Problem/Motivation

There is no validation of the allowed values.

Proposed resolution

Validate whether a value is allowed for a given vote type.

CommentFileSizeAuthor
#2 rate-3069973-2.patch1.09 KBKrzysztof Domański
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Krzysztof Domański created an issue. See original summary.

Krzysztof Domański’s picture

Krzysztof Domański
Location Poland
CreditAttribution: Krzysztof Domański at abventor commented
Status: Active » Needs review
FileSize
rate-3069973-2.patch1.09 KB

Krzysztof Domański’s picture

Krzysztof Domański
Location Poland
CreditAttribution: Krzysztof Domański at abventor commented
Status: Needs review » Fixed
JordiK’s picture

JordiK CreditAttribution: JordiK commented

Why is this necessary?
If, for example, someone has a custom widget based on Yes/No and wants to vote with custom steps, e.g. 5, this validation kills the possibility.
Is there any security or other implication for the values to be limited this way?

JordiK’s picture

JordiK CreditAttribution: JordiK commented
Status: Fixed » Postponed (maintainer needs more info)
Krzysztof Domański’s picture

Krzysztof Domański
Location Poland
CreditAttribution: Krzysztof Domański at abventor commented

Users can manipulate voting results. For example, vote for 500 or -200 is possible.

Is there another way to solve this problem?

JordiK’s picture

JordiK CreditAttribution: JordiK commented

Put a maximum allowed value in the configuration of the widget, for example. If omitted - no limit.
Or disabling right click on the widget.
But hardcoding it is not a good idea imho.

Krzysztof Domański’s picture

Krzysztof Domański
Location Poland
CreditAttribution: Krzysztof Domański at abventor commented
Status: Postponed (maintainer needs more info) » Needs work