Allow multiple votes from anonymous users on a shared IP address

The new anonymous voting mechanism in version 2.x of VotingAPI should be more flexible in this regard. For more specific needs, manually populating the votes in question will bypass VotingAPI's normal behavior.

Eaton, can you elaborate a little on what new mechanisms are in place in version 2 of VotingAPI? Is it possible to use cookies now instead of IP Address for instance?

By default, it operates on IP addresses. However, if you're casting votes manually you can specify anything in the vote's own 'vote_source' column. That will be used later for matching if a valid user id isn't available (IE, the user is an anonymous voter)

Drupal 6 is no longer supported. Closing old issues to clean up the issue queue.

Please reopen and update this issue if this is still an issue in the D7 or D8 version.

I was facing the same issue with D8 version. A client is working on a private network, where IP address is the same for all users.
The site is using the Voting API module and the Like & Dislike module.

Anonymous users are allowed and able to vote thanks to this fix https://www.drupal.org/project/votingapi/issues/2846341, but it fails in my use case because the module saves a vote_source as IP address hash, which is the same for all users.

The problem is that when a module (here Like & Dislike) asks how many times the current user has voted by calling VoteStorage::getUserVotes() the vote_source returns the same IP hash + user ID is 0, hence, it looks as though the current user has already voted, which is not true (e.g. anonymous user from a different computer within organization's network).

For some use cases, I assume https://www.drupal.org/project/votingapi/issues/2791129 (which I also tested and added to my project) can be an option (to limit on time passed between voting), but in my case we don't want the duplicates, so this doesn't fully solve the problem with Anonymous.

To fix the situation, I have added an option to store vote_source relying also on Drupal's Session ID. This allows anonymous users within one IP to vote without issues.

Attached is a patch of how I implemented it.

By definition a 'session' is reset when restarting the browser (though depending on the browser setting it might be different). This means that anonymous users will be able to cast a new vote every time they visit the site.
Instead of using Drupal's session, it might be better to set a cookie with the voting identifier, and store it as long as possible, so that well-behaving customers will be able to update their votes with the same voting identifier, instead of adding a new vote.

It is also important to note that in both cases the system can be abused by the client resetting their cookies, and misbehaving users may cast unlimited votes. That is probably not a problem in a private web site where abuse is not expected, yet I believe there should be a clear warning about that in the configuration.
For this reason it would be nice to have the user IP identifier preserved (as part of the session identifier hash), so that abuse can be detected if needed. In this way it is also possible to add votes limit per IP.

I invite you, to test and review this issue : https://www.drupal.org/project/votingapi/issues/3060468
Where I posted a patch to fix the rollover window, so users on the same network can now vote after the rollover window ends.

And if the rollover window is not what you want, and you are looking for a "per device" vote system. I also added a way to configure the source from whitch you want the vote to be considered from another user, but instead of using the Drupal's session (as stated in the above comment), I set a randomly generated cookie, which is a bit safer (I also added a combo option between IP + randomly genarated cookie).

And if 5 minutes is not fast enought for you, there is an "Immediately" option (as well as a "Never" option) now.

The patch from #6 does not apply to the current 3.x-dev version. Here is a rerolled patch.

I opened a MR and added the changes from the last patch. I renamed Anonymous vote restrictions (anonymous_vote_restrictions) to Anonymous vote differentiation (anonymous_differentiation) and added a third option, One vote per cookie, as suggested by @RumyanaRuseva in #7.