[JhonathanLepidus]

No description provided.

[bozana]

Hi @JhonathanLepidus, thanks, and sorry for the wait!

For the gallery we prefer to add just the newest release per branch rather than the interim builds.
I see there are now newer releases for each branch (0.10.1.0 and 1.9.1.0) that supersede the ones in this PR, plus a new 3.5 release (2.0.1.0). Could you update the PR to point at the latest per branch — and, if you'd like the gallery to carry a 3.5 line, add 2.0.1.0? I'd prefer to bring the newest releases in.

One small thing to flag while you're at it (it applies to the newer releases too): in QuestionnaireHandler, the index, saveQuestionnaire and deleteData actions all validate the per-author token via authorTokenIsValid(), but orcidVerify() doesn't — it associates the ORCID without that check. It'd be good to add the same authorTokenIsValid() guard at the start of orcidVerify() before editing the author.

Thanks a lot!

[bozana]

Hi @JhonathanLepidus, a follow-up to my comment above. We took a closer look at the plugin with Claude, including the newer releases, and found some further points. Some I have just sent as private message.

Two other things to fix:

• Report columns: in ContextReport::writeReport, a missing answer is skipped with continue, so later answers in the row land under the wrong question. Writing an empty cell fixes it.
• Encryption key (0.10.x and 1.9.x): answers are encrypted with the site's api_key_secret. Rotating that secret, a normal step after a leaked API key, silently makes every stored answer unreadable. A key of the plugin's own would avoid that, as 2.x already does.

Smaller things:

• On the member API, the ORCID request asks for /activities/update, but only the iD is used, so /authenticate is enough.
• Emails go out even when no question block is active.
• Redirecting every user to the profile tab might be gentler as a notice.

Thanks!

[JhonathanLepidus]

Hi @bozana

I've just updated the releases sent in this PR with the latest one to each application version, including the release for 3.5.0. These releases fixed some security issues, including the issues you reported.

If there's still something missing, please let us know.

Thanks for the feedback!