Just wondering how the vote-once feature of the forum is implemented (just in general terms).  Is it possible for someone to try to vote more than once, even when you set the poll to allow only one vote per user?  I'm guessing this is implemented through cookies, but can this be bypassed?

(No need for specifics, just a Yes or No would be sufficient.  Thanks)

yes it can, all you need to do is delete your cookies and wait until somebody else votes or change your IP (only the last voter's IP is stored in the db) and you can vote as many times as you wish a solution to that would be to store all the votes on a database but you would have to set an expiration date on the poll and have the vote entries deleted from the database once the poll has expired, otherwise the db will get too big and it'll slow down your forum...

Thanks for the responses.

Just looked through the source code and have to agree with fernan82, it can be bypassed by someone who knows the code, or spends a little time experimenting.  Wonder if borg would consider adding a "strict" enforcement option of vote-once for polls, where IDs of voters are stored per poll.  That way you can choose to place the "important" polls under strict enforcement. 

OK...figure borg is too busy to worry about this, so I tried to make a couple of modifications.  Tested with latest version 7.01 using Access 2000, but should work on 2002 and SQL as well.  Requires some knowledge of Access databases.

Objective: When the vote-once option is checked, this will be "strictly" enforced, not through the use of cookies (which the forums currently used), but through the use of server-stored voters' IDs.  As borg indicates in another post, this may slow down your forum if there are many (in the thousands) voters.  However, this will ensure that each registered user only votes once.  Of course, some one could sign up as multiple users, but the email restrictions could prevent that.  It's highly recommended that you backup your forum and database before attempting this.

1.  Open the forum database in Access, then open the tblPoll table

2.  Add a memo field called "Vote_IDs".  Set Required to No and Allow Zero Length to Yes.

3. Replace the "poll_cast_vote.asp" in the forum directory and "poll_display_inc.asp" in the includes directory with the files below:

http://www.allersoft.com/wwf/poll_mod_701.zip - http://www.allersoft.com/wwf/poll_mod_701.zip

Then, you're all set.

Note that if your poll is open to "unregistered user", i.e., guests, cookies will be used to enforce single-vote, since all guests have the same ID, 2.

Should also add that for existing polls, the restriction will be applied to new voters only, i.e., if you make these changes, those who already voted CAN vote again, however, new voters will be able to vote only once.

I think borg mentioned that he wouldn't implement that cuz of the performance issue.........what i've been thinking and i'm planning to do when i get time (unless someone does it first) is mod it so the user who creates the poll can set an expiration date for the poll, that way when the poll expires the voters IDs can be deleted off the db automatically. That's the way vBulletin works and I like it that way...... i tried to get -Borg- to implement that but he didn't agreed with me....

Sounds like a good idea.  For my forums I restrict poll-creating ability to administrators only.  The voter IDs memo field could hold unlimited data.  Say one thousand voters, each ID (assuming 4 digit max, that's for a forum with up to 9999 users) takes up to 5 bytes (4 digits plus the ampersand separator), so one thousand voter IDs take 5 KB, not a huge storage/processing cost.  My implementation is somewhat "quick-and-dirty" so database cleanup is not a big priority.  But if someone could make such a mod with database cleanup, that'd be great!

I agree with ljamal, the use of a separate table with fixed-size records would probably be faster than the use of a variable-size memo field.  This method would be slightly more involved, since you'd need to create an additional table.  If you're comfortable with Access databases, following is another method that can assuredly prevent multiple votes.  This has been tested on v7.01, Access 2000 but should work with Access 2002 as well

1.  Open your forum database in Access, then add an empty table called 'tblVotes' with the following fields & attributes:

Field               Attributes

Vote_ID:     AutoNumber, Indexed with no duplicates.  Set this as the primary key.

Poll_ID:       Number (long integer)

Author_ID:   Number (long integer)

Save & upload your database to your server

2.  Download http://www.allersoft.com/wwf/poll_mod_701_v2.zip - http://www.allersoft.com/wwf/poll_mod_701_v2.zip .  Replace poll_cast_vote.asp in the forum directory and poll_display_inc.asp in the includes directory with the provided files.

That's it.  This method on average will require slightly more space than the method I described in the previous post, but should be faster.  If borg decides to implement a more rigorous vote-once option, this (or something similar) is probably what he'll use.  Thanks borg for a great forum

P.S.  There's no provision for deleting the vote records, that would involve mod to the admin panel which I'll leave to borg or a more motivated mod-builder, but you can manually delete the vote records periodically.

Well...who am I to argue with a mod-builder...

A quick disclaimer: my original intention was to make a couple of quick modifications since I'm gonna do a couple of polls that require strick enforcement of the vote-once option.  Since I'm restricting poll-making ability to mods/admin, database size/cleanup was not a big issue.  Plus I could manually control the size of the vote records.

That being said, if someone decides to do a "full" implementation, a couple of suggestions:

1.  Give select groups of users (mods/administrators) the ability to create polls that use "strict" enforcement, i.e., through database-stored voter IDs instead of cookies.  Non-mod/non-admin could be limited to creating polls that enforce through cookies only.  This way the database is not filled with voter records for "trivial" polls.

2.  As fernan82 indicated, the database cleanup operation could take place when the poll is displayed, but it could also be implemented through a "Removed expired vote records" in the admin panel, so the database cleanup can be done at one setting; that might reduce database fragmentation (and save the server one extra database query every time the poll is displayed).

OK Dokey...have fun

Well I finally finished it!

I made the mod so you can set an expiration date on the polls and on the admin section you can set it to automatically delete the votes once the poll expires or to display a link to admins on the poll once it has expired to delete the votes, it also deletes the votes if the poll ever gets deleted before it expires.....

read about it and download it here: http://forums.webwiz.net/forum_posts.asp?TID=2808&PN=1&TPN=1 - http://forums.webwiz.net/forum_posts.asp?TID=2808&PN=1&TPN=1

exile2003 wrote: OK...figure borg is too busy to worry about this, so I tried to make a couple of modifications.  Tested with latest version 7.01 using Access 2000, but should work on 2002 and SQL as well.  Requires some knowledge of Access databases. Objective: When the vote-once option is checked, this will be "strictly" enforced, not through the use of cookies (which the forums currently used), but through the use of server-stored voters' IDs.  As borg indicates in another post, this may slow down your forum if there are many (in the thousands) voters.  However, this will ensure that each registered user only votes once.  Of course, some one could sign up as multiple users, but the email restrictions could prevent that.  It's highly recommended that you backup your forum and database before attempting this. 1.  Open the forum database in Access, then open the tblPoll table 2.  Add a memo field called "Vote_IDs".  Set Required to No and Allow Zero Length to Yes. 3. Replace the "poll_cast_vote.asp" in the forum directory and "poll_display_inc.asp" in the includes directory with the files below: http://www.allersoft.com/wwf/poll_mod_701.zip - http://www.allersoft.com/wwf/poll_mod_701.zip Then, you're all set. Note that if your poll is open to "unregistered user", i.e., guests, cookies will be used to enforce single-vote, since all guests have the same ID, 2. Should also add that for existing polls, the restriction will be applied to new voters only, i.e., if you make these changes, those who already voted CAN vote again, however, new voters will be able to vote only once.

MOD NOT WORK FOR ME I GET ERROR!!!!!!!!!!!

Hum.... i really need this to work as it should, also...

I mean, if the Poll choice says "Vote only once" it should work like that, independantly of cookies, or expiration times.

and the mod about the expiration date on the polls doesn't solve the problem, it only takes care of the database size increasement, but doesn't actually solve the problem... which is MULTI-VOTING..

I'm thinking about bringing this to the suggestions forum, and hope -borg- implements it... after all, it doesn't work as supposed.

Supremo wrote: and the mod about the expiration date on the polls doesn't solve the problem, it only takes care of the database size increasement, but doesn't actually solve the problem... which is MULTI-VOTING..

well the only way to prevent multi-voting is by storing the users that have voted on a database and check that the user hasn't voted before allowing him/her to vote so the mod does resolve the multi-voting problem.........................

fernan82 wrote: Supremo wrote: and the mod about the expiration date on the polls doesn't solve the problem, it only takes care of the database size increasement, but doesn't actually solve the problem... which is MULTI-VOTING.. well the only way to prevent multi-voting is by storing the users that have voted on a database and check that the user hasn't voted before allowing him/her to vote so the mod does resolve the multi-voting problem.........................

Sorry if i misunderstood... let me see if i got it straight.

The user who makes the poll, sets an expiration date on it, then, every voter can vote there once, and won't be able to do it again until the expiration date timeouts, and when that happens, the users won't be able to vote anyway, cause the poll gets deleted... is that it ?

Sorry for the trouble.

Supremo wrote: fernan82 wrote: Supremo wrote: and the mod about the expiration date on the polls doesn't solve the problem, it only takes care of the database size increasement, but doesn't actually solve the problem... which is MULTI-VOTING.. well the only way to prevent multi-voting is by storing the users that have voted on a database and check that the user hasn't voted before allowing him/her to vote so the mod does resolve the multi-voting problem......................... Sorry if i misunderstood... let me see if i got it straight. The user who makes the poll, sets an expiration date on it, then, every voter can vote there once, and won't be able to do it again until the expiration date timeouts, and when that happens, the users won't be able to vote anyway, cause the poll gets deleted... is that it ? Sorry for the trouble.

Kind of like that but the poll doesn't get deleted once it expires, just the votes are deleted off the db and nobody else can vote after the poll has expired, but the poll stays there, just nobody can vote on it after it has expired...

Also changing the options on the expiration date is as simple as changing the HTML on the form...

The only difference the users will notice is that they won't be able to vote on polls once it has expired, instead they'll get a message saying that the poll has expired...

maybe i should also add a text string on poll_display_inc.asp so it shows the expiration date on the poll...

Thx a lot fernan82, i think this MOD solves my problem yes... i'm gonna set it up this week, along with some toehr stuff.

again, thx

Thanks for the mod, fernan82.

Everything works great, however, one potential problem, if the polls are left on "auto-pilot" with automatic deletion of expired votes is that if the poll never get accessed on or beyond its expiration date, the associated votes will never be deleted.  Otherwise, great code!

exile2003 wrote: Thanks for the mod, fernan82. Everything works great, however, one potential problem, if the polls are left on "auto-pilot" with automatic deletion of expired votes is that if the poll never get accessed on or beyond its expiration date, the associated votes will never be deleted.  Otherwise, great code!

I guess i can make a script to delete the votes of all expired polls and add it to the admin section when i get time, that would be a possible solution to that problem...