HomePhabricator

Prevent users from voting for invalid Slowvote options

Description

Prevent users from voting for invalid Slowvote options

Summary:
Depends on D19773. See https://hackerone.com/reports/434116. You can currently vote for invalid options by submitting, e.g., vote[]=12345.

By doing this, you can see the responses, which is sort of theoretically a security problem? This is definitely a bug, regardless.

Instead, only allow users to vote for options which are actually part of the poll.

Test Plan:

  • Tried to vote for invalid options by editing the form to vote[]=12345 (got error).
  • Tried to vote for invalid options by editing the radio buttons on a plurality poll into checkboxes, checking multiple boxes, and submitting (got error).
  • Voted in approval and plurality polls the right way, from the main web UI and from the embed ({V...}) UI.

Reviewers: amckinley

Reviewed By: amckinley

Differential Revision: https://secure.phabricator.com/D19774

Details

Provenance
epriestleyAuthored on Nov 5 2018, 6:19 PM
epriestleyPushed on Nov 6 2018, 5:21 PM
Reviewer
amckinley
Differential Revision
D19774: Prevent users from voting for invalid Slowvote options
Parents
rP5e1d94f33651: Remove nonfunctional AJAX embed behavior for Slowvote
Branches
Unknown
Tags
Unknown
Build Status
Buildable 21089
Build 28659: Run Core Tests