To reproduce:

• Open "mark as solution" in a new tab several times
• Look at the author's solutions list, and observe that the same post shows up multiple times, and the user's solution count has increased accordingly.

This can be triggered accidentally, eg if the user accidentally clicks the button multiple times or has a network dropout, and could also be exploited by users to quietly artificially boost their solution count.

It happens because in \IPS\Content\Solvable::toggleSolveComment, you don't delete the existing entry from core_solved_index when marking a new post as a solution (though you do clear the solved flag from the existing post). You also don't remove the duplicate notifications.

(This could also be solved with a unique index on core_solved_index on comment_class+item_id.)

Thank you for your effort first of reviewing the issue, the code, and making a good explanation of what is happening. I've marked this for one of our developers to review this for next steps. Thanks again!

Thank you for bringing this issue to our attention! I can confirm this should be further reviewed and I have logged an internal bug report for our development team to investigate and address as necessary, in a future maintenance release.

 

This issue has been resolved in 4.6.12, which has just been release. Please let us know if you still have any issues once you have upgraded to that release.