form is still displayed even if max number exceeded

In this case, most of the relevant code was in webform_client_form_validate, alojng with a healthy bit of watchdogs. The methodology in here is all wrong: you offer the ability to limit form submissions, but then you tease the user with the form display anyways, then spend a good 15 lines or so telling the admins that the user WAS tricked, and then have to worry about limiting the number of times you tell admins because of spams. The solution, really, is: not to tease the user in the first place. If they've exceeded the limit, just don't show the damn form! This simple change in methodology saves a healthy bit of code (and a lot of useless watchdog messages).

Definitely a more sensible place to check the submission limit.

One little suggestion. Since previous submissions are tracked by IP address, users who have reached the submit limit and are currently logged out will still see "You may not submit another entry at this time," which might be confusing. That message should probably only be shown to logged in users.

I was just bitten by this as well. Subscribing so I can test the patch when it's not 2 am.

I consolidated the error messages thrown during validation into a single message if multiple are thown. So that if you have both the error message "You cannot submit another entry at this time" and "You have already submitted this form. View your submissions", it is consolidated into "You cannot submit another entry at this time. View your submissions." This just cuts down on redundant error messages.

Other than that, the patch worked great. Sorry for the long delay before getting this in. I wanted to get the 2.0 version out the door before introducing any new features. This will be included in the 2.1 version.

Automatically closed -- issue fixed for two weeks with no activity.