs displaying the counts for the different types of data (e.g., labs, medications, demography) being pulled from the EHR over time.
    • Note: The "Data values pulled from source system via CDP" count on the System Statistics page has been removed since it was never very accurate and was mostly misleading as to what it implied.
  • Minor security fix: A Blind SQL Injection vulnerability was found using the Data Search feature, in which a malicious user could potentially exploit it by manipulating the query string or POST parameters of an HTTP request.
  • Bug fix: When using the [previous-event-name] and [next-event-name] Smart Variables when prepended to field variables in piping, calculations, or logic, they might mistakenly point to the previous/next designated event of the current instrument rather than the previous/next designated event of the field to which the Smart Variable is prepended. Note: This does not affect [previous-event-name] and [next-event-name] when they are used as standalone without being prepended to a field. (Ticket #81976)
  • Bug fix: If Twilio SMS and Voice Call Services have been enabled at the system level on the Modules/Services Configuration page in the Control Center, but they have been set to "No, hide all information about Twilio services" for the setting "Display information about Twilio services to all users on Project Setup page in a project?", then users would mistakenly still see the SMS and Voice Call options in the alert setup dialog when creating a new alert on the Alerts & Notifications page.
  • Bug fix: When viewing Report B for a project that contains repeating instruments, the "total number of records queried" in the report might mistakenly be incorrect and not match the "number of results returned".
  • Bug fix: When downloading a PDF of an instrument or survey, it would mistakenly display the project title as the PDF header instead of the survey title or instrument title. Bug emerged in REDCap 9.8.0. (Ticket #82070)
  • Bug fix: When a project is using Twilio telephony services for Alerts & Notifications but not for surveys, if someone received an SMS message from an alert being triggered and responded back to it, it would then respond back to the person saying that they need to enter a valid survey code. This is confusing if the Twilio functionality is not being utilized for surveys. Instead, in this case it will return another message stating that the phone number is not being monitored, thus implying that replying to it will do nothing.
  • Bug fix: When a project is using Twilio telephony services for Alerts & Notifications but not for surveys, the Configure Twilio Settings dialog on the Project Setup page would mistakenly always force the user to select at least one survey invitation type checkbox, even when not using Twilio for surveys.
  • Bug fix: When exporting data to SAS, it might throw an error when loading the CSV data into SAS in some cases if a field variable name ends in a number. Additionally, if the project is utilizing Missing Data Codes, it might throw an error on a numerical field if some of the Missing Data Codes are non-numerical.
  • Bug fix: Custom Record Status Dashboards that are set to sort by a field's value would mistakenly sort in a case sensitive manner when instead it should be sorting in a case insensitive manner. (Ticket #82092)
  • Bug fix: When clicking the "All Status Types" link on the Record Status Dashboard, it would mistakenly hide the [+] buttons next to the status icons of repeating instruments. Instead they should remain displayed. (Ticket #82092)
  • Bug fix: If a survey participant partially completes a survey that has the "Save & Return Later" option enabled, the mechanism to send an email to the participant after clicking the "Save & Return Later" button would mistakenly throw a JavaScript error and not send the email. This bug was thought to have been fixed in REDCap 9.8.1 but mistakenly was not. (Ticket #82158)
  • Bug fix: If custom "Help & FAQ" text has been defined, then the navigation bar would mistakenly obscure the custom text on the "Help & FAQ" page. (Ticket #82192)
  • Bug fix: When a production project is in draft mode and a user deletes an entire instrument in draft mode, it would mistakenly delete any Descriptive field attachments that belong to fields on that instrument from the live version of the instrument in production, thus permanently losing the attachments. (Ticket #82322)
  • Bug fix: When a survey participant is viewing their Survey Queue, in which it contains a repeating survey, the "Take this survey again" button next to the repeating survey would mistakenly not be visible in the survey queue when viewing the page on a mobile device with a narrow screen. (Ticket #82335)

Version 9.8.2 (released on 2020-04-09)

CHANGES IN THIS VERSION:

  • Critical bug fix: When collecting data using a public survey where multiple participants are entering data near-simultaneously (i.e., submitting the survey within the same fraction of a second), some scenarios may arise in which those multiple responses could get mistakenly merged together as a single record rather than as separate new records. When this occurs, it appears in the logging that one participant has created the record while another participant modified the record afterward, in which it should instead log the events as two separate "create response" events. It is difficult to know when this kind of incident has occurred, and if discovered, might take some work (using the Logging page as a reference) to split the record back into separate proper records and resave them. While this issue occurs very seldom, the worst-case scenario can be if the survey allows the participant to download their responses as a PDF or have their responses emailed to them after completing the survey, in which it might possibly result in a privacy leak if private and/or identifying information (e.g., PHI) has been entered on the survey. (Ticket #81104, #81559)
  • Bug fix: Any REDCap plugins or module pages that utilize the HtmlPage::PrintHeaderExt() method would see the main DIV on the page mistakenly left-aligned when it should instead be centered on the page.
  • Bug fix: An error would occur when using Data Mart or Clinical Data Pull when importing EHR values from a patient’s Problem List.
  • Bug fix: A database query would fail invisibly but do little harm when importing data to a project via the REDCap Mobile App. (Ticket #81815)
  • Bug fix: If the e-Consent Framework is enabled on a survey that is a repeating instrument, in which the first name, last name, and/or date of birth fields (designated in the e-Consent Framework options) also exist on that same survey/instrument, then those name/DOB values would mistakenly not pipe correctly when REDCap adds them to the footer of the e-Consent PDF and also to the Identifier column in the PDF Archive table in the File Repository. Unfortunately, it is not possible to fix the missing piped values for survey responses that have already gone through the e-Consent process prior to this bug fix. (Ticket #81790)
  • Bug fix: The IE-specific Conditional Comments to detect Internet Explorer 9 (e.g., <!--[if IE 9]>) were mistakenly not formatted correctly and might cause some users using Internet Explorer to have issues loading pages.
  • Bug fix: When exporting a Project XML file for a project via the API, the resulting XML file would mistakenly be missing a lot of the project settings, such as surveys, Alerts & Notifications, Data Quality rules, reports, etc. (Ticket #81879)
  • Bug fix: When using the Clinical Data Pull (CDP) feature, the new line separator for storing repeated values (labs, vitals, medications...) was changed slightly. Those repeated values in CDP are stored in a single field using a string separator containing line breaks. The previous new line separator was mistakenly causing false positives in the CDP adjudication table when checking for new values to adjudicate.
  • Bug fix: A link in the "Piping" section of the "Help & FAQ" page would point to a non-existent page on the Vanderbilt REDCap server.
  • Bug fix: When editing an alert and changing Step 1A from the second option (form save + conditional logic) to the third option (only conditional logic), it would mistakenly not save the alert correctly and might cause the dialog not to reload properly when editing that same alert again later.

Version 9.8.1 (released on 2020-04-03)

CHANGES IN THIS VERSION:

  • New feature: New “Shibboleth & Table-based” authentication method
    • Similar to “LDAP & Table-based” authentication, this new method allows one to use the existing Shibboleth authentication in REDCap while also having Table-based authentication for external users.
    • This method can be enabled on the Security & Authentication page in the Control Center, along with some customizable settings near the bottom of that page. Once enabled, the login screen will display two tabs to allow users to choose between Shibboleth login and local (Table-based) login.
    • Documentation on how to set up: https://redcap.vanderbilt.edu/redcap_v9.8.1/Help/shib_table_help.php
    • Thanks to the following folks for their work on this effort: Philip Chase and Kyle Chesney, with testing and help from Taryn Stoffs and Andy Martin.
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on several pages, in which a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into places in REDCap where such HTML gets reflected back on a page that a user is viewing.
  • Bug fix: When calling the API method "Export Metadata (Data Dictionary)" and providing values for the "fields" parameter, it would mistakenly ignore that parameter unless the "forms" parameter was also provided with a value. Bug emerged in the previous release.
  • Change: The downloadable Python example code provided in the API Playground has been improved.
  • Bug fix: The plain text section of outgoing emails (which is not ever displayed by most email clients unless they do not support HTML email) would mistakenly have links converted into text and might have unnecessary tabs or line breaks. Most extra tabs and line breaks have been removed from the plain text section of emails, and all links in the email body will have their URL extracted and placed in parentheses directly following the link text so as not to lose that information. (Ticket #80878)
  • Bug fix: The redcap_connect.php file was mistakenly not returning an HTTP 500 status error in the incident that the database connection fails. Following the upgrade to this version, REDCap will prompt administrators to replace their redcap_connect.php file.
  • Bug fix: If a survey participant partially completes a survey that has the "Save & Return Later" option enabled, the mechanism to send an email to the participant after clicking the "Save & Return Later" button would mistakenly throw a JavaScript error and not send the email. (Ticket #81287)
  • Bug fix: Certain tables displayed throughout a project, such as in the Record Status Dashboard, reports, etc., might mistakenly not have their table header float correctly when scrolling down a long page, in which a duplicate table header might appear strangely at the bottom of the page instead. Bug emerged in REDCap 9.8.0.
  • Bug fix: When using a Super API Token to create a new project via the API, it would mistakenly thrown a fatal PHP error. Bug emerged in REDCap 9.8.0.
  • Bug fix: If still using the old bit.ly (j.mp) URL shortener service for public surveys (instead of the newer https://redcap.link URL shortener), then when fetching a short survey link on the Public Survey Link page, it would appear to spin forever and never return the shortened URL. This is due to BITLY changing how their API web service works.
  • Bug fix: The new database table redcap_projects_user_hidden (added in v9.8.0) mistakenly did not have the table collation explicitly set, which could cause it to be set to an undesired value.
  • Bug fix: Some reports and data quality rules in longitudinal projects might run 2x-10x slower than expected in certain situations, such as if a field in the report filter logic or DQ logic does not have a prepended event name or if the report filter has "all events" selected for a filter field drop-down. The slowness is especially pronounced in projects having large numbers of events defined and/or a large amount of records in the project. (Ticket #79830)
  • Bug fix: When viewing the participant list of a longitudinal project containing multiple arms, the paging drop-down list for the participant list would mistakenly provide an incorrect number of participants for the given survey/event and might not be able to display subsequent pages in the participant list after changing the paging drop-down list to select another page to view. (Ticket #81118)
  • Bug fix: When viewing a drop-down field with auto-complete enabled, depending on the labels of the drop-down choices, some choices might mistakenly wrap their text to the second line inside the drop-down. (Ticket #81340)
  • Bug fix: If an administrator is using the "View as [user]" feature in a project in which the user selected has had their access expired in that project, it would mistakenly display the error message to the admin telling them that their user rights in the project have expired, thus preventing them from doing anything in the project, including preventing the admin from even disabling the "View as [user]" feature. (Ticket #81536)
  • Bug fix: If a project does not have record auto-numbering enabled, and the record ID field has min/max validation, then the min/max validation would mistakenly not be applied when a user is entering a new record name via the Record Status Dashboard or Add/Edit Record page. (Ticket #81117)

Version 9.8.0 (released on 2020-03-26)

CHANGES IN THIS VERSION:

  • New feature: Surveys to capture custom information during project status transition (optional)

    • On the User Settings page in the Control Center, four optional fields have been added to allow you to utilize public surveys to capture custom information from users when projects transition to a new status (i.e., project creation, move to Production status, move to Analysis/Cleanup status, mark as Completed). This allows administrators to create custom surveys to capture all the info they desire from users during these project transitions. The survey will be presented inside an iframe on the page, in which the user must complete the survey before completing the process on the page. You may use any or none of these fields.
    • NOTE: Administrators will not be forced to complete any of the public surveys set below but will be exempt from this process.
  • New feature: “View Project As...” feature

    • When inside a project, administrators will see a “View project as user” drop-down on the left-hand project menu that will allow them to select a user in the project, after which they will have that user’s user privileges applied to them while in the project for the duration of their REDCap session.
    • The “View project as…”feature is a project-level feature, so administrators can only impersonate users inside a project (as opposed to non-project contexts in REDCap). Additionally, admins may impersonate users in multiple projects during the same session.
    • When impersonating a user, a green banner will appear across the top of the project page to remind the admin that they are currently viewing the project as that user.
    • On data entry forms, the @USERNAME action tag and all [user-X] smart variables will operate using the impersonated user’s values.
    • When performing actions in the project while viewing the project as another user, all logged events in the project will still reflect the true user (the impersonator) rather than the user being impersonated.
    • When an administrator enables or disables the “View project as…” feature, it logs this particular action on the project Logging page. However, only administrators will be able to see these specific logged events when viewing the Logging page since they are only meant for admin purposes.
    • If the user being impersonated has been assigned to a Data Access Group, then when viewing the project as that user, the impersonator will be simulated as being in that DAG also and thus will only be able to view and create records in that user’s DAG.
  • New feature: New "Mapping Helper" utility for Clinical Data Mart (CDM) and Clinical Data Pull (CDP)

    • During the field mapping process in CDP and Data Mart projects, users may optionally use the Mapping Help page, which will provide methods for easily extracting all data for a single patient (using a medical record number) to help find all the LOINC codes associated with the data in that patient’s record.
    • This tool will be especially useful when mapping Laboratory values, as it will provide the LOINC codes for all data values for the patient, and thus allow the user to take those LOINC codes and use them in the field mapping for CDP and Data Mart, which will make the mapping process significantly faster and more efficient.
  • Project life cycle changes

    • Change: The "Archived" project status has been removed and converted into a built-in Project Folder named "My Hidden Projects", as now seen at the bottom of each user’s My Projects page. If users wish to hide any projects from their My Projects list, they may click the Organize button on that page and place the projects into that new Project Folder. NOTE: Any already-archived projects will be automatically placed there and will have their project status set as "Analysis/Cleanup" to match the projects’ general behavior prior to the upgrade.
    • Change: The "Inactive" project status has been renamed to "Analysis/Cleanup" status to help reinforce that cleaning and analyzing the data is the next logical step after data collection in Production status.
    • New feature: Projects that are in "Analysis/Cleanup" status can now optionally have their project data set as "Locked/Read-only" or "Editable" (see the top of the Project Setup or Project Home page). This will give users more control to prevent data collection from happening while in this project status.
    • Change: New records can no longer be created while in "Analysis/Cleanup" status. If users wish to create records, the project must be moved back to Production status.
    • New feature: Mark a project as "Completed": If users are finished with a project and wish to make it completely inaccessible, they may mark the project as Completed. Doing so will take it offline and remove it from everyone's project list, after which it can only be seen again by clicking the Show Completed Projects link at the bottom of the My Projects page. Once marked as Completed, no one in the project (except for REDCap administrators) can access the project, and only administrators may undo the Completion and return it back to an accessible state for all project users. Marking a project as Completed is typically only done when users are sure that no one needs to access the project anymore, and they want to ensure that the project and its data remain intact for a certain amount of time.
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on the Scheduling page, in which a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into places in REDCap where such HTML gets reflected back on a page that a user is viewing. (Ticket #80773)
  • Improvement/change: When using the Clinical Data Mart feature while the system setting “Allow normal users to create new projects?” is set to “No”, the admin approving the “project creation” request is no longer required to have Data Mart privileges in their REDCap account nor access to the EHR system in order to approve the user’s request to create the Data Mart project.
  • Bug fix/change: 350 Laboratory fields (including 30 related to COVID-19) and their associated LOINC codes were not originally included on the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Improvement/change: The EHR demography field “Is deceased?” is now included on the field mapping page for Clinical Data Pull and Clinical Data Mart and is now added automatically when creating a new Data Mart project.
  • Change: Underlying technical changes

    • REDCap now incorporates the use of Webpack and NPM to better keep front-end packages up to date more easily and also to help bundle many of them automatically.
    • Each REDCap page now loads the three JS files /Resources/webpack/js/bundle.js, /Resources/js/Libraries/bundle.js, and /Resources/js/base.js. The libraries jQuery, Bootstrap, etc. are no longer included in base.js but are now inside either file named bundle.js.
    • If you are a developer and have an external module that references a JS or CSS file from REDCap core (as opposed to an asset bundled with your module), you should check your module code because you may need to modify the path for those files for REDCap 9.8.0+.
    • The global function files ProjectGeneral/form_renderer_functions.php and Surveys/survey_functions.php have had their content removed and moved into classes as static methods. These files will still exist until the end of May 2020 in Standard Release, but in releases afterward they will be completely removed. If a plugin, hook, or external module includes/requires these files in a version of Standard Release prior to the end of May 2020, a note at the top of the project page will be displayed to inform the user/admin/developer that it is no longer needed to include/require these files and that those references should be removed from the custom code being called on that page.
    • The endpoint “/PDF/index.php” has been removed and has now been replaced with “/index.php?route=PdfController/index”. The developer method REDCap::getPDF() still works exactly the same way as in previous versions.
  • Bug fix: If a user has "No access" data entry form level privileges for the first instrument in a project, the Data Search feature on the "Add/Edit Records" page would mistakenly not include the record ID field in the search. (Ticket #80282)
  • Bug fix: If a checkbox field exists on a repeating event or repeating instrument and is utilized in a calculation or branching logic, in which the field is referenced on another repeating instance than the current repeating instance, then while the checkbox's checked value will save correctly, if a field choice is unchecked later, it might mistakenly not clear/delete the checked value successfully. (Ticket #78956)
  • Bug fix: If using "LDAP" or "LDAP & Table-based" authentication, any user containing an apostrophe in their LDAP username would mistakenly not be able to be added to a user role in a project, in which it would fail silently when attempting to add a user to a role. (Ticket #79647)
  • Bug fix: If a user attempts to add a field comment to a field on a data entry form prior to creating the record (via Save button), when the user clicks the "Save and then open Field Comment Log" button to reload the page, the cursor's focus might mistakenly be on a field on the form underneath the dialog rather than inside the dialog, possibly causing the user to get stuck and not be able to enter a field comment successfully. (Ticket #80511)
  • Bug fix: When clicking the Compose Survey Invitations the first time on the Participant List page in a project, it might mistakenly not load the list of participants to email inside the popup, but it would load it successfully if the popup was closed and then reopened. (Ticket #80584)
  • Bug fix: A database query would fail invisibly but do no harm whenever a record is renamed in a project. (Ticket #80895)
  • Bug fix: A database query would fail invisibly but do no harm whenever previewing a survey theme in the Online Designer. (Ticket #80940)
  • Bug fix: A database query would fail invisibly but do no harm whenever viewing a survey response on a data entry form. (Ticket #80901)
  • Bug fix: In a multi-arm longitudinal project that has record auto-numbering disabled, if the record names contain non-Latin/multi-byte characters, then the record names would mistakenly get scrambled whenever rebuilding the record list. (Ticket #74092)
  • Bug fix: A database query would fail invisibly in certain scenarios surrounding the piping of repeating instances, which might cause the piping not to work correctly. (Ticket #80901)
  • Change: The Python code generated by the API Playground has been changed/improved to better handle JSON-formatted outputs.
  • Bug fix: When performing a data import (via API or Data Import Tool) for a multi-arm project, in which a record is being imported into multiple arms during the import, the record might not initially appear as if it has been created in the subsequent arms when viewing the Record Status Dashboard (even though it had been created in the arm correctly). Note: This issue would automatically resolve itself within five days of the import. (Ticket #55039)
  • Bug fix: When using the randomization module in a project, the act of randomizing a record does not trigger any Alert & Notifications if an alert was set to be triggered based on the randomization field or strata fields having their values changed. (Ticket #80985)
  • Bug fix: When using the randomization module in a project, the act of randomizing a record does not trigger the REDCap hook "redcap_save_record".
  • Bug fix: If survey notifications have been enabled on a survey that is a repeating instrument or is on a repeating event, then the link back to the survey response on the data entry form would mistakenly always point back to the first instance of that instrument rather than to the correct instance. (Ticket #81009)
  • Bug fix: A database query would fail invisibly in certain API methods being called. (Ticket #81041)
  • Bug fix: A database query would fail invisibly in very specific occasions when using the Online Designer to add/edit fields. (Ticket #81020)
  • 9.8.0: Bug fix: A database query would fail invisibly to the redcap_log_view_requests table when a user is logging in to REDCap. (Ticket #81056)

Version 9.7.8 - (released 3/12/2020)

BUG FIXES AND OTHER CHANGES:

  • Major bug fix: If a participant is taking a public survey (via the public survey link) that allows them to "Save & Return Later", in which the survey requires Return Codes to be used in order to return to the survey, then if the participant returns to the survey using the private/unique survey link (rather than the public survey link), it would mistakenly allow the participant to view their responses without having entered the return code first. However, if they clicked the "Save & Return Later" button again on the survey after returning, then the next time they return to the survey, it would correctly require that they enter a return code. This does not occur for follow-up surveys but only for public surveys with "Save & Return Later" enabled using return codes.

  • Bug fix: If the feature "File Upload field enhancement: Password verification & automatic external file storage" is enabled for the system and for a given project, a file uploaded into a File Upload field in the project would be stored on the external server mistakenly using the user's filename of the file rather than the filename of the file as it is stored in the backend of REDCap. This could potentially cause naming conflicts and prevent the file from being stored successfully on the external server. It will now store the file on the external file server using REDCap's backend "stored_name" filename for the file.

  • Bug fix: If entering a value on a data entry form for a field that is designated as a Secondary Unique Field, in which a value is entered that duplicates a value in another record in the project, if the user clicks the Enter key on their keyboard after typing the value (instead of clicking outside the field or clicking the Tab button), it would correctly display the error dialog popup about the duplicate value, but the dialog would mistakenly not be able to be closed, thus forcing the user to reload the page and potentially lose any data entered thus far on the page. (Ticket #79910)

  • Bug fix: When importing data via the API or Data Import Tool, an alert might not get sent/scheduled for any records that are being created during the data import if the data being imported is expected to trigger an alert. This does not affect existing records but only records that did not exist prior to the data import.

  • Various fixes and updates for the External Module Framework.

  • Bug fix: The Configuration Check page in the Control Center was mistakenly noting that the PHP cURL extension was "recommended" when it should instead state that it is "required". This is because so many major features in REDCap rely on cURL specifically. The warning for cURL on the Config Check page has now been modified accordingly to accurately reflect this. (Ticket #80121)

  • Bug fix: The REDCap hook named "redcap_survey_complete" would get mistakenly called when a survey participant would attempt to return to a completed survey that has the "Save & Return Later" option disabled - i.e., when it displays the message "Thank you for your interest, but you have already completed this survey". (Ticket #80109)

  • Bug fix: When exporting data in CDISC ODM XML format, in certain situations, the resulting XML might mistakenly omit the ending ODM tag - e.g., "</ODM>". (Ticket #80084)

  • Bug fix: When a calculated field exists on a repeating event and its calculation references fields on the same event, in which one or more of those fields exist on instruments that are not designated for that event, then while the calculation would work correctly when viewing the calc field on a survey or data entry form, it would mistakenly return a ""/blank value for the calc field when performing a data import or running Data Quality rule H. (Ticket #79874)

  • Bug fix: The text for the confirmation email set at the bottom of the Survey Settings page for an instrument in the Online Designer would mistakenly have extra line breaks added between all the text if the email text was saved and then the page was re-opened later and saved again, thus adding more extra space each time. (Ticket #79836)

  • Bug fix: If a custom Data Quality rule has logic that contains a field that is utilized in both a repeating and non-repeating context, especially for a longitudinal project, then it might not return all the correct discrepancies. (Ticket #80102)

  • Bug fix: When viewing the "Stats & Charts" page for a user-defined report (i.e., not report A or B) that has filter logic defined, the "missing" count displayed in the descriptive stats table for a given field might mistakenly be a negative number. (Ticket #79994)

  • Bug fix: If using "LDAP" or "LDAP & Table-based" authentication, any user containing an apostrophe in their LDAP username would mistakenly not be able to be added as a user on a project, in which it would display a popup error message when attempting such. (Ticket #79647)

Version 9.7.7 - (released 3/3/2020)

BUG FIXES AND OTHER CHANGES:

  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on the Send-It upload page and the Survey Link Lookup page in the Control Center, in which a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into places in REDCap where such HTML gets reflected back on a page that a user is viewing.
  • Bug fix: Twenty "Laboratory" fields, two "Vital Signs" fields, and their associated LOINC codes were mistakenly missing from the field-mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: If a URL is included in a message posted on REDCap Messenger (including those sent via General Notifications from an administrator), the URL might not be displayed properly as a clickable link if the URL is immediately followed by a dot/period or a line break/carriage return.
  • Bug fix: If a longitudinal project with repeating instruments or repeating events contains a report that has simple filters (i.e., fields selected via drop-down options) where a field is selected along with the "All events" option, OR if the report has advanced filter logic that references fields that exist on both repeating and non-repeating instruments/events, in which the fields on repeating instruments/events do not have anything appended to them, such as a numeral instance designation or instance Smart Variable and those fields also do not have a unique event name explicitly prepended to them, then the report might return incorrect results *if a field in the logic exists on both repeating and non-repeating events in the project*. This appears only to occur if the report setting "Show data for all events or repeating instruments for each record returned" is left unchecked. (Ticket #79058)
  • Bug fix: When clicking the "Use advanced logic" link when building a report that has simple filters (i.e., fields selected via drop-down options), in which a filter field is selected with the "All events" option, when creating the advanced filter logic, it would mistakenly fail to prepend the field with "[event-name]" and thus would throw an error that says the logic is invalid when attempting to save the report.
  • Bug fix: When sending emails, REDCap was mistakenly attempting to employ DKIM in all outgoing emails, which might cause emails to no longer be received if hosting REDCap on certain platforms, such as AWS. To ensure emails keep sending as expected, the usage of DKIM is no longer attempted when sending emails.
  • Bug fix: When sending survey invitations via the Participant List, if some invitations are sent first and then the user clicks the Compose Survey Invitations button to send another batch without leaving the page, the survey invitation message text would appear to still be the same for the new batch as with the previous batch but instead it would actually send the default invitation text that gets loaded in the text editor when opened the first time. This could cause users to mistakenly send the wrong text in the invitation when sending multiple batches on that page at a time. (Ticket #79507)
  • Bug fix: When using Missing Data Codes in a project, and a missing data code is saved for a checkbox field on a record, then that field would mistakenly be returned as a discrepancy in Data Quality rule G. (Ticket #79553)
  • Bug fix: If a slider field has the "Display number value?" option checked for it, then when entering data on a survey or form, if the slider has focus put on it (either by tabbing through the survey/form, or if an instrument is opened in which the slider is the first field on the instrument), then a value of "50" would get initially displayed in the slider's associated text box even though the slider value is actually blank/null and will remain so until the slider is clicked or if the user uses their keyboard's left/right arrow keys. So seeing the value of "50" when the slider gets focus might give the impression that its value has been set when in fact it has not been set yet. This has been changed so that the text box value only changes when the user, thus eliminating this ambiguity regarding the slider’s current value, has changed the slider value itself. (Ticket #79430)
  • Bug fix: While REDCap prevents users from viewing all pages of a given report at the same time if it estimates that the report contains more than 500k data points, it would mistakenly calculate the number of total data points incorrectly while determining this. (Ticket #79657)

Version 9.7.6 - (released 2/28/2020)

BUG FIXES AND OTHER CHANGES:

  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on a page in the External Module Framework, in which a malicious user (who must be logged in) could potentially exploit it by manipulating the query string parameters in the URL.
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on several pages, in which a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into places in REDCap where such HTML is reflected back on a page that a user is viewing.
  • Minor security fix: All web links on REDCap pages that link to an external website and contain the target="_blank" attribute, which opens the website in a new browser tab, will automatically have the HTML tag attribute 'rel="noopener noreferrer"' added to the link's underlying HTML. This will occur automatically and invisibly for links either added by user input on forms/surveys or those that are hard-coded as part of REDCap itself. This will improve overall security to prevent the passing of referrer information from REDCap onto the third-party website.
  • Bug fix: The Configuration Check page in the Control Center was mistakenly still checking the communication with the old bit.ly and is.gd URL shortener services, even though the newer redcap.link URL shortener has been enabled. It now instead checks the communication with the redcap.link service if the redcap.link URL shortener is enabled.
  • Bug fix: If a text field that has min/max validation is changed to another field type, such as a drop-down, in the Online Designer, it would mistakenly not nullify the min/max validation values for the field when saving it as a new field type, which would cause an error to be displayed when downloading the data dictionary and then re-uploading it. (Ticket #29422)
  • Bug fix: When using Live Filters in a report, if any of the Live Filter fields have choices whose label contains HTML tags, it would mistakenly display the HTML tags inside the Live Filter drop-downs at the top of the report.
  • Change: When using the Clinical Data Pull (CDP) feature and viewing a project page inside an EHR user interface, it might display the yellow warning at the top of the page that Internet Explorer 9 and 10 are not fully compatible with REDCap. From now on, it will only display that warning for normal project viewing and not in the EHR-embedded view.
  • Various fixes and updates for the External Modules Framework.
  • Bug fix: The PHP function for validating URLs for certain outgoing HTTP calls from REDCap might mistakenly allow certain invalid URLs to pass the validation test.
  • Bug fix: If a longitudinal project with repeating instruments or repeating events contains reports with report filter logic that references fields on both repeating and non-repeating instruments/events, in which the fields on repeating instruments/events do not have anything appended to them, such as a numeral instance designation or instance Smart Variable, then the report might return incorrect results *if a field in the logic exists on both repeating and non-repeating events in the project*. This appears only to occur if the report setting "Show data for all events or repeating instruments for each record returned" is left unchecked. (Ticket #79058)
  • Bug fix: If using the Missing Data Codes feature in a project that also has Randomization enabled, it would mistakenly allow the missing data codes icon to appear next the randomization field on the data entry form. The missing data codes icon should never appear for the randomization field because it is not applicable there. (Ticket #79057)
  • Bug fix: If the "Import Records" API method was called or if a user was saving a survey or data entry form that triggered the calculation of calc fields on other instruments/events, then the internal record list cache in the project would mistakenly get reset in the back-end database, thus forcing the cache to be rebuilt the next time a report, record dashboard, or record list was viewed in the project. This could cause unnecessary slowness for the project and possibly affect performance of the entire REDCap server in some cases.
  • Bug fix: If a new data collection instrument is added to a production project that is currently in draft mode, in which the user has submitted some field/form changes to an administrator and is awaiting approval, it is mistakenly possible for the user to enable that instrument as a survey. Instead it should display a notice on the Survey Settings page that the instrument cannot be enabled as a survey until the project is no longer in draft mode (i.e., after the submitted changes have been approved). (Ticket #79192)
  • Bug fix: When using iOS and entering data on a survey or data entry form, "number"-validated text fields would not enforce the client-side validation and would mistakenly allow non-numerical values to be entered. This has been fixed so that it will now display the number pad keyboard to allow only numbers and a dot decimal as an option. Note: If the field has "number (comma as decimal)" validation, then it will instead use the full QWERTY keyboard (this is a limitation of iOS) instead of the number pad keyboard. (Ticket #79317)
  • Bug fix: In a longitudinal project, if an alert that has a field that is piped into the alert's message or subject, in which the field variable is not prepended with the unique event name, then when that alert gets triggered by saving a form/survey, it would mistakenly not pipe the field's value correctly unless the field's event's unique event name had been explicitly referenced by another field in the message text, subject text, or conditional logic.
  • Change: On the User Settings page in the Control Center, the text for the setting "Allow normal users to add or modify events and arms on the Define My Events page for longitudinal projects while in production status?" has been modified for better clarity regarding how this setting behaves.

Version 9.7.5 - (released 2/21/2020)

BUG FIXES AND OTHER CHANGES:

  • Major bug fix: Surveys and data entry forms were mistakenly displaying the "errors exist" popup relating to branching logic errors in many situations.

Version 9.7.4 - (released 2/21/2020)

BUG FIXES AND OTHER CHANGES:

  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on several pages, in which a malicious user (who must be logged in) could potentially exploit it by adding some specific HTML tags into places in REDCap where such HTML gets reflected back on a page that a user is viewing. This mostly involves the names/labels of data collection instruments.
  • Major bug fix: A user with "No Access" Data Export privileges in a project would [correctly] neither be able to perform data exports nor access the Data Export Files tab in the File Repository, but if that user had been given the direct URL to download a specific archived data export file from the File Repository (i.e., exported by another user in the project at a previous time) or if they were simply guessing URLs through trial and error by modifying the "id" URL parameter for the "FileRepository/file_download.php" end-point, they would be able to successfully download that data file even though they have no data export privileges. Note: The user must have access to the project in order to do this. (Ticket #72652)
  • Change: When the Easy Upgrade feature is displaying a list of versions for upgrading to, the word "Recommended" has been removed from the most recent version in the list because the word would inadvertently wrap to the next line and make it seem as if the second version in the list is the recommended version. (Ticket #77911)
  • Bug fix: If a user is piping a field that uses the BioPortal Ontology Service, and they're wanting to pipe the field's coded value and not the choice value, then adding ":value" to the variable name (e.g., [icd10:value]) would mistakenly return the choice label and not the coded value.
  • Bug fix: On the CDIS Standalone Launch page, the "Go to projects" button would not work when clicked due to a JavaScript error. (Ticket #78558)
  • Various fixes and updates to the External Module Framework.
  • Change: Added extra check on the Configuration Check page when attempting to communicate with the WebDAV server (if using it for file storage).
  • Bug fix: If a user is suspended, the page displaying the notice that they are suspended when the user attempts to log in would mistakenly throw an invisible JavaScript error in the browser console. (Ticket #78850)
  • Bug fix: In completed survey responses on a repeating survey, if there is somehow no Form Status value (in the back-end database) for the survey instrument or if its value was somehow set to "Incomplete" mistakenly (e.g., through direct database interaction via an external module), then if the current repeating instance of the survey that is being viewed is not the first instance, it would mistakenly set the value of the first instance of the survey to "Completed" whenever someone views the instrument/survey page.
  • Bug fix: When adding/editing a calc field in the Online Designer, the "Valid"/checkmark indicator and "Clear calculation" link were mistakenly obscured by the calculation's equation textarea right above them. (Ticket #78545)
  • Bug fix: The word "Page" used to display the page number in PDFs of exported instruments was mistakenly hardcoded instead of coming from the language translation file. (Ticket #78771)
  • Bug fix: If the @DEFAULT action tag is used on a field, then users would always receive the "save changes?" prompt when attempting to leave the form without clicking a Save button, even when no field values had been changed. Instead it should only display this prompt when the form has no data (i.e., has gray form status icon) and leaving the form. It should not display the prompt every time afterward. (Ticket #78807)
  • Bug fix: When attempting to add a user via the User Rights page to a project that currently has no users, it would mistakenly return no user suggestions when typing the username in the text field. (Ticket #78929)
  • Bug fix: When performing a data export of a report to a stats package, in which the first instrument in the project is a survey and the report is set to output all survey-related fields (e.g., completion timestamp), then if the record ID field is the first field in the report, the resulting syntax file for the stats package would mistakenly be missing the survey completion timestamp for the first instrument, thus causing the data not to load properly into the stats package.
  • Bug fix: When using the dateRangeBegin parameter for the "Export Records" API method, if the dateRangeEnd was left blank or not included as a parameter in the API request, then the API would not function correctly and would mistakenly return no data in the API response.
  • Bug fix: A third-party PHP library was using code that is deprecated in PHP 7.4. (Ticket #79001)
  • Bug fix: If a field on a data entry form or survey has an @HIDDEN action tag and also has branching logic, then in certain cases the field might flicker (i.e., appear then disappear momentarily) when the page initially loads. (Ticket #78697)

Version 9.7.3 - (released 2/13/2020)

BUG FIXES AND OTHER CHANGES:

  • Change/improvement: Inclusion of the SweetAlert2 JavaScript framework for displaying custom dialogs.
    • Note to External Module creators: The SweetAlert dialogs may be used by external modules as of v9.7.3 and higher.
    • It is worth noting that Internet Explorer 9 and 10 are not supported by SweetAlert2. So if users are using IE 9 or 10, the SweetAlert dialogs will not be displayed for them.
  • Change: To wean users off of using Internet Explorer 9 and 10, any users using IE 9 or 10 will see a thin, yellow banner at the top of all project pages, which will inform them that their browser is not fully compatible with REDCap and thus will encourage them to upgrade to IE11 or use another browser. Technically, IE 9 and 10 will be supported till July 2020 in Standard Release, but this warning is mostly preemptive in preparation for that.
  • Bug fix: When copy-and-pasting text from Microsoft Word (or similar products) into the rich text editor used throughout REDCap, the underlying HTML that is added to the rich text editor after the paste would be extremely bloated and superfluous. Additionally, for field labels on instruments, it could cause the text to become so long (although appearing to be normal length) that it might cause some text to be truncated when downloading->uploading the Data Dictionary. To prevent this issue, it now automatically removes a lot of the extra, hidden styling and unnecessary HTML when copy-and-pasting text into the rich text editor. (Ticket #77555)
  • Bug fix: The pseudo user "site_admin" (which is only used as a default account when authentication is disabled) could mistakenly be added to a conversation in REDCap Messenger by a user. As a result, it might mistakenly send the administrators a notification email that the "site_admin" has unread messages in Messenger. Users will now no longer be able to find "site_admin" when searching for users to add to a Messenger conversation. (Ticket #78117)
  • Bug fix: In the Edit Field dialog in the Online Designer, the "Enable auto-complete" option for drop-down fields was mistakenly covered up by the Choices textbox directly above it, thus making it impossible to enable or disable that option for a drop-down field.
  • Bug fix: The Clinical Data Pull (CDP) code was mistakenly referencing a PHP method that no longer exists in the Standard Release branch. This would produce any undesirable response in certain situations when using CDP. (Ticket #78123)
  • Bug fix: When running Data Quality rule A, B, or F for projects that are longitudinal and/or have repeating instruments/event, it might mistakenly run out of memory and return an error message to the user, even when the project doesn't appear to have a large amount of records.
  • Various fixes and updates for the External Module Framework.
  • Bug fix: If the Secondary Unique Field (SUF) is used in a longitudinal project in which the value of the SUF is currently blank and then a data entry form or survey containing the field is saved where the field's value still remains blank, then if the SUF exists in events that currently do not have data (i.e., it has gray status icons for all forms in the event), then it would mistakenly save a blank value for the SUF in those empty events, thus causing their form status icon to be red instead of gray, which could be confusing to users.
  • Bug fix: If a custom Data Quality rule has logic that contains a field from a repeating instrument in a non-longitudinal project, then it might mistakenly not find valid discrepancies that exist for that DQ rule in reference to data from repeating instruments.
  • Change: For survey participants using Internet Explorer 6, 7, or 8, rather than failing silently, survey pages now display an error message letting them know that the page is not compatible with IE 6-8 and recommends they upgrade or use another browser.
  • Bug fix: On the Project Setup page of a DDP-enabled or CDP-enabled project, the step to "Set up Dynamic Data Pull (DDP)"/"Set up Clinical Data Pull (CDP)" would have its progress icon mistakenly set to "Complete!" (big checkmark icon) when the project is in production status, regardless of whether the field mapping setup had actually been completed, which was confusing. It now can only be marked as "Complete!" if the user clicks the "I'm done!" button, which is how it has always behaved while in development status.
  • Bug fix: When uploading a file or signature for a File Upload field on a repeating instrument or repeating event, in which record auto-numbering is enabled in the project, then the project's Logging page would mistakenly add an unnecessary "Created Record" event immediately before the "Uploaded Document" event in the logging history.
  • Bug fix: If REDCap has two-factor authentication enabled and it is set to enforce 2FA only for certain IP addresses, it would mistakenly only support IPv4 changes and would not support IPv6. It now supports IPv6 ranges/subnet masks. (Ticket #77195)
  • Bug fix: If users were using Internet Explorer 11 with Compatibility View enabled, it would get logged mistakenly as Internet Explorer 7 in the redcap_log_view database table.
  • Bug fix: If a project has the Data Resolution Workflow enabled, and a user clicks the "Export" button on the Resolve Issues page in the project, the resulting CSV file would mistakenly have the text comments truncated in the First Update and Last Update columns. Those should be truncated on the webpage view but not in the CSV export file.
  • Change: When clicking the "View past invitations" or "View past notifications" button on the Survey Invitation Log and Alert Notification Log, respectively, it now defaults to displaying the page with the most recently sent invitations/notifications, whereas previous versions would default to the first page (i.e., the oldest sent). This change should provide a more intuitive experience for users.
  • Bug fix: If logic or calculations contain a checkbox field whose variable name ends with "min", "max", or "log", then it might cause the logic/calculation to be considered invalid or syntactically incorrect while being parsed, thus resulting in an error message in many places. (Ticket #78083)
  • Bug fix: In the API Playground, the "csvDelimiter" parameter was mistakenly missing as a drop-down in the user interface for the API methods "Export Records" and "Export Reports". (Ticket #77754)
  • Bug fix: When viewing the "Stats & Charts" page for a user-defined report (i.e., not report A or B) that has filter logic defined, the "missing" count displayed in the descriptive stats table for a given field might mistakenly be incorrect if the report is displaying fields from a repeating instrument or repeating event. (Ticket #77050)

Version 9.7.2 - (released 2/6/2020)

BUG FIXES AND OTHER CHANGES:

  • Bug fix: The logic parsing algorithms in REDCap might mistakenly fail and not return accurate results when the logic contains an empty/blank value (represented as two quotes/apostrophes) on either side of an "=" operator or an "<>" operator, such as ' ""<>"" ' or ' ""=1 '. While such logic is less likely to be entered in this form by a user, some logic could end up in this form prior to parsing after certain Smart Variables in the logic are replaced by literal values during the logic-processing phase. This means that logic used in certain Data Quality rules or report filter logic, among other places, might not behave accurately. Bug emerged in REDCap 9.5.11 (LTS) and 9.7.0 (Standard).
  • Change: When viewing reports, it now displays "report execution time" in seconds near the top of the report. This denotes the total server execution time that it took to create the report. Note: This does not account for the rendering time of the report (i.e., via JavaScript), which can sometimes take several seconds or more (if the report is large) for a user's web browser to actually render the report's HTML on the page.
  • Bug fix: Users could mistakenly access the Online Designer and Data Dictionary pages in an Inactive project and thus could make field changes, which should only be allowed while in Development or Production status. (Ticket #66286)
  • Bug fix: If an administrator is processing a "Delete Project" user request for a production project, then it might mistakenly not display the "Delete Project" prompt when loading the project's Other Functionality page while processing the request.
  • Bug fix: If a field on a form or survey has the @DEFAULT action tag, and that same field has its value being piped into somewhere else on the same page, then when the form/survey is initially loaded with no data saved for it yet (i.e., has gray status icon), the piping of the default value would mistakenly not occur when the page is initially loaded but only after the field's value is modified while on that page.
  • Bug fix: If using Table-based authentication, and a user was somehow added to a project even though the user has not yet had a REDCap user account created for them, then when attempting to delete the user from the project or modify their user rights, it would always return an erroneous error message, which prevents the user from being modified or deleted from the project.

Version 9.7.1 - (released 2/4/2020)

BUG FIXES AND OTHER CHANGES:

  • Medium security fix: A Cross-Site Scripting (XSS) vulnerability was discovered on many pages, in which a malicious user (who must be logged in) could potentially exploit it by adding some very specific, malformed HTML tags with certain attributes into places in REDCap where such HTML gets reflected back on a page that a user is viewing. This includes field labels, field choice labels, survey instructions, etc. on data entry forms and surveys, as well as other places throughout REDCap where user input is displayed on a webpage.
  • Change: If REDCap is running on a version of PHP that is not one of the currently supported versions of PHP (according to https://www.php.net/supported-versions.php), it will display a warning in the Server Info section at the top right of the main Control Center page that recommends that PHP be upgraded soon to one of the supported versions.
  • Bug fix: There is a small chance that a cron job might have multiple simultaneous instances running of the job when there should only ever be one instance of it running. This mostly applies to External Module cron jobs since most internal cron jobs in REDCap have built-in ways of preventing issues with this.
  • Bug fix: Nine "Laboratory" fields and their associated LOINC codes were mistakenly missing from the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: When using the operators "&&" and "||" in place of "and" and "or", respectively, in report filtering logic, it would mistakenly fail to filter the report correctly. Bug emerged in the previous version. (Ticket #77738)
  • Change: In the Online Designer's Edit Field dialog, the textarea boxes (field label, field choices, and action tags) are now slightly bigger and are all resizable.
  • Bug fix: Reports were loading unexpectedly slowly in certain cases where report logic was being used when data from repeating instruments/events were being displayed in the report.
  • Bug fix: Reports that contained the record ID field and also contained fields from repeating instruments/events were mistakenly displaying blank rows in the report (i.e., all fields in the row were blank *except* for the record ID field) if the report contained filtering logic that evaluated as TRUE on the first repeating instance. If the filtering logic did not evaluate as TRUE on the first repeating instance (but perhaps on other repeating instances), the blank row would not be displayed, as expected.
  • Bug fix: When creating a new project using a super API token via the Create Project API method using a Project XML file, it would mistakenly output some junk code in the API response that was only meant for debugging purposes. (Ticket #77798)
  • Bug fix: When using a logic tester to validate if logic has correct syntax (e.g., when creating a Data Quality Rule, adding report filter logic), if the logic contained certain Smart Variables, it would mistakenly say that the logic is not correct syntax when it actually is correct. (Ticket #77741)
  • Bug fix: When using certain Smart Variables inside the the Custom Label for Repeating Instruments, it might mistakenly replace the Smart Variable with a blank value rather than the correct value when displaying the custom label in the repeating instrument tables on the Record Home Page and in the drop-down of repeating instances at the top of data entry forms. (Ticket #77575)
  • Bug fix: If any Automated Survey Invitations get triggered via the ASI DataDiff cron job (because an ASI has conditional logic that contains datediff+today/now) in a longitudinal project, then invitations might not get successfully scheduled if the conditional logic refers to a field on an event for which its instrument has not been designated. For example, if we have logic such as "[event1][field1] = '2'", and field1's instrument is not designated for event1, then invitations would never get scheduled by the ASI datediff cron job when attempting to process this logic. (Ticket #77812)

Version 9.7.0 - (released 1/31/2020)

BUG FIXES AND OTHER CHANGES:

  • New feature: REDCap-branded URL Shortener (https://redcap.link)
    • The “Get short survey link” and “Create custom survey link” buttons on a project’s Public Survey Link page now utilize the REDCap-branded URL Shortener (https://redcap.link) instead of BIT.LY and IS.GD, which are third-party websites utilized by previous versions.
    • For administrators, a new “URL Shortener” link on the Control Center’s left-hand menu will take you to the “All-Purpose REDCap URL Shortener” page, which allows an admin to take *any* URL and shorten it as a custom redcap.link URL. We ask that you please try to limit the usage of this feature to only REDCap-related and work-related things.
    • NOTICE: Since this feature is ultimately supported by Vanderbilt, which pays for the hosting and infrastructure on AWS, it is a requirement that the REDCap server must have reported its REDCap stats to the consortium first in order to be able to use the REDCap URL Shortener. If the server’s REDCap stats have never been submitted, then the feature will return an error when attempting to create a redcap.link URL and will note this requirement in the error message.
    • To disable this feature and revert back to using BIT.LY and IS.GD for URL shortening for public survey links, you can run the following SQL query on your REDCap database: UPDATE redcap_config SET value = '0' WHERE field_name = 'enable_url_shortener_redcap';
  • Change/improvement: By popular demand, the "Send test email" link/feature has been re-added to all the following places where emails are composed: Email Users page in the Control Center, Automated Survey Invitations setup dialog, Compose Survey Invitations dialog for Participant List, Compose Survey Invitation dialog at the top right of data entry form, and the Confirmation Email setting on the Survey Settings page.
  • Major bug fix: Most non-project types of actions by users were mistakenly not being logged in REDCap due to a query that failed when inserting a new row into the redcap_log_event database table. All project-level logging was correctly being logged, but non-project activities (such as creating users, resetting passwords, etc.) were mistakenly not getting logged. Bug emerged in REDCap 9.6.0 Standard. (Ticket #77584)
  • Bug fix: On the Activity Log page in the Control Center, the popover that appears when mousing-over the gear icon next to each logged event would mistakenly stay visible, even when the user mouses-off of the gear icon. (Ticket #77044)
  • Bug fix: When putting the cursor in the Variable Name text box in the Edit Field dialog in the Online Designer, if the variable name is longer than 26 characters and the project is currently in production status in Draft Mode, it might mistakenly pile several different dialogs on top of each other and make it impossible to close them all. This is often exacerbated if clicking the "X" icon or Escape key when attempting to close the dialogs. (Ticket #75072)
  • Bug fix: It might mistakenly report an error that the "database structure is incorrect" in the Control Center or on the Configuration Check page when in fact the database structure is correct. And if the "Easy Upgrade" feature is enabled, the "Auto-Fix" option would fail if attempted. This issue is due to a previous fix that was meant to address idiosyncrasies in MySQL 8.0 but did not fully, and in fact the previous fix caused issues with installations that were not running MySQL 8.0. So this should now fix the issue on all versions of MySQL where these errors are occurring. (Ticket #76872)
  • Change: In a production project where repeating instruments/events are enabled, if a user opens the Repeating Instrument/Event setup dialog on the Project Setup page, in which one or more checkboxes are checked already in the setup, a warning dialog with red text will be displayed to inform the user that unchecking any of the checkboxes might cause data to be orphaned and thus will cause any data already collected from repeating instances to disappear indefinitely from the user interface, reports, and exports. This warning will help users to be aware of this possibility that might affect their data and thus might have otherwise caused confusion. (Ticket #66801)
  • Bug fix: If using the Clinical Data Pull in a project, and the setting “Convert source system timestamps from GMT to local server time?” is set to “Yes” on the Clinical Data Interoperability Services page in the Control Center, then if a user in the project is adjudicating data values, in which a single temporal value (i.e., Labs or Vitals) is displayed on multiple fields/events within the adjudication popup for that record, then that value’s associated timestamp would mistakenly get shifted by the same amount (e.g., by 6 hours if in Central Time) for *every* time that value is displayed in the popup. Thus the timestamp value would be incorrect for every place where it is displayed in the popup except for the first one. Note: This issue does not affect the data value being imported at all.
  • Bug fix: When viewing the Project Modification Module for a production project in Draft Mode, it might mistakenly display false positives for field changes as if some fields are being modified when in fact they are not. This can happen if the old field attributes and new field attributes are the same except that one has Windows newline characters (which represent line breaks in text) and the other has Linux newline characters, or vice versa. So the text looks the same on the page, but REDCap thinks they are different and thus flags them as yellow on the page. When comparing them, it no longer pays attention to what type of newline character is being used. (Ticket #76811)
  • Change: At the top right of the main Control Center "Notifications" page, it now displays the following server info: PHP version, MySQL/MariaDB version, and the web server OS type (Windows vs Linux/Unix).
  • Bug fix: If a field's branching logic contained the datediff() function with a literal date (e.g., "01-01-2020") as one of the first two parameters in the function, in which the date value was either in MDY or DMY date format, then certain server-side logic-parsing operations (e.g., Data Quality rule A and B, the use of branching logic in downloaded PDFs) would fail to work correctly.
  • Bug fix: Data Quality rule F would use a bit too much web server memory while processing. (Ticket #77606)
  • Change: If using WebDAV for file storage and the WebDAV connection file on the web server cannot be read by REDCap for some reason (e.g., due to a file/folder permissions issue), then it would prevent much of REDCap from working correctly and not give any clue as to what was causing it, making it difficult to troubleshoot. To prevent this issue, it now fails more gracefully and provides an error message on what the exact problem is in this particular case.
  • Bug fix: If exporting a report to a stats package (SAS, SPSS, R, Stata) in which the first instrument in the project is enabled as a survey and the record ID field is the only field from the first instrument that is included in the report, then the resulting syntax file for the stats package would mistakenly reference the survey timestamp field of the first instrument, and since that timestamp field would not be included in the CSV data file in the export, it would cause errors to occur when loading the exported data into the stats package. (Ticket #77574)

Version 9.6.5 - (released 1/28/2020)

BUG FIXES AND OTHER CHANGES:

  • Improvement: Adaptive and Auto-scoring instruments (i.e., PROMIS assessments) that have been downloaded from the REDCap Shared Library may now have their survey responses deleted via the Delete button at the bottom of the data entry form when viewing the survey response. In previous versions, if an Adaptive and Auto-scoring instrument had been partially completed or the wrong one had been taking accidentally, there was no way to remove the existing response since the whole response was locked afterward. Now the "Delete data for THIS FORM only" button appears at the bottom to allow users to remove the response if they wish to add another to replace it. (Ticket #77086)
  • Major bug fix: Some specific server installations (most notably Linux servers running PHP 7) would result in many fatal PHP errors when running or enabling external modules, thus making the REDCap installation mostly unusable in some cases. A patch has been issued to the External Module Framework to fix this. Bug emerged in REDCap 9.6.4 (Standard).
  • Bug fix/change: Email Alerts converter has been removed - The Email Alerts external module has diverged from Alerts & Notifications in both its feature set and its back-end storage structure to the point where the option to convert alerts from the Email Alerts module into Alerts & Notifications is no longer a viable or reliable option, and in some cases the converter has caused major issues on some installations by not successfully converting alerts correctly. To prevent further damage, the EA->A&N converter will be removed from the user interface (it exists as a green button at the top right of the "Configure Email Alerts" page, which opens a dialog popup). This change will not in any way affect the functionality of the Email Alerts external module or the Alerts & Notifications feature, and they will both continue to function and exist separately with no conflict to each other. NOTE: This fix/change is only relevant if you have the Email Alerts external module installed on your REDCap system. REVERTING BACK: If for some reason you want to expose the EA->A&N converter feature to use it again, you may execute the following SQL query on the MySQL database, after which the green converter button will appear again in all projects where the Email Alerts module has been enabled: UPDATE redcap_config SET value = '1' WHERE field_name = 'email_alerts_converter_enabled'; WARNING: Please be aware that no guarantee is given regarding the success of the EA->A&N converter if you choose to re-enable it and use it. It is HIGHLY recommended that you leave it disabled.
  • Bug fix: Certain types of cookies created by REDCap were not getting stored correctly in a user's browser if the “session.cookie_secure” setting is set to “On” in the server’s PHP.INI configuration file while using a version of PHP lower than PHP 7.3.0. For example, this would likely prevent the Google reCAPTCHA feature from working successfully on public surveys, thus preventing survey participants from taking those surveys. This bug emerged in the previous release.
  • Bug fix: When a user adds a full REDCap survey link (as opposed to using the [survey-link] smart variable) into the rich text editor when composing a survey invitation (i.e., in the "Compose Survey Invitations" popup or "Automated Survey Invitations" popup), the warning dialog that suggests to remove the hard-coded survey link would mistakenly get displayed multiple times on top of itself, thus making it impossible for the user to actually close them all and forcing the user to refresh the page. (Ticket #77086)

Version 9.6.4 - (released 1/27/2020)

BUG FIXES AND OTHER CHANGES:

  • Improvement: If the "email notifications for administrators" option is enabled on the To-Do List page, then when a user cancels a "move project to production" request or a "delete production project" request, it now sends an email notification to the REDCap administrator to inform the admin that the request was cancelled so that the admin does not attempt to process it (even though the admin will be prevented with an error message if they try to process it). In previous versions, the request would have been cancelled silently by the user without ever notifying the admin.
  • Change: The Configuration Check page now makes a suggestion that the PHP setting "session.cookie_secure" be set to "On" in the PHP.INI configuration file if you are running REDCap over SSL/HTTPS. Doing this is not required, but it is recommended since it improves the overall security of the REDCap system.
  • Bug fix: If running REDCap on MySQL 8.0, it might mistakenly report an error that the "database structure is incorrect" in the Control Center or on the Configuration Check page when in fact the database structure is correct. This is due to the ZEROFILL attribute for numeric field types that exist in MySQL 8.0. Note: This issue was thought to have been fixed in the previous release but was not. (Ticket #76872)
  • Bug fix: The project templates created during a fresh install of REDCap contained fields that mistakenly conflated the concepts of sex and gender (e.g., having "Gender" as the field label with "sex" as the variable name) and often did not provide enough inclusive options as choices. These fields in the project templates have thus been modified.
  • Bug fix: When viewing a project's Logging page and the text displayed in the last table column is very long with no spaces, it might mistakenly overflow out of the table and sometimes off the page.
  • Various bug fixes and changes for the External Module Framework.
  • Due to changes in the default cookie settings in the Google Chrome browser (in Chrome v80 and later), any REDCap pages embedded on another website (via iframe) might mistakenly not be able to start an authenticated session successfully when logging in to REDCap. This may also affect surveys' ability to collect some data and behave correctly if the survey page is embedded on another website. REDCap now manually sets the cookie "SameSite" attribute with the value "None" by default in all compatible web browsers for all cookies generated by PHP in REDCap. Note: This is only applicable for REDCap installations using SSL/HTTPS that have the setting “session.cookie_secure” set to “On” in the server’s PHP.INI configuration file. If session.cookie_secure is not set to On, then the SameSite cookie attribute will not be added by REDCap.
  • Bug fix: The main Notifications page in the Control Center and the Configuration Check page might not load completely if using PHP 5.5 or 5.6. Bug emerged in the previous REDCap version.
  • Bug fix: A couple words were mistakenly not translated on Copy Project page. (Ticket #77083)
  • Bug fix: If a user has clicked the "Request delete project" button on the "Other Functionality" page in a production project, after which they then click the "Cancel request" button to cancel that project-deletion request, then an administrator who is processing user requests via email notifications (as opposed to via the To-Do List) might not realize that the request was cancelled and thus might process the request and mistakenly delete the user's project unwittingly.
  • Bug fix: The Clinical Data Interoperability Services (CDIS) now works more correctly for provider apps when using with the Cerner EHR system. In the previous versions, it was not working successfully.
  • Bug fix: When launching the Clinical Data Pull (CDP) feature as a REDCap window inside the EHR, it would mistakenly force the user to log in to REDCap every time they had a new EHR session. It should instead only ask the user to log into REDCap the first time and then remember it for all other times afterward in the future.

Version 9.6.3 - (released 1/21/2020)

BUG FIXES AND OTHER CHANGES:

  • Major bug fix: If the Twilio telephony feature has been disabled at the system level on the Modules/Services Configuration page in the Control Center, then when adding/editing an alert on the Alerts & Notifications page in a project, the alert's Email From, To, CC, BCC, and Subject values would mistakenly all get set to a blank value when saving a new or existing alert. (Ticket #76760)
  • Change/improvement: The text box fields for logic have been increased in size and made resizable for the following places: the Survey Queue setup popup in the Online Designer, the Add/Edit Branching Logic popup in the Online Designer, and the Advanced Filter Logic when creating/editing reports.
  • Bug fix: The Survey Confirmation Email feature might mistakenly display too many line breaks in the email text when viewing it on the Survey Settings page for an instrument or when viewing the received confirmation email in an email client.
  • Bug fix: When importing data via API or Data Import Tool, it would mistakenly output a bunch of seemingly random text (e.g., "redcap_repeat_instrument, $repeat_instrument: ...") that was only meant for debugging purposes.
  • Bug fix: When using a rich text editor that exists inside a modal dialog (e.g., the "Create new alert" dialog, the "Automated Survey Invitation" setup dialog), the rich text editor's "Table" menu option would not function correctly and would prevent users from adding a table to their rich text.
  • Bug fix: If running REDCap on MySQL 8.0, it might mistakenly report an error that the "database structure is incorrect" in the Control Center or on the Configuration Check page when in fact the database structure is correct. This is due to the ZEROFILL attribute for numeric field types that exist in MySQL 8.0. (Ticket #76768)
  • Bug fix: If the setting "Auto-suspend users after period of inactivity" is enabled, and some users who are suspended have not had any activity within the designated period of inactivity, then if the user has a sponsor and the user's sponsor puts in a request to have them unsuspended, the user would mistakenly get re-suspended within a day. (Ticket #58909)
  • Bug fix: The email content text box was mistakenly too short in the Compose Survey Invitations popup on the Participant List page.
  • Bug fix: When clicking the "Cancel" button on a data entry form, it would mistakenly display the alert "Are you sure you wish to CANCEL and lose all changes made on this page?" when no values had actually changed on the page, which could be confusing to users. It now only displays the alerts when values have been added or modified. (Ticket #76818)
  • Bug fix: When using Missing Data Codes in a project where a field in the project has the same value as a missing data code but has the @NOMISSING action tag, it would mistakenly interpret the field value as a missing data code in the following places: 1) the Data History popup on a data entry form, and 2) in the CSV Labels data export file. (Ticket #76813)
  • Bug fix: When using Missing Data Codes in a project, if a file has been uploaded for a File Upload field and then a user clicks the "M" icon next to the field to open the missing data code choices, if they then click "[Clear value]", it would mistakenly hide the filename of the existing uploaded file, even though the user might choose to cancel the operation and not delete the file. This could be confusing to the user since it is hiding the file's filename prematurely in the process of entering a missing data code, thus making it appear as if perhaps the file has been deleted when in fact it has not. (Ticket #76810)

Version 9.6.2 - (released 1/20/2020)

BUG FIXES AND OTHER CHANGES:

  • Improvement: New options for Alerts & Notifications
    • A “Trigger Limit” setting was added to Step 1 in the Add/Edit Alert popup that allows users to define where and to what extent within a record that the alert will be triggered. Its options include “only once per record”, “only once per event”, “only once per instrument regardless of the event”, and others that are displayed if the project contains repeating instruments/events. The trigger limit will help users to limit alerts to only be triggered on certain parts of a record and/or so many times within a record to achieve the behavior they desire for their notifications. Note: For non-longitudinal projects that do not have repeating instruments, this option (Step 1C) will not be displayed at all since it would contain only one choice: “only once per record”. (Ticket #70860)
    • The “every time” option of the “Send it how many times?” setting in Step 2 has been expanded to have sub-options to provide more possible scenarios in which an alert will be triggered. In previous versions, the only option was to set an alert to be triggered “every time the form/survey in Step 1B is saved”, but now it contains two new variations: “every time the form/survey in Step 1B is saved with new or modified data” and “every time the form/survey in Step 1B is saved with new or modified data (ignoring calc fields)”.
    • Recurrence maximum - When setting an alert to send multiple times in a recurring fashion in Step 2, a new option has been added to limit the maximum number of recurrences (i.e., the total times the alert will be sent on its repeated schedule). In previous versions, the alert would continue sending indefinitely at its defined interval (typically until conditional logic became no longer true), but now the alert can be set to repeat up to 9999 times at the interval that has been defined.
  • Major security fix: An “information leakage” security vulnerability was discovered, in which a malicious user could exploit it by manipulating the URL’s query string parameters for certain paths used to access External Module pages. This is not related to any specific External Module but is a vulnerability in the External Module Framework bundled with REDCap. The user could potentially access the contents of any plain-text files (excluding PHP files) that exist on the REDCap web server, including files that sit outside the server’s web root, which could include files with sensitive information. Note: In order to exploit this, the user must be a valid user that is currently logged in. This exploit is not able to reveal the contents of any PHP files on the server but other plain-text files instead, such as files with file extensions TXT, JSON, XML, or YAML. And in order to view the contents of a file, the malicious user must first know or guess the exact filename *and* directory location of the file on the server.
  • Improvement: If the Custom Record Label and/or Secondary Unique Field are being used in a project, their values will now be displayed on the Calendar page when viewing the Day or Agenda tab for any calendar event connected to a record in the project.
  • Improvement/change: On the Alerts & Notifications page, users may now edit a deactivated alert. This is especially useful if a user is setting up part of an alert and wishes to make incremental edits to the alert prior to re-enabling it.
  • Improvement: A new setting "Utilize the Display Name in all outgoing emails?" was added to the "Configuration for Outgoing Emails" section on the Control Center's "General Configuration" page. This setting allows administrators to disable the email Display Name feature in all outgoing emails from REDCap. This feature might need to be disabled if your institution is having a disproportionate amount of emails not being received due to email servers blocking them, sometimes due to the usage of the display name. This setting is enabled by default when upgrading or installing REDCap. (Ticket #75941)
  • Improvement: On the Clinical Data Interoperability Services (CDIS) page in the Control Center, a new helper popup was added to assist admins in quickly determining their EHR's "Patient Identifier String". A new button "Find patient identifier string" will appear on the page, and after clicking it, it will ask the administrator to enter the Social Security Number of any patient in the EHR system, which will return a list of all patient identifier strings that are available in the EHR. After finding the identifier string that corresponds to MRNs in the EHR system, that string can then be pasted and saved on that page so that the Clinical Data Mart and Clinical Data Pull services can begin functioning fully.
  • Change/improvement: The TinyMCE library was upgraded from v4.9.2 to v5.1.5.
  • Bug fix: External Modules could not be enabled if the user was using Internet Explorer. (Ticket #76276)
  • Bug fix: When exporting data into SAS, it would result in errors upon loading into SAS for datetime fields if Missing Data Codes are not utilized in the project.
  • Bug fix: When exporting data into SAS, it would mistakenly not apply choice label formats onto multiple choice values when loading into SAS.
  • Bug fix: If a REDCap plugin, hook, or external module is calling REDCap::saveData() from outside the scope of the project in which it is saving the data, then if any Automated Survey Invitations in the project have conditional logic, then those ASIs might not get triggered successfully because in most cases the logic will never evaluate to TRUE. (Ticket #75607)
  • Various fixes and updates for the External Module Framework
  • Bug fix: When clicking the table header for a date or datetime field in a report, in which the dates/datetimes are in either MDY or DMY date format, it would mistakenly not sort the values correctly in the report. (Ticket #76377)
  • Bug fix: If the Survey Confirmation Email setting has been enabled at the bottom of the Survey Settings page for a data collection instrument, and then a user disables it by setting its drop-down value to "No" and then saves the page, then even though the setting does get properly disabled upon save, if a user re-opens the Survey Settings page again later, it would mistakenly display the Survey Confirmation Email setting as still being enabled - even though it is not. (Ticket #76354)
  • Bug fix: If the User Settings option "Allow normal users to move projects to production?" is set to "No, only Administrators can move projects to production," and email notifications are enabled for administrators to receive these user requests via email, then if a user requests that a project be moved to production but then cancels their own request on the Project Setup page, an administrator could still move the project to production afterward if they click the link received in the email (however, this could not be done via the To-Do List interface). This could cause some projects to have all their data mistakenly deleted if the requesting user clicked the wrong option in the "move to production" dialog and didn't notify the admin immediately afterward so that the admin would not approve their request. From now on, if the admin clicks the link in the email and the user has already cancelled the request, it will display an error to the admin and prevent them from approving the deleted request. (Ticket #76068)
  • Bug fix: When executing a custom Data Quality rule in a longitudinal project, in which the rule's logic references fields on multiple events, in certain scenarios it might mistakenly display a false positive discrepancy from another unrelated event that is not referenced in the logic. (Ticket #76090)
  • Bug fix: When viewing a project's Calendar page, the Agenda tab might mistakenly display "No calendar events to display" even though one calendar event is being displayed.
  • Bug fix: When accessing the "Help & FAQ" page via the top nav bar on the My Projects page and Control Center pages, the search box at the top of the "Help & FAQ" page would be mostly obscured when initially loading the page, thus making it unusable until you scrolled down the page some to reveal it.
  • Change: In the Add/Edit Alert popup on the Alerts & Notifications page, the Alert Expiration option has been moved upward in the popup so that it is now part of Step 2.
  • Bug fix: In the Add/Edit Alert popup on the Alerts & Notifications page, the "Add Attachments" button in the popup would mistakenly not do anything, thus preventing users from adding attachments to their alerts. (Ticket #76541)
  • Bug fix: The email Display Name will no longer be utilized for the "REDCap access granted" emails and "Verify your email address" emails that are sent to users from REDCap because the Display Name for these particular emails were causing them to get disproportionately flagged as spam by many institutions' email servers, thus preventing users from receiving them. (Ticket #75941)
  • Bug fix: When using the CSV import functionality for the field mapping page of the Clinical Data Pull (CDP) feature, it would mistakenly not allow composite mapping of fields (i.e., many-to-one or one-to-many mapping) and thus might ignore some field mappings included in the CSV import file.
  • Bug fix: If data had been entered into multiple instances of a repeating instrument or repeating event and then that instrument or event was later set to no longer be repeating (while there still exist other repeating instruments/events in the project), then the orphaned data from the repeating instances might mistakenly get included and displayed in reports or data exports. And in some cases, this orphaned data might cause Data Quality rule H to behave erratically, such as stating that there are some discrepancies to fix, but after clicking the button to auto-fix them, it would say that "0" were fixed.
  • Bug fix: For many popup dialogs whose content is obtained from an AJAX call that returns a JSON-encoded payload, there are some cases where the popup might fail to open if there are certain non-Latin/UTF-8 characters in the text that will be displayed in the popup (e.g., Field Comments dialog, Survey Login dialog, Survey Queue Setup dialog, Edit Matrix Fields dialog). A new process has been added to most of these places to ensure that at least some of the content gets displayed in the dialog popup rather than never being able to open the dialog at all. (Ticket #76619)
  • Bug fix: If an alert has been created in which its content/message contains one or more Smart Variables that allow you to provide custom text, such as survey-link, form-link, and survey-queue-link (e.g., [survey-link:prescreening:My Custom Text]), then if the Smart Variable's custom text contains a forward slash "/", then it would mistakenly prevent the alert's notification from being sent.
  • Bug fix: If Missing Data Codes are enabled in a project, then the Missing Data Codes "M" icon on a data entry form would mistakenly be displayed and would function even when the entire form is disabled due to limited user rights or if viewing an un-editable survey response. Note: Clicking an option in the Missing Data Codes popup would change the value of the associated field, but since there would be no way to save that value, it would never affect any data. (Ticket #76688)
  • Bug fix: When a user requests changes in a production project, the display name for the "Review & Approve Project Changes" email sent to the REDCap admin gets set to the project contact name instead of the user's first and last name. (Ticket #76685)
  • Bug fix: If exporting a report in JSON format via the REDCap API, in which the report has filter logic defined and contains many thousands of records that will be returned, the beginning of the JSON string returned in the API response might mistakenly get malformed and begin with "[,{" instead of "[{". (Ticket #76602)
  • Bug fix: When importing data via the API in "EAV" format for a repeating instrument or repeating event, many of the normal checks that ensure that the fields "redcap_repeat_instrument" and "redcap_repeat_instance" have valid values where mistakenly getting bypassed and thus not performing all the necessary checks to ensure the best data quality during the import. For example, importing a field on a repeating instrument but leaving the "redcap_repeat_instance" field blank would not return an error but would instead assume the value is "1", which should not be assumed. (Ticket #75854)

Version 9.6.1 - (released 1/10/2020)

BUG FIXES AND OTHER CHANGES:

  • Major bug fix: If the Twilio telephony feature has been disabled at the system level on the Modules/Services Configuration page in the Control Center, then when adding/editing an alert on the Alerts & Notifications page in a project, the "Email From", "Email To", and "Subject" settings would mistakenly not be displayed and thus would prevent users from creating or editing an alert. (Ticket #76266)

Version 9.6.0 - (released 1/9/2020)

NEW FEATURES, BUG FIXES, AND OTHER CHANGES:

  • New feature: SMS and Voice Calls for Alerts & Notifications
    • If Twilio services have not been disabled at the system level for the REDCap installation, then users may now send a notification as an SMS text message and/or as a one-way voice call for any given alert in a project by setting them up on the Alerts & Notifications page.
    • The Twilio telephony services must first be enabled on the project on the Project Setup page (the same way it has in the past when utilizing Twilio for surveys and survey invitations), and once enabled, using the Twilio configuration dialog users may choose to utilize Twilio in the project for surveys (default), alerts, or both surveys and alerts.
    • Once enabled for alerts, inside the Add/Edit Alert dialog on the Alerts & Notifications page users will see the options to send a notification as an email, SMS message, or voice call. If SMS or voice call is chosen, it will hide all email-specific settings and will reveal the “Phone Number” fields for entering the phone numbers of one or more recipients of the notification, which may include the following: the phone numbers of all project users (from their My Profile account settings), any fields having integer validation or phone validation, and the survey participant’s phone number (if also using Twilio services for surveys).
    • Note: Just as when SMS messages are sent and when voice calls are made via Twilio for surveys, REDCap has a cron job that runs every 2 minutes that will automatically delete all logs on the Twilio website for any SMS messages sent or voice calls made via Alerts & Notifications. This is for privacy reasons to remove any potentially sensitive information (e.g., recipient phone numbers) that might be stored in Twilio’s logs.
    • New system-level settings for Alerts & Notifications have been added to the “Modules/Services Configuration” page in the Control Center that allow REDCap administrators to disable the phone-related settings listed below (similar to the ones that currently exist regarding email address usage in alerts). Note: These settings are enabled by default when upgrading to 9.6.0 or higher or when installing REDCap.
      • Option: “Allow normal users to use project variables for phone fields and integer fields in the project for an alert's recipient phone numbers?
      • Option: “Allow normal users to manually enter email addresses as freeform text for an alert's recipient phone numbers?”
  • New feature: New REDCap class method for plugins/modules/hooks: getLogEventTable($project_id) - Method will return the database table name for a specified project by providing its project_id. If $project_id is null or not provided, it will return “redcap_log_event” by default.
  • Change/improvement: Added four new redcap_log_event database tables for new projects to improve server performance when REDCap is querying logging data for a project. Note: This will not improve performance when querying the logging records of existing projects but only applies to projects created after upgrading to v9.6.0 or higher.
  • Change/improvement: To protect the performance of the REDCap server, safeguards have been added to prevent users from running more than five Data Quality rules simultaneously for a given project. If this is detected, REDCap will automatically kill all but the newest five Data Quality rule requests that are still running and will display an error message on the page explaining this.
  • Minor security fix: REDCap now automatically removes the "X-Powered-By" response header produced by the REDCap server so that it doesn't reveal the server's PHP version (the default behavior), which is considered to be a minor security issue.
  • Bug fix: If the record ID field has min/max validation, it would mistakenly prevent records from being created on the "Add/Edit Records" page and "Record Status Dashboard" if a record ID was entered in the correct format but whose value was out of range. It should allow the creation of the record even when out of range. (Ticket #60352)
  • Bug fix: If any Alerts & Notifications get triggered via the Alerts DataDiff cron job (because an alert has conditional logic that contains datediff+today/now), then it might not perform all piping correctly if any field variables are piped into the email subject, email content, or are used for recipients or attachments.
  • Bug fix: If an alert is set to be triggered "Using conditional logic during a data import or data entry" and is set to send "Just once", then if the conditional logic has become true when importing or entering data for a repeating instrument, it would mistakenly keep sending a new notification every time the record is saved (assuming the logic is still true). Instead it should only send it once (per repeating instance).
  • Bug fix: If any Alerts & Notifications get triggered via the Alerts DataDiff cron job (because an alert has conditional logic that contains datediff+today/now), then they might mistakenly only get scheduled once per record rather than for all events and all repeating instances within a given record. Warning: This fix might inadvertently cause the cron job to schedule/send any alerts that were supposed to have been scheduled/sent in the past but mistakenly were not sent because of this bug. There is unfortunately no way to prevent this.
  • Bug fix: When attempting to change the version of an External Module while using Firefox, it would mistakenly fail due to a JavaScript error. (Ticket #76009)
  • Change/improvement: The TinyMCE library was upgraded from v4.7.2 to v4.9.2.
  • Bug fix: The act of deleting a custom record status dashboard would mistakenly not get logged on the project's Logging page.
  • Bug fix: When exporting data into SAS, it would result in errors upon loading into SAS for multiple choice fields that contain only numerical codings (including True/False, Yes/No, and form complete status fields) and also for number/integer fields, but only if Missing Data Codes are not utilized in the project.
  • Bug fix: Some CSS (i.e., affecting "a.btn") was added to REDCap's styling in a recent version that was mistakenly overriding some Bootstrap CSS, which might negatively affect some REDCap plugins, hooks, or modules. (Ticket #75943)
  • Bug fix: If the setting "Domain whitelist for user email addresses" is enabled and Table-based authentication is being used, then the "Set Up Password Recovery Question" popup would mistakenly fail to enforce the domain whitelist if a user attempts to modify their primary email address in that popup. (Ticket #75990)
  • Bug fix: For users with visual impairments that are using screen reader software on survey pages, there are certain conditions, such as if the Text-To-Speech feature is enabled on that survey, where screen readers might not be able to interpret all the labels on the page correctly.
  • Bug fix: When viewing a project's Logging page using Internet Explorer or Edge browser, if the username is long as displayed in the logging table, it might cause some of the columns in the table to overflow onto each other, thus making them nearly unreadable. (Ticket #76109)
  • Bug fix: False positives may appear as discrepancies when running Data Quality rule F in a longitudinal project when fields have branching logic that does not have a unique event name explicitly prepended to all field variables in the logic. (Ticket #66789)
  • Bug fix: When attempting to add a new user on the User Rights page in a project, if a user being searched for has a first or last name that contains undecipherable/mangled characters, then it would fail to return any users in the auto-suggest list as the user types the user's username. (Ticket #76053)

Version 9.5.3 - (released 12/31/2019)

BUG FIXES & OTHER CHANGES:

  • Improvement: New content was added to the "Help & FAQ" page
  • Bug fix: For branching logic, calculated fields, or other logic, if "IF" statements are nested in the logic, then in some cases the logic might not get parsed correctly and might produce an error or behave unexpectedly. For instance, this will occur if the logic contains "if(if(..." with no spaces between each "if(". (Ticket #75506)
  • Bug fix: When branching logic on a data entry form or survey attempts to hide a checkbox field and thus erase its values (i.e., uncheck all its checkboxes), if any of the checkbox options contains a dash/hyphen in its coded value, it would mistakenly display an error message saying that branching logic errors exist, which is not true. (Ticket #75346)
  • Bug fix: When creating a project using a Project XML file that contains multiple reports, each subsequent report that gets created in the new project would mistakenly contain all the fields from all previous reports in that project. (Ticket #75517)
  • Bug fix: If administrators must approve the creation of new projects on a user's behalf, then if the user had selected one or more Project Folders to which the new project should be assigned, the new project would mistakenly get assigned and connected to the administrator processing the request instead of to the user making the request, which could cause errors for the requester later on if they attempt to add or remove that project to/from a Project Folder. (Ticket #75004)
  • Bug fix: When exporting the PDF of an instrument, in which the instrument has no data (i.e., has a gray form status icon) and the instrument is also not the last instrument in the project, it might mistakenly display the instrument title (or survey title/instructions, if enabled as a survey) while the rest of the page in the PDF would remain blank. It should instead not include the page at all in the PDF export. (Ticket #73896)
  • Bug fix: If the setting "Domain whitelist for cross-domain HTTP access control" is set on the Security & Authentication page in the Control Center, in which multiple domains have been set, then it would mistakenly only allow the last domain defined in the list. (Ticket #75848)
  • Bug fix: If using MySQL 8 for the database while viewing "View User List By Criteria" on the "Browse Users" page in the Control Center, selecting "Active in past X" or "Not active in past X" from the drop-down list would always mistakenly return no results. (Ticket #75429)
  • Bug fix: If a custom Data Quality Rule contains more than one field in a project with repeating events or repeating instruments, then if none of the fields in the rule's logic exist on a repeating event/instrument, it might mistakenly return duplicate discrepancies of those fields on one or more repeating instances. (Ticket #75839)
  • Bug fix: If a custom Data Quality Rule in a longitudinal project references fields in repeating events/instruments, in which the rule logic does not explicitly specify the event name or repeating instance designation for the field, then it might return an "ERROR" message stating that the logic has syntactical errors, which is not true.
  • Fixes and updates for the External Module Framework.
  • Bug fix: If a longitudinal project with repeating instruments or repeating events contains reports with report filter logic that references fields on both repeating and non-repeating instruments/events, in which the fields on repeating instruments/events do not have anything appended to them, such as a numeral instance designation or instance Smart Variable, then the report might return incorrect results. This appears only to occur if the report setting "Show data for all events or repeating instruments for each record returned" is left unchecked. (Ticket #75792)
  • Bug fix: When exporting data into SAS, it would result in errors upon loading into SAS for multiple choice fields that contain only numerical codings (including True/False, Yes/No, and form complete status fields) if Missing Data Codes are not utilized in the project.

Version 9.5.2 - (released 12/20/2019)

BUG FIXES & OTHER CHANGES:

  • New feature: Built-in activation process for external modules (system-level setting - enabled by default)
    • All modules that have been set as “Discoverable” in the system will now have a “Request Activation” button displayed next to them when viewing the list of available modules on the External Modules page in a project. If a user with Project Setup/Design privileges in the project clicks the button, it will add a new item to the To-Do List in the Control Center (and also send an email to the REDCap administrator if admin email notifications are enabled) that will ask the admin to activate the module. Once the admin has activated the module for the user, the user will receive an email informing them that the module has been activated for the project.
    • Note: This option can be disabled to hide this button for all discoverable modules (e.g., if you wish to use your own module activation process) at the top of the “Modules/Services Configuration” page in the Control Center.
  • New feature: Users can self-activate an external module for a project (module level setting - disabled by default)
    • For any given module that has been enabled in the system and that has also been set as “Discoverable”, a REDCap administrator may optionally set a module setting (in the Configure Module popup for the module in the Control Center) that will allow any user with Project Setup/Design privileges in a project to activate the module in their project on their own (i.e., without an administrator having to enable it for them).
    • Since this is a module-level setting, it is completely opt-in by the REDCap administrator for any given discoverable module.
  • New feature: Standalone Launch for CDP and Data Mart - When using the Clinical Data Pull or Clinical Data Mart functionality, it is no longer required for users to have to log in to the EHR and launch the embedded REDCap window inside the EHR interface as a means of establishing a connection between their REDCap account and the EHR. This is now optional. Users may now alternatively establish a connection with the EHR by logging into to the EHR via a prompt while inside REDCap. If a user in REDCap attempts to pull clinical data from the EHR, in which it determines that the user has not established a connection yet with the EHR, it will prompt them to log into their EHR directly in their web browser, after which it will redirect them back to REDCap to begin pulling the clinical data from the EHR. Thus setting up a REDCap launch button in the EHR interface is no longer required but optional since the connection can now be completely established on the REDCap side alone. NOTE: For those using Epic, this means that creating an FDI Integration Record and Menu Record are no longer mandatory as part of the general CDIS setup process.
  • Improvement: In Alerts & Notifications when clicking the "Preview Message by Record" option, it now displays the Custom Record Label and/or Secondary Unique Field value in the record drop-down list in the dialog.
  • Improvements and changes when exporting data from REDCap into SAS
    • Full integration of the Missing Data Code functionality in the SAS data export syntax file to prevent issues when loading data containing Missing Data Codes into SAS.
    • Note: The SAS Pathway Mapper file has been removed and is no longer utilized. Users exporting data to SAS will now need to manually modify the path of the CSV data file in their .SAS syntax file to reflect its locally saved path on the device.
  • Bug fix: If a survey has the "Save & Return Later" option enabled but the "Allow respondents to return and modify completed responses" option is disabled, then if a participant attempts to return to a survey that was taken via a public survey link, then it might cause the participant's web browser to keep redirecting endlessly and thus prevent them from accessing the survey again.
  • Bug fix: When renaming a data collection instrument via the "Choose action" button in the Online Designer, if the instrument being renamed is enabled as a survey, the dialog prompt that asks the user to additionally rename the survey title would mistakenly have the current survey title listed as blank/"" in the dialog text. Also, in very specific cases, renaming the instrument might mistakenly cause it to get mistakenly deleted altogether as an instrument.
  • Bug fix: When creating a new record in a project via a data import (API or Data Import Tool), in which the data being imported should trigger an Automated Survey Invitation (ASI), then for certain multi-arm projects the data import might mistakenly not trigger the ASI to schedule a survey invitation (although the ASI could get triggered later if data were added/modified for that record).
  • Bug fix: If a project is created where the value of "Purpose of Project"->"Other" contains an apostrophe, then it might mistakenly cause the Project Setup page to throw a JavaScript error and thus might prevent some things from working on the page. (Ticket #75179)
  • Bug fix: When copying a project via the Copy Project method, it would mistakenly not copy the Email Display Name value for any Automated Survey Invitations that had been set up for surveys in the project. (Ticket #75641)
  • Bug fix: When deleting and/or replacing an email attachment for an alert on the Alerts & Notifications page, it might mistakenly not remove the existing attachment file.
  • Bug fix: When opening the Compose Survey Invitations popup on the Participant List page, the "Select a previously sent email..." drop-down list in the popup would mistakenly display HTML tags in the drop-down's labels when it should strip out any HTML tags there.

Version 9.5.1 - (released 12/11/2019)

BUG FIXES & OTHER CHANGES:

  • Improvement: When using the Data Resolution Workflow and exporting all data queries in a CSV file, the following attributes are now all exported as their own separate columns in the CSV file: record name, event name, data access group, data quality rule, and field name. In previous versions, some of these attributes existed together in a single column and thus were harder to parse out individually. Additionally, the following columns have been added to the CSV export file: Current Query Status, Time Raised, and Time Resolved. (Ticket #30092)
  • Major bug fix: When clicking the "Remove file" link on a data entry form or survey page when attempting to delete a file or signature for a File Upload field or Signature field, it would mistakenly fail and prevent the user from successfully deleting the file. Bug emerged in v9.5.0. (Ticket #75030)
  • Minor security fix: A Cross-Site Scripting (XSS) vulnerability was discovered, in which a malicious user could potentially exploit it by manipulating the POST request parameters of a specific HTTP request.
  • Bug fix: Some English language on the Alerts & Notifications page was mistakenly not translated in the previous version.
  • Bug fix: In certain situations where the first instrument is a survey and a survey participant completes any given survey in the project, after which they are immediately presented with the Survey Queue, it might mistakenly show some surveys as not being completed in the queue, even when they are or if they have a form status of "Complete" (2). (Ticket #75005)
  • Bug fix: When using the Clinical Data Mart to pull EHR data, it might mistakenly no longer import the ICD-9 or ICD-10 values when importing data for the Problem List. Bug emerged in v9.4.2.
  • Bug fix: Sixteen "Laboratory" fields and their associated LOINC codes were mistakenly missing from the field mapping page for Clinical Data Pull and Clinical Data Mart.
  • Bug fix: When importing data (via API or Data Import Tool) into a non-longitudinal project, in which the imported data contains the redcap_event_name field with a blank value, it would mistakenly keep adding duplicate rows in the redcap_data database table for the record ID field. This would not adversely affect anything in the user interface though. (Ticket #74561)
  • Bug fix: When importing data (via API or Data Import Tool) into a project with repeating instruments and/or repeating events, in which the imported data contains the values belonging to a repeating instance, it would mistakenly keep adding duplicate rows in the redcap_data database table for the record ID field. This would not adversely affect anything in the user interface though. (Ticket #74561)
  • Bug fix: When a user creates a custom data quality rule for a project containing repeating events and/or repeating instruments, in which the instance (e.g., [current-instance], [2]) is not appended to all repeating variables in the logic, it might return duplicate discrepancies, no discrepancies, or discrepancies from the wrong event of a given record. (Ticket #74976)
  • Bug fix: When a user creates a custom data quality rule in a project that is either longitudinal or contains repeating events/instruments, the real-time execution of data quality rules might be very inconsistent or inaccurate depending on whether any event-based or instance-based Smart Variables are used or not used in the data quality rule logic. (Ticket #74036)
  • Bug fix: When Alerts & Notifications are grandfathered in or converted via the Email Alerts external module, Auto-Notify plugin, or some other back-end method, if the Sender's address (the From address) of a given alert is defined as a REDCap field variable (e.g., "[my_from_email]") instead of a literal email address, then while the user interface would allow the variable to be used, it would mistakenly not successfully send the alert's notification email when triggered. (Ticket #75112)
  • Bug fix: If the setting "Auto-suspend users after period of inactivity" is enabled, and some users who are suspended have not had any activity within the designated period of inactivity, then if the user has a sponsor and the user's sponsor puts in a request to have them unsuspended, the user would mistakenly get re-suspended within a day. (Ticket #75231)
  • Bug fix: If a project is created where the value of "Purpose of Project"->"Other" contains an apostrophe, then it might mistakenly cause the Project Setup page to throw a JavaScript error and thus might prevent some things from working on the page. (Ticket #75179)
  • Bug fix: When using the Data Resolution Workflow and exporting all data queries in a CSV file, the record name might not mistakenly not be displayed in the Record column in the CSV file. (Ticket #75215)
  • Bug fix: A JavaScript error was occurring in the function calcChangeCheck(), which gets run for calculated fields are triggered on forms and surveys. (Ticket #75255)
  • Bug fix: If a user is attempting to enable the Twilio telephony services in a project, REDCap will automatically set the URL for Voice/Messaging in the Twilio account via the Twilio API, and it will do so for only the phone number entered into the Twilio phone number field in the Twilio setup dialog on the Project Setup page. But if the phone number field is left blank in the Twilio setup dialog when the Twilio services are being enabled, it would mistakenly set the Voice/Messaging URL for *all* phone numbers associated with that Twilio account. This could overwrite the Twilio configuration of other Twilio phone numbers being utilized in that Twilio account.