Page MenuHomePhabricator

Prevent users from voting for invalid Slowvote options
ClosedPublic

Authored by epriestley on Nov 5 2018, 6:23 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 19, 3:42 PM
Unknown Object (File)
Tue, Mar 19, 3:41 PM
Unknown Object (File)
Tue, Mar 19, 3:41 PM
Unknown Object (File)
Tue, Mar 12, 1:13 PM
Unknown Object (File)
Feb 26 2024, 6:12 PM
Unknown Object (File)
Feb 1 2024, 11:40 PM
Unknown Object (File)
Jan 22 2024, 9:01 PM
Unknown Object (File)
Dec 27 2023, 8:12 PM
Subscribers
None

Details

Summary

Depends on D19773. See https://hackerone.com/reports/434116. You can currently vote for invalid options by submitting, e.g., vote[]=12345.

By doing this, you can see the responses, which is sort of theoretically a security problem? This is definitely a bug, regardless.

Instead, only allow users to vote for options which are actually part of the poll.

Test Plan
  • Tried to vote for invalid options by editing the form to vote[]=12345 (got error).
  • Tried to vote for invalid options by editing the radio buttons on a plurality poll into checkboxes, checking multiple boxes, and submitting (got error).
  • Voted in approval and plurality polls the right way, from the main web UI and from the embed ({V...}) UI.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable