Voting period (i.e. time after users can vote again) is only applied if site is reloaded. Without reloading, only one vote is allowed and further voting is denied

Jefferson49 / Joomla_extension_sexypolling_reloaded

A Joomla extension for polling with single/multiple voting, adding answers by users, start/end dates, voting periods, and extensive template customizing.

GNU General Public License v3.0

2 stars 3 forks source link

Voting period (i.e. time after users can vote again) is only applied if site is reloaded. Without reloading, only one vote is allowed and further voting is denied #67

Open Jefferson49 opened 1 year ago

Jefferson49 commented 1 year ago

Observed with Joomla 4.4.0 and plugin v4.1.7

Gimopa commented 1 year ago

Hi Jefferson, this check on IP is very weak in my opinion, because if you try to disconnected your device and reconnect it, every time a new IP will be assign at your device, so every device can send many different votes at the same survey in few time. so, also if you set a voting period, it is easly by-passed.

Jefferson49 commented 1 year ago

Yes, I agree. I think we have two different cases:

The vistor is logged in as a Joomla user
The visitor is not logged in

In the first case, sexy_polling will know which user is voting and voting limits or times can be controlled.

In the second case, it is more difficult to control the number of votes etc.. The IP address is almost the only thing, which can be considered. Therefore, sexy_polling uses it knowing that there are easy ways to work around IP addresses.

The second case is an important use case, because it covers "public" votes, where everyone is invited to vote and visitors to the page might be reluctant to log in as users. I have been using public votes for a long time on my own website and it works pretty well.

In general, the administrator can decide which way to go and use the settings in the backend to configure the poll as public or for logged in users. Both is equally possible.

RobertBrachfeld commented 1 year ago

How can I disabel voting period for tests?

Jefferson49 commented 1 year ago

How can I disabel voting period for tests?

Voting period is defined as the period of time (calculated in hours) after which users can vote on this poll again. If 0, users can vote on this poll only once. If 0.5, they can vote every 30 minutes. If 1, they can vote once an hour. If 24, once a day.

Therefore, you can disable voting period by setting it to 0.

You can get this information, if you move the mouse over the text "Voting Period".

RobertBrachfeld commented 1 year ago

How can I disabel voting period for tests?

Disable voting period by setting it to 0.

It doesn't work, when 0 user only can make 1 vote.

Jefferson49 commented 1 year ago

How can I disable voting period for tests?

For testing, you can reduce the time between votes by using a very small value for the voting period, e.g. 0.0001

Jefferson49 commented 1 year ago

Additional hint: You have to reload the Joomla site after each vote. Afterwards you can vote again (after vote period)

RobertBrachfeld commented 1 year ago

Sorry it doesn't work.

Jefferson49 commented 1 year ago

Sorry it doesn't work.

Can you describe in more detail: Which values did you choose for the following settings?

Voting Period
Max votes per logged in user or IP
Voting Permission

What voitng did you perform and what were the results?

If you have chosen a value for "Max votes per logged in user or IP", you might also have reached the maximum number of votes and the vote is not permitted. Check IP address and user in the "votes" page in the backend.

RobertBrachfeld commented 1 year ago

voting period=0 Max votes per logged in user or IP=10 Voting Permission=public You can check on my website: https://live.web-komp.eu/diamantbericht/

Jefferson49 commented 1 year ago

Bei voting period=0 ist nur eine einzige Abstimmung möglich (siehe Beschreibung im Backendd: "If 0, users can vote on this poll only once"). Um einen kleinen Wert für den Abstand zwischen Abstimmungen einzustellen, kann man einen kleinen Dezimalwert z.B. 0.0001 nehmen (mit englischem Punkt für Komma).

Voting Permission=public erlaubt eine öffentliche Abstimmung ohne eingeloggte User. In diesem Fall werden die IP-Adressen bei Abstimmungen ausgewertet. Max votes per logged in user or IP=10 bedeutet dann, dass maximal 10 Stimmen von einer IP-Adresse abgegeben werden können.

Man kann die bereits abgegebenen Stimmen im Backend unter "Stimmen" ansehen. In der Spalte "IP" kann die IP-Adresse eingesehen werden. Wenn 10 oder mehr Einträge mit der aktuellen IP-Adresse vorliegen, dann wird die Abstimmung gesperrt.

Jefferson49 commented 6 days ago

Summary of further analysis:

JavaScript prevents second vote by adding the class "voted_button" to the CSS
If the voted button has the class "voted_button", further voting is replied with an alert message
In the AJAX methods voteAjax and addAnswerAjax, only the current vote is checked. Allowance for further voting is not checked.
Full checking if voting is enabled is performed in the render_html method
After voting, the module is not rendered once again. Therefore, only the JavaScript "voted_button" will have its effect (and show an alert message). General voting permission (from render_html) ist not checked again
As an overall consequence, the user can only vote once. Only after reloading the site, further voting is possible
There is no simple solution to change this overall behavior
Blocking of further voting (without reloading) can also be seen as a measure against spamming
The purpose for further voting (in the current implementation) is to vote again during the next visit of the site. Also refer to the, default value for "Voting Period" in the backend: 24 hours.