Illume Security Update
Date: December 21, 2018
In an effort to ensure our products are up to date with the latest security standards, our supported product versions – DatStat Illume 5.0, 6.0, and 6.1 – recently underwent thorough penetration testing. Based on the results of this testing, our product development team has made a series of updates to resolve any located security vulnerabilities in our offerings. The date these updates will be provided to all customer systems is TBD.
The update to the product line will cause HTML used in Participant Fields, Submission Text Responses, and Piping to render as plain text. Please see below for examples of what will no longer be supported in the product after the security related upgrade occurs.
Input: Participant Fields
Output: Participant List Grids
Before: HTML entered into participant fields rendered in the participant list grid.
Output: Participant Records
Before: HTML entered into participant fields rendered in participant records.
After: HTML entered into participant fields displays as plain text.
After: HTML entered into participant fields displays as plain text.
Input: Q1 Response
Output: Viewing Q1 Submission
Before: HTML entered into submissions rendered when viewing individual submissions.
After: HTML entered into submissions displays as plain text.
Input: Piping
Input: Q1 Response
Output: Data Piping
Before: Piped data containing HTML rendered with the following tags:
- {participantdata}
- {prompt}
- {response}
- {value}
After: Piped HTML displays as plain text.
