First, this is a very cool module. I like it alot and it works very well EXCEPT for message limitations. When I limit users to 1, 5, 10 etc. messages per hour...it does not work. How can I fix this?

Incidentally, is there an email address limitation? I see I can send to/input multiple email addresses, either on a comma separated list or each on a new line, and send pages. But, if there are no email address limitations, someone could put a list of 10,000 addresses in the input box and crush my system. Am I missing something obvious? Thanks again for a cool module.

cheers,

larry

Comments

seanr’s picture

seanr
he/him
commented

Are you sending the messages while logged in as user/1? The main admin account is excluded from the flood control to allow for testing. Please test this as another user and let me know if the flood control mechanism works as expected.

larry’s picture

larry commented

Thanks for your quick response. Yes, I thought of this. I tested it as both a registered non-admin user and as an anonymous user, with the appropriate permissions given. In both cases, the limitation did not work.

cheers,

larry

seanr’s picture

seanr
he/him
commented
Priority: Normal » Critical

OK, marking this critical then, since this is a potential spam issue. I'll look into it and get back to you.

seanr’s picture

seanr
he/him
commented

I realized it's not just user/1 which bypasses the flood check - it's any user with 'administer forward' permissions. I've also tried changing the code for the check a bit. Try it with a user that does not have that permission and let me know if the floodcheck is still getting bypassed.

larry’s picture

larry commented

I'm currently giving this module a good go-through with 4.7.2. I'll let you know how it all works. Thanks for looking into this.

cheers,

larry

chromeyellow’s picture

chromeyellow commented

I think the problem is here (@line 258): 

<?php
if (!flood_is_allowed('contact', variable_get('forward_flood_control', 10))) {
    $output = t(variable_get('forward_flood_error', "You can't send more than %number messages per hour. Please try again later."), array('%number' => variable_get('forward_flood_control', 10)));
  }
?>

Looks like the flood_is_allowed check is testing against the contact module's history, rather than the forward module. Changing 'contact' to 'forward' should fix this, assuming the rest of the code is right...

seanr’s picture

seanr
he/him
commented
Status: Active » Fixed

Thank you very much!! I kept looking and looking and looking and never did see that. LOL! Fixed in DRUPAL-4-7 and HEAD.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)