Anonymous users - Multiple voting from one IP

Created on 19 September 2017, about 7 years ago
Updated 18 January 2023, almost 2 years ago

Problem/Motivation

Currently, the poll module allows only one anonymous vote for a poll per IP address. There are use cases where this restriction isn't desired. For example when a group of people, who are on the same network, are asked to vote on the poll.

Steps to reproduce

  1. Create a poll.
  2. Log out.
  3. Place a vote on the poll.
  4. Open an other browser or go to the poll with an other device.

You see only the poll results and cannot vote again.

Proposed resolution

On the poll creation form, add an option to change the restriction mode for anonymous users.

Allow the following restriction methods:

  • One vote per IP
    This is the default option and follows the current behavior. If an anonymous user places a vote, he/she cannot vote again: not in an other browser, not when clearing cookies and not even on an other device in the same network. He/she can however place another vote when switching his/her device to an other network.
  • One vote per session
    When an anonymous user places a vote, he/she cannot vote again during the current session. He/she can vote again when using an other browser, when clearing cookies or when using an other device in the same network. He/she can't however place another vote when only switching networks.
  • Unlimited votes
    There are no restrictions on how many votes the same anonymous user can place. After voting, he/she can go back to the voting form to place another vote. Can be useful in a situation where a group of people need to place a vote on the same device, for example at a stand in an exhibition hall.
    This option has no effect on authenticated users, they continue to only be able to vote once per poll.

Remaining tasks

  • Fix the test failures for the vote restriction option "unlimited".
  • Review

User interface changes

On the poll creation form, a setting called "Anonymous vote restriction" is added. This setting is only visible when enabling the option "Allow anonymous votes".

API changes

  • Constants are added to PollInterface for each vote restriction.
  • A method called getVoteRestriction() is added to PollInterface.
  • When calling the method saveVote() on PollVoteStorage, the ID of the saved vote gets returned. Previously, the method returned nothing.

Data model changes

  • The table "poll_vote" gets a new column called "id". This also becomes the new primary key. This is needed because multiple votes can now exist per combination of poll ID, user ID and hostname (which previously formed the primary key).
  • The content entity type "poll" gets a new base field called "anonymous_vote_restriction". In this field, the setting for the vote restriction is stored.

Release notes snippet

📌 Task
Status

Needs review

Version

1.0

Component

Code

Created by

🇺🇦Ukraine stomusic Ukraine

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇺🇸United States fozzieblue

    I'm not able to update the poll module to 1.5 or 1.6.

    My Drupal site is running the following:
    - poll module 8.x-1.4
    - Drupal 9.5.8
    - I am using patch #35 from this issue.

    When I run `composer update drupal/poll` I get the following error:

    Could not apply patch! Skipping. The error was: Cannot apply patch https://www.drupal.org/files/issues/2020-10-21/poll-unlimited-votes-2909811-35.patch
    [Exception]                                                                                        
    Cannot apply patch Anonymous users - Multiple voting from one IP (https://www.drupal.org/files/issues/2020-10-21/poll-unlimited-votes-2909811-35.patch)!  

    I removed the patch and was able to update the poll module to 8.x-1.6. But updating with out the patch in #35, the poll module no longer allows multiple votes from the same IP.

    Is anyone else able to update poll to 8.x-1.6 and still use patch #35?

  • 🇬🇧United Kingdom naheemsays

    Can an alternative approach be to differentiate by mac address?

    I dont think it is as common for different devices from the same IP address to be shared between multiple users as much as it was say 10 years ago, so if we still want to try and differentiate voters, it may be reasonable to look at distinguishing based on something other than IP address.

  • Assigned to BramDriesen
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    Using this for a long time on a few projects. Would love to incorporate this on the new 2.0.x release.

    Re #44: Not sure, I think the main thing used is still IP's. E.g. we still have the IP ban module, CDN's like CloudFlare offer IP bans but not Mac address bans.

  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    Ready for review once more.

    Also updating credits for everyone who actively (and meaningful) participated on this issue for the last 6 years 🙈.

  • Issue was unassigned.
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪
  • ivnish Kazakhstan

    Needs reroll

    error: patch failed: src/Form/PollViewForm.php:247
    error: src/Form/PollViewForm.php: patch does not apply
    error: patch failed: src/Form/PollViewForm.php:204
    error: src/Form/PollViewForm.php: patch does not apply

  • Status changed to Needs work 8 months ago
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪

    Thanks @Berdir! This also needs a rebase now and a change in ID for the install/update hook

  • First commit to issue fork.
  • Pipeline finished with Failed
    7 months ago
    Total: 191s
    #162480
  • Pipeline finished with Failed
    7 months ago
    Total: 224s
    #162495
  • 🇧🇪Belgium cgoffin

    I rebased the changes from the dev branch. Here also an up to date patch.

  • 🇧🇪Belgium cgoffin

    There was a missing newline at the end of the patch file. Here the new version.

  • 🇺🇦Ukraine lobodacyril

    #54 patch stopped working after last updates on dev branch.

  • First commit to issue fork.
  • Pipeline finished with Failed
    2 months ago
    Total: 192s
    #274675
  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪
  • 🇧🇪Belgium Ozmodiar

    Rerolled patch against latest 2.0.x

  • 🇧🇪Belgium Ozmodiar

    The patch in #58 does not work as it adds a 8003 updatehook while in 2.0.x updatehook 8003 already exists for something else... Simply changing the one from the patch to 8007 exposes the problem Bram mentioned above (the updatehook is not idempotent).

  • Pipeline finished with Failed
    29 days ago
    Total: 204s
    #312597
  • 🇧🇪Belgium Ozmodiar

    Reroll against 2.0.x with the idempotent update hook. This should be safe to use if you have already used an earlier version of this patch in your project.

  • 🇧🇪Belgium BramDriesen Belgium 🇧🇪
  • 🇮🇳India drupalite1411

    Used patch #61, it is providing option from UI to select if per IP vote,per session vote and unlimited vote.
    I select any option and save the form. When I edit the form the select field does retain it's value. Moreover, the functionality is not working.
    I can't give unlimited vote.

  • 🇮🇳India drupalite1411

    Updated. In the patch #61, removed this repetitive code from poll.php and vote per session functionality is working fine now. I am still testing

      $fields['anonymous_vote_restriction'] = BaseFieldDefinition::create('list_string')
          ->setLabel(t('Anonymous vote restriction'))
          ->setSetting('allowed_values', [
            'ip' => t('One vote per IP'),
            'session' => t('One vote per session'),
            'unlimited' => t('Unlimited votes'),
          ])
          ->setDefaultValue('ip')
          ->setRequired(TRUE)
          ->setDisplayOptions('form', [
            'type' => 'options_select',
            'settings' => [
              'display_label' => TRUE,
            ],
            'weight' => 2,
          ])
          ->setDisplayConfigurable('form', TRUE);

    I found it is actually removed from the merge request https://git.drupalcode.org/project/poll/-/merge_requests/30/diffs?commit...

Production build 0.71.5 2024