i have a content type (review) to vote on one node. anonymous users can vote. i notice that if i delete one review node created by anonymous user, all votes by anonymous users are deleted from votingapi_vote table. i guess the sql statement uses "where nid=0" instead of "where nid=0 and hostname like 'xxxxx"

Is this a bug from fivestar or from voting_api module? I apologize if i did post it in a wrong place.


#6 fivestar_anonymous_check.patch1.45 KBquicksketch


quicksketch’s picture

You'll need to upgrade to the latest version of Fivestar to see if this is still a bug in the latest release. It should delete only that single anonymous vote, as per this query from Fivestar:

"SELECT vote_id FROM {votingapi_vote} WHERE content_type='%s' AND content_id=%d AND value_type='percent' AND uid=%d AND tag = '%s' AND hostname='%s'"
xqi’s picture

quicksketch, thanks for the reply.

I am using the latest release of fivestar and votingapi.

i think the deletion happens in the following code when calling votingapi function votingapi_unset_vote. which really should pass the hostname as a parameter. it seems to me votingapi and fivestar need collaborate to have this bug fixed.

function fivestar_field($op, &$node, $field, &$items, $teaser, $page) {
  case 'delete':
      foreach ($items as $delta => $item) {
        if ($field['dynamic_target'] && !empty($node->$field['dynamic_target'])) {
          $items[$delta]['target'] = $node->$field['dynamic_target'];
        elseif (is_numeric($item['target'])) {
          $items[$delta]['target'] = $item['target'];
        elseif ($field['php'] && strpos($item['target'], '<?php') === 0) {
          // Use eval rather than drupal_eval to allow access to local variables.
          $items[$delta]['target'] = eval('

'. $item['target']);
if (is_numeric($items[$delta]['target'])) {
votingapi_unset_vote('node', $items[$delta]['target'], $node->uid);


function votingapi_unset_vote($content_type, $content_id, $uid = NULL) {
  if ($uid == NULL) {
    global $user;
    $uid = $user->uid;

  $votes = votingapi_get_user_votes($content_type, $content_id, $uid);
  foreach ($votes as $vobj) {

  if (variable_get('votingapi_calculation_schedule', 'immediate') != 'cron') {
    return votingapi_recalculate_results($content_type, $content_id);
quicksketch’s picture

The code you pointed out is from the Fivestar CCK implementation, I was assuming you were using normal comments. Are you indeed using CCK for your reviews? That'd help me understand where this problem is located.

xqi’s picture

yes, i use fivestar as a cck field in my node type "review".

xqi’s picture


quicksketch’s picture

Version: 5.x-1.9 » 5.x-1.13
Status: Active » Fixed
1.45 KB

I finally got to looking at this problem, it's Drupal 5 specific as VotingAPI in Drupal 6 handles this logic for us. Fivestar was only adding the hostname to the queue when a $uid was not being passed in. However, in the case of node-based reviews, the UID was always being passed in, since the UID is not the current user, but the UID of the node author. This patch should fix the problem, and I've already committed it.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.