1. set the appropriate rules - you can post only 1 story node in 24 hours
2. login as auth user, and node/add/story
3. fill in the fields and submit.
4. click on "back" button of browser, and the node/add/story form will appear
5. change the fields as you wish, and submit again : voila ! you can post like that billion times.

How we can act on such behavior ?

I also created the rule "Content is going to be saved" to check node limit number, but still you can replicate the bug.

Comments

jdwfly’s picture

Title: Bug abusing » Users can still create nodes by using the back button
Version: 6.x-2.0-alpha2 » 6.x-2.x-dev
Priority: Critical » Normal

working on...

jdwfly’s picture

Priority: Normal » Critical

Bringing back up to critical since I just was able to replicate this bug. Will be working on a fix soon.

jdwfly’s picture

Status: Active » Fixed

After making some other changes I think this got fixed. I can't replicate this error with the latest from cvs.

vertazzar’s picture

thanks!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

zdean’s picture

Status: Closed (fixed) » Active

I'm reopening because I think what I'm experiencing is the same issue.

On my site I have a content type "File".

I've embedded the node create form in a block and placed it in the right column of a page. I did this so that when a person is on that particular page, they can create a "File" without having to go to a different page to do so.

I've created a rule with a limit on the number of nodes that can be created. The rule has 2 actions on execution:

1. redirect to the page that contains the block with the embedded node create form
2. display a message that the limit has been reached.

It does everything that it's supposed to. However, when the redirect happens, you are still able to fill out the create node form in the block...when you click "save", the rule brings you back to the page and displays the message and the content type "File" gets saved.

So, I'm wondering if this is an issue with the module or if the special circumstance of the content creation form being embedded in the block makes it impossible to use the module.

Thanks for your help!

jdwfly’s picture

Status: Active » Closed (fixed)

Your issue is different than the one in this issue. Create a new issue.

ermannob’s picture

Version: 6.x-2.x-dev » 6.x-2.0-beta2
Priority: Critical » Normal
Status: Closed (fixed) » Active

I can still create nodes with the back button trick.
I'm using the example rule, modified for my content type. I get the error message and the redirection, but a new node is created and saved.

Can you confirm this bug is fixed? Am I doing something wrong with rules?

Thank you.

ermannob’s picture

Status: Active » Closed (fixed)

Yeah, I'm doing something wrong with the rule! :(

The action "Redirect to a page" needs the flag "Immediately issue the page redirect".

Sorry for reopening and reclosing.

biswajeetparida’s picture

Issue summary: View changes

Sorry to ask but could you tell me how you fix this. I am facing the exact problem.