Jump to content

Marking a post as solved multiple times artificially boosts solution count


Go to solution Solved by Marc,

Recommended Posts

Posted

To reproduce:

  • Open "mark as solution" in a new tab several times
  • Look at the author's solutions list, and observe that the same post shows up multiple times, and the user's solution count has increased accordingly.

This can be triggered accidentally, eg if the user accidentally clicks the button multiple times or has a network dropout, and could also be exploited by users to quietly artificially boost their solution count.

It happens because in \IPS\Content\Solvable::toggleSolveComment, you don't delete the existing entry from core_solved_index when marking a new post as a solution (though you do clear the solved flag from the existing post). You also don't remove the duplicate notifications.

(This could also be solved with a unique index on core_solved_index on comment_class+item_id.)

Posted

Thank you for your effort first of reviewing the issue, the code, and making a good explanation of what is happening. I've marked this for one of our developers to review this for next steps. Thanks again!

  • 2 weeks later...
Posted

Thank you for bringing this issue to our attention! I can confirm this should be further reviewed and I have logged an internal bug report for our development team to investigate and address as necessary, in a future maintenance release.

 

  • 2 weeks later...
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...