Editing a poll clears all votes but not "Cancel your vote" option when not having administer nodes permission

/* 6/8/09 danielhonrade bug report
*
* Hi, I was hacking the poll core module (which is really bad, I know but
* I only have few days to finish the project (http://pinometro.com) , this is temporary anyway, I am
* planning to create a module that would integrate to poll module with the following
* features:
* - use of google chart
* - add default values for choices
* - allow/disallow users to add choices and change other settings
* - require users to vote before commenting and not otherwise
*
* then I encountered this SAME PROBLEM, which I thought at first was the result of
* my hacking but when I installed a fresh Drupal6 and tested the poll again,
* it's still there, you can check the bug by:
* 1) Install fresh Drupal 6
* 2) Allow authenticated users to vote, create/edit/delete own poll
* 3) Login as a new authenticated user and not as admin, so you don't have node administer perm
* 4) Create a poll, then vote and edit then save
* 5) You'll notice that the vote values become 0
* 5) Cancel your vote, the result becomes -1
*
* PROBLEM: if an authenticated user without node administer permission but
* has a permission to edit his/any poll, everytime he edits his poll or
* any poll the vote values become 0 and when he goes to view tab,
* if has voted, the cancel button still exists even though vote values are 0
* so if he decided to cancel, the result is negative value which
* the validator function doesn't even notice
*
* I created a patch, which I am sure, it's not the best, but it works
*
* SOLUTION 1: I added an else statement where I copied the the content in the
* if($admin) {...} and added '#disabled' => 'disabled', and changed
* '#default_value' => $votes, to '#value' => $votes, because if the
* attribute is disabled #default_value doesn't pass its value
*
* SOLUTION 2: I added an else statement where I copied the the content in the
* if($admin) {...} and just change the '#type' => 'textfield', to '#type' => 'hidden',
* but you'll have nothing under the heading VOTE COUNT which is the original
* state when you create a poll in the original poll module
*/

// PATCH, just replace this function with this one
function _poll_choice_form($delta, $value = '', $votes = 0) {
  $admin = user_access('administer nodes');

  $form = array(
    '#tree' => TRUE,
  );

  // We'll manually set the #parents property of these fields so that
  // their values appear in the $form_state['values']['choice'] array.
  $form['chtext'] = array(
    '#type' => 'textfield',
    '#title' => t('Choice @n', array('@n' => ($delta + 1))),
    '#default_value' => $value,
    '#parents' => array('choice', $delta, 'chtext'),
  );

  if ($admin) {
    $form['chvotes'] = array(
      '#type' => 'textfield',
      '#title' => t('Votes for choice @n', array('@n' => ($delta + 1))),
      '#default_value' => $votes,
      '#size' => 5,
      '#maxlength' => 7,
      '#parents' => array('choice', $delta, 'chvotes'),
    );
  } else { // <-- add this (daniel's SOLUTION 1 module patch )
    $form['chvotes'] = array(
      '#type' => 'textfield',
      '#title' => t('Votes for choice @n', array('@n' => ($delta + 1))),
      '#value' => $votes,
      '#size' => 5,
      '#maxlength' => 7,
	'#disabled' => 'disabled',
      '#parents' => array('choice', $delta, 'chvotes'),
    );
  }  // <--patch upto here
  return $form;
}

I am having problems with getting the right diff program. But here is the patch file, anyway

/* Based on the latest Drupal 6.12-dev
* PROBLEM: if an authenticated user without node administer permission but
* has a permission to edit his/any poll, everytime he edits his poll or
* any poll the vote values become 0 and when he goes to view tab,
* if has voted, the cancel button still exists even though vote values are 0
* so if he decided to cancel, the result is negative value which
* the validator function doesn't even notice
*
* I created a patch, which I am sure, it's not the best, but it works
*
* SOLUTION 1: I added an else statement where I copied the the content in the
* if($admin) {...} and added '#disabled' => 'disabled', and changed
* '#default_value' => $votes, to '#value' => $votes, because if the
* attribute is disabled #default_value doesn't pass its value
*
* SOLUTION 2: I added an else statement where I copied the the content in the
* if($admin) {...} and just change the '#type' => 'textfield', to '#type' => 'hidden',
* but you'll have nothing under the heading VOTE COUNT which is the original
* state when you create a poll in the original poll module
*/

313:	  if ($admin) {
314:	    $form['chvotes'] = array(
315:	      '#type' => 'textfield',
316:	      '#title' => t('Votes for choice @n', array('@n' => ($delta + 1))),
317:	      '#default_value' => $votes,
318:	      '#size' => 5,
319:	      '#maxlength' => 7,
320:	      '#parents' => array('choice', $delta, 'chvotes'),
321:	    );
322
323:	  } else { // <-- add this (daniel's solution 1 )
324:	      '#type' => 'textfield',
325:	      '#title' => t('Votes for choice @n', array('@n' => ($delta + 1))),
326:	      '#value' => $votes,
327:	      '#size' => 5,
328:	      '#maxlength' => 7,
329:		  '#disabled' => 'disabled',
330:	      '#parents' => array('choice', $delta, 'chvotes'),
331:	    );
332:	  }  // <--patch upto here

Solution at #3 works for me.

This should also work for 6.12 and 6.12-dev, I just tested it, now when a user edits his poll, it gives him a disabled number of votes which makes sense since he has no administrative privileges to change the number of votes, if he wants to delete his poll, he can also, thanks for testing. Unlike before, when the user edits his poll, they all become zeros and the vote cancel still appears and when he cancels the vote becomes negative 1.

This is still an issue in 6.13. First off, the votes are set back to zero even if you don't change or add any of the vote options. Also, when viewing the poll, if you click the 'Votes' tab, you still get a list of who voted, despite the vote count being zero. Doesn't make any sense to me..

The patch in #3 works ... i think it should be committed.

I have marked #484878: Poll module bug patch as duplicate of this report.

And this is still an issue in 6.14. Solution at #3 works also for me.

Still exists in 6.16.

When you submit a patch, you need to change the status to "needs review" so the test bot will see it.

You also need to see if this happens in D7 as it is unlikely to get fixed otherwise.

I got around this problem with a submit handler:

function fb_form_alter(&$form, $form_state, $form_id) {
  switch ($form_id) {
    case 'poll_node_form':
      $form['buttons']['submit']['#submit'][] = 'fb_poll_vote_refresh';
      return;
  }
}

/**
 * There is a core bug (http://drupal.org/node/362256) when editing a poll.
 * We will recalculate the votes values on submit.
 * One could also reinstate the vote values to the form (see the patch).
 */
function fb_poll_vote_refresh($form, &$form_state) {
  $node = $form['#node'];
  $update = db_query("UPDATE {poll_choices} c, {poll_votes} v SET c.chvotes = (SELECT COUNT(chorder) FROM {poll_votes} WHERE chorder=c.chorder AND nid=%d GROUP BY chorder) WHERE c.chorder=v.chorder AND c.nid=v.nid", $node->nid);
}

Let's try this one.

Arrrggghhh, how do you fix the line endings?

@NancyDru #14

Be carefull, the code of #14 updates all polls with the vote-counts of the current poll!!! We need to only update the current node. Change the WHERE statement to c.nid=%d like this:

function fb_form_alter(&$form, $form_state, $form_id) {
  switch ($form_id) {
    case 'poll_node_form':
      $form['buttons']['submit']['#submit'][] = 'fb_poll_vote_refresh';
      return;
  }
}

/**
* There is a core bug (http://drupal.org/node/362256) when editing a poll.
* We will recalculate the votes values on submit.
* One could also reinstate the vote values to the form (see the patch).
*/
function fb_poll_vote_refresh($form, &$form_state) {
  $node = $form['#node'];
  $update = db_query("UPDATE {poll_choices} c, {poll_votes} v SET c.chvotes = (SELECT COUNT(chorder) FROM {poll_votes} WHERE chorder=c.chorder AND nid=%d GROUP BY chorder) WHERE c.chorder=v.chorder AND c.nid=%d", $node->nid, $node->nid);
}

This code needs to be placed in a custom module in order to work.

I dont feel good in recalculating the number of votes from the chorder. The chid would be much better, but i guess we dont have another choice here, since the chid is not stored in poll_votes.

reroll of poll_362256.patch

what about this?

Nice try on the patches.

I had caught that code error and fixed it, I just didn't come back here and update. But thanks for finding it and telling me any way. Yes, it is in a custom module. No, I don't like the recalculation either; a fix for this problem would be much nicer.

last try...

Thanks for sharing the code, it saved me a couple of hours. I just wanted to help anyone who just copies and pastes the code. I did that and it worked (seemed to) until i realized that all polls had the same number of votes :)

I think its bad design, that the chid gets not saved in the poll_votes table.

...try this

It looks like this is fixed in Drupal 7 - how about just backporting that fix?

http://api.drupal.org/api/function/_poll_choice_form/7

Here's a backport of the D7 approach.

The patch applies fine and fixes the issue - sort of...

Adding another choice after voting works fine - as it doesn't reset all votes to value 0 while giving you the option to cancel. There still is the possibility of a foolish admin messing things up. If you manually change all of the vote values to 0 after editing the poll, you still have the cancel your vote button.

Is that worth fixing, or simply the admin's fault?

@mikestefff - sounds like that situation is a bug not yet addressed in Drupal 7, and I'm not sure what the right behavior is. If the admin changes any vote values (up or down), what does it mean for a user to "cancel" their vote?

@pwolanin - I don't think it's even an issue worth addressing, I just thought I should point it out so everyone is at least aware of the conditions. Otherwise, the patch works and I suggest it's committed. I'm very surprised this has been lingering for the several releases now. I'm not going to change the status of the issue - I'll leave that to you.

Thanks

given this is a straight backport from 7, I hope we are in good shape.

I can't comment on the code itself, as I didn't analyze it. Functionality wise, it works fine.

Backport patch #32 works well. Same problem of clearing votes from non-admin editors.

Committed @pwolanin's backport to Drupal 6. Thanks for all the testing feedback!

Nice. Thanks for clearing this up.

Fabulous, Gábor and Peter. Any ideas when the next 6.x release will arrive?