fix: being able to submit multiple votes

There was a missing policy check when casting the vote. So the script managed to add the vote to the alternative, but then failed when trying to register the user as casted vote (MYSQL dupe error). This commit fixes it and enforces a better policy when casting a vote not making this possible anymore.
Vatsim-Scandinavia · Mar 25, 2024 · e7c8117 · e7c8117
1 parent e9954bb
commit e7c8117
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 28 deletions.
diff --git a/app/Http/Controllers/VoteController.php b/app/Http/Controllers/VoteController.php
@@ -124,6 +124,8 @@ public function update(Request $request, $id)
     {
         $vote = Vote::findOrFail($id);
 
+        $this->authorize('vote', [Vote::class, $vote]);
+
         if (! $this->isVoteValid($vote)) {
             return back()->withInput()->withErrors('You vote could not be registered. The vote deadline has passed.');
         }

diff --git a/app/Policies/VotePolicy.php b/app/Policies/VotePolicy.php
@@ -49,10 +49,15 @@ public function store(User $user)
      */
     public function vote(User $user, Vote $vote)
     {
+
         if ($vote->closed) {
             return Response::deny('The vote closed and concluded at ' . Carbon::create($vote->end_at)->toEuropeanDateTime());
         }
 
+        if ($vote->user->contains('id', $user->id)) {
+            return Response::deny('You have already voted.');
+        }
+
         if ($vote->require_member) {
             if ($user->subdivision != config('app.owner_code')) {
                 return Response::deny('Sorry, you do not qualify to participate in this vote. You must belong to ' . config('app.owner_name') . ' to vote.');

diff --git a/resources/views/vote/show.blade.php b/resources/views/vote/show.blade.php
@@ -15,34 +15,27 @@
 
                 @can('vote', $vote)
 
-                    @if($vote->user()->where('user_id', \Auth::user()->id)->exists())
-
-                        <p><i class="fas fa-check"></i> You've already voted.</p>
-
-                    @else
-                        <form action="{{ route('vote.update', $vote->id) }}" method="POST">
-                            @method('PATCH')
-                            @csrf
-
-                            @foreach( $vote->option as $votefor )
-                                <div class="form-check">
-                                    <input class="form-check-input" type="radio" name="vote" id="{{ $votefor->option }}" value="{{ $votefor->id }}">
-                                    <label class="form-check-label" for="{{ $votefor->option }}">
-                                        {{ $votefor->option }}
-                                    </label>
-                                </div>
-                            @endforeach
-                            @error('vote')
-                                <span class="text-danger">{{ $errors->first('vote') }}</span>
-                            @enderror
-
-                            <br>
-                            <p class="text-muted">Your vote is secret and can not be traced. The vote is final and cannot be changed.</p>
-                            <button type="submit" class="btn btn-success">Submit Vote</button>
-
-                        </form>
-
-                    @endif
+                    <form action="{{ route('vote.update', $vote->id) }}" method="POST">
+                        @method('PATCH')
+                        @csrf
+
+                        @foreach( $vote->option as $votefor )
+                            <div class="form-check">
+                                <input class="form-check-input" type="radio" name="vote" id="{{ $votefor->option }}" value="{{ $votefor->id }}">
+                                <label class="form-check-label" for="{{ $votefor->option }}">
+                                    {{ $votefor->option }}
+                                </label>
+                            </div>
+                        @endforeach
+                        @error('vote')
+                            <span class="text-danger">{{ $errors->first('vote') }}</span>
+                        @enderror
+
+                        <br>
+                        <p class="text-muted">Your vote is secret and can not be traced. The vote is final and cannot be changed.</p>
+                        <button type="submit" class="btn btn-success">Submit Vote</button>
+
+                    </form>
 
                 @else
                     <p class="text-danger">{{ Gate::inspect('vote', $vote)->message() }}</p>