humanmade / comment-popularity

Allow visitors to vote on comments
MIT License
25 stars 15 forks source link

Bug that allows a single user to vote infinite times; fix in description #112

Open fredclaymeyer opened 7 years ago

fredclaymeyer commented 7 years ago

Hi guys, I'm using Comment Popularity with nonlogged-in voting, and I found a bug that lets a single user "walk up" or "walk down" the votes on any comment to any arbitrary number. The first 38 seconds of this video demo the problem, and seconds 38 and onward show how the plugin should function.

https://www.youtube.com/watch?v=32J3Oa6RaFA

I got the correct behavior by inserting an elseif statement inside the section commented with "see if user has already voted" around line 615 in class-comment-popularity.php:

if ( 'undo' === $labels [ $vote ] ) {
    // undo the previous action
    $this->get_visitor()->unlog_vote( $comment_id, $last_action );

    $vote_value = ( 'upvote' === $last_action ) ? $this->get_vote_value( 'downvote' ) : $this->get_vote_value( 'upvote' );
} elseif ( ( 'upvote' === $last_action && 'downvote' === $labels [ $vote ] ) || ( 'downvote' === $last_action && 'upvote' === $labels [ $vote ] ) ) {
    // TO STOP CRAWL UP
    $vote_value = $vote_value * 2;
}

It's crude, so I'm sure you can do something that integrates more gracefully.