Yaw Anokwa

@issa-tseng An attacker could put ODK cloud or forum or whatever credentials here in the outside frame and claim it will enable some better functionality. @florianm What I've used in...

Thanks for the responsible disclosure. We do not have a bounty program. We will resolve this issue in due time.

According to @smoyth... > I'm pretty sure the previous level was zero. This is a newer addition to Sinatra. The rack-protection gem did not exist in the project prior to...

And here I thought the validation was not strict enough. I'm open to making the regex `http://[.]`, but what are you proposing when you say you want to make the...

@danielsteward Thanks for the great detective work! @mitchellsundt @wbrunette Is it true that Aggregate can only handle JPGs? I'd love some insight as to why that is the case and...

@mitchellsundt Collect doesn't have restrictions on file types, but it does rename any image to jpg before uploading. https://github.com/opendatakit/collect/blob/master/collect_app/src/main/java/org/odk/collect/android/activities/FormEntryActivity.java#L656 is the relevant line of code. This is bad behavior on...

@kusaasira @mathieubossaert Agreed that easier access to images on Aggregate would be a nice thing, but it's not relevant to this issue. If you'd like to see this discussed, please...

It might be time to take this on. It's no fun to catch issues when doing a release.

Given that this is a niche device and selfies are a niche feature, I don't think it's worth it to keep investigating. @seadowg is there a way we can detect...

saveIncomplete was added because a user needed to save incomplete at a particular point in the form before launching an external widget that needed to read form data. See https://forum.opendatakit.org/t/best-way-to-extend-xlsform/3416....