Why do anonymous users see 'Your vote has been recorded.' on a decision instead of something like 'You must be logged in to vote'?

Happens in the dev version too.

Eric

Comments

floater’s picture

floater commented

As this depend on permission 'vote on decisions', a better message might be: you have insufficient permissions to vote on this decision.
(it would have saved me some time ;-)

roball’s picture

roball commented
Title: Anon users seeing 'Your vote has been recorded.' » Anonymous users see 'Your vote has been recorded.'

Can confirm this bug. IMO, if the anonymous user has no view decisions permission, viewing a decision node for non-logged in users should trigger a "Access denied" HTTP status.

anarcat’s picture

anarcat commented
Status: Active » Fixed

I don't think we throw a permision denied just yet, but the error message has been fixed in CVS, which will be bundled in the next release. Open a new issue if you think it's really important to return proper status codes here.

ezra-g’s picture

ezra-g commented

IMO, if the anonymous user has no view decisions permission, viewing a decision node for non-logged in users should trigger a "Access denied" HTTP status.

I'm not sure that makes sense, since an inaccessible decision could be displayed in a block on a page where the rest of the content is accessible. We could look to how the node access system handles this in general for guidance here.

btmash’s picture

btmash commented

The problem is beyond just anonymous users seeing 'Your vote has been recorded'

Providing scenario:

Decisions start date: set to sometime after the current time and date
Decisions quorum: set to a value greater than 0 (atleast one of percentage or #votes)

Publish the node and let a regular user who is eligible to vote see it.

According to the rules, the user can see the node. However, they fall under the 'cannot' vote clause as the start date has not yet come. They also cannot see the results since the quorum has not yet been met. However, they are presented with 'Your vote has been recorded as that case is not in the theme.

I have a patch for a particular case that I had to solve really quickly but I think the permissions aspect of this is a deeper issue.

In the scenarios that have been presented above, an anonymous user should be able to see *some* of the information regarding the node if the permissions grant it (as an example, I cannot vote in the US elections, but I am still able to see the results and information regarding it). So I this the decision should be the only part that is inaccessible.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.