Option for anonymous votes to use session id in vote_source field

Same issue, here's a patch

Subscribing +1 from me too!

Ahh I've been looking thru the fivestar/votingapi code for a couple hours now. I was just about to implement something like this. Nice work - will apply the path. This should def be commit.

Wait a minute.... What is the point of the other option in VotingAPI then? For the time frame before anonymous users can vote again? From what it describes it seems like it should do what we are doing here. But there is only one reference to it in the code and it doesn't make much sense to me... or work for that matter....

It looks like votingapi is not using that 'Anonymous vote rollover' feature at all. There's only one reference to it in votingapi_select_votes function but I don't figure out what it should do. I extended Stalski's anonymous-voting.patch a bit and added a checkup to votingapi_set_votes function where I compare votingapi_anonymous_window variable against user's latest vote timestamp. This should prevent voting if vote rollover time has been set up and not passed yet. Here's a patch.

Didn't include Stalki's votingapi.admin.inc changes into the previous patch. Here's a new one. Sorry.

I tried the patch and I now have the session ID validation option which seems to work. I can now visit two different computers from the same range of IP addresses from one router and vote on those individual machines.

I think the only downside to this is if someone clears their browser cache, they can vote again. But I suppose there will always be people who try to game the system no matter what it is. (...and indeed the "Anonymous vote rollover" as mentioned above never really seemed to work either before or after the patch).

I tried the patch, everything seems to be fine after reviewing the code, but my problem is that session_id() always change on page refresh, which lets the same anonymous user vote unlimited times on the same content.

What I found is that when you are not logged in, the module looks for the session id in the table to see if there is a registry with a vote attached to it, and since everytime that I send the request the session id is changing, no match is found, and so the user can keep voting.

What can be done to prevent this from happening?

Subscribing. I have the same issue as Samshel. When using the session_id() for the vote_source unlimited votes are being allowed from anonymous users.

Updated patch for D7 attached.

Cross posting for those using the Rate module and this patch:
https://www.drupal.org/node/2324845#comment-9073361

The patch doesn't create a session for the user. This causes two issues:

• The user can't see his vote after voting
• The user can vote multiple times

How can we open a new session?

Subscribe. Please add this to the next release of the module, it is very important for some people!

The patch doesn't create a session for the user. This causes two issues:
-The user can't see his vote after voting
-The user can vote multiple times
How can we open a new session?

To fix this, I have added

$_SESSION['blablabla5839023'] = 'blablabla5839023';

before lines with session_id function.

function votingapi_current_user_identifier() {
  global $user;
  $criteria = array('uid' => $user->uid);
  if (!$user->uid) {
//    $criteria['vote_source'] = ip_address();
    $_SESSION['blablabla5839023'] = 'blablabla5839023';
    $criteria['vote_source'] = variable_get('votingapi_anonymous_validation_method', 'ip') == 'session' ? session_id() : ip_address();
  }
  return $criteria;
}

function _votingapi_prep_vote(&$vote) {
  global $user;
  if (variable_get('votingapi_anonymous_validation_method', 'ip') == 'session') {
    $_SESSION['blablabla5839023'] = 'blablabla5839023';
  }
  if (empty($vote['prepped'])) {
    $vote += array(
      'entity_type' => 'node',
      'value_type' => 'percent',
      'tag' => 'vote',
      'uid' => $user->uid,
      'timestamp' => REQUEST_TIME,
      'vote_source' => (variable_get('votingapi_anonymous_validation_method', 'ip') == 'session' ? session_id() : ip_address()),
      'prepped' => TRUE
    );
  }
}

I know that it is ugly solution. But is works.

I also need the ability to customise the source. However I'd like to keep it as clean (and still flexible) as possible, added a new patch that allows you to create your own vote_source token. Please review.

Using #11 and Session API module, you will have a session per user.

In votingapi.module, replace session_id() by session_api_get_sid().

Session API also works with the patch from comment #16. Just set the Drupal votingapi_source_callback system variable to 'session_api_get_sid', no need to adjust the code of the patch to be able to integrate it with Session API, in contradiction to the patch from #11.

The Drupal variable and the helper function is what I like more about #16.
The admin UI and the lack of PHP constants is what I like more about #11.
Both patches are backwards compatible. That's good.

Drupal 6 is no longer supported. Closing old issues to clean up the issue queue.

Please reopen and update this issue if this is still an issue in the D7 or D8 version.

Reading the issue it's clear that it IS a problem in D7 at least, and there are other D7 issues in the Rate and Fivestar modules that are blocked by this:
#2324845: Support storage of votes by session ID as well as IP address
#2631646: anonymous cannot vote
the issue version should have been changed to D7 long ago ...