lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Limit survey answer on public page by ip adress

Browse Source
This commit is contained in:
Faustin 2022-11-24 13:10:43 +01:00
parent 0901bf55c3
commit 9a028c9137
3 changed files with 61 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/install/mysql/migration/16.0.0-17.0.0.sql
View File

@ -67,6 +67,8 @@ ALTER TABLE llx_adherent ADD COLUMN ip varchar(250);
ALTER TABLE llx_projet ADD COLUMN ip varchar(250);
ALTER TABLE llx_actioncomm ADD COLUMN ip varchar(250);
ALTER TABLE llx_eventorganization_conferenceorboothattendee ADD COLUMN ip varchar(250);
ALTER TABLE llx_opensurvey_user_studs ADD COLUMN ip varchar(250);
ALTER TABLE llx_opensurvey_comments ADD COLUMN ip varchar(250);
ALTER TABLE llx_fichinterdet_rec DROP COLUMN remise;
ALTER TABLE llx_fichinterdet_rec DROP COLUMN fk_export_commpta;

7
htdocs/opensurvey/class/opensurveysondage.class.php
View File

@ -571,12 +571,13 @@ class Opensurveysondage extends CommonObject
*
* @param string $comment Comment content
* @param string $comment_user Comment author
* @param string $user_ip Comment author IP
* @return boolean False in case of the query fails, true if it was successful
*/
public function addComment($comment, $comment_user)
public function addComment($comment, $comment_user, $user_ip = '')
{
$sql = "INSERT INTO ".MAIN_DB_PREFIX."opensurvey_comments (id_sondage, comment, usercomment)";
$sql .= " VALUES ('".$this->db->escape($this->id_sondage)."','".$this->db->escape($comment)."','".$this->db->escape($comment_user)."')";
$sql = "INSERT INTO ".MAIN_DB_PREFIX."opensurvey_comments (id_sondage, comment, usercomment, ip)";
$sql .= " VALUES ('".$this->db->escape($this->id_sondage)."','".$this->db->escape($comment)."','".$this->db->escape($comment_user)."'".($user_ip ? ",'".$this->db->escape($user_ip)."'" : '').")";
$resql = $this->db->query($sql);
if (!$resql) {

58
htdocs/public/opensurvey/studs.php
View File

@ -97,8 +97,34 @@ if (GETPOST('ajoutcomment', 'alpha')) {
$error++;
}
$user_ip = getUserRemoteIP();
$nb_post_max = getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 1000);
// Calculate nb of post for IP
$nb_post_ip = 0;
if ($nb_post_max > 0) { // Calculate only if there is a limit to check
$sql = "SELECT COUNT(id_comment) as nb_comments";
$sql .= " FROM ".MAIN_DB_PREFIX."opensurvey_comments";
$sql .= " WHERE ip = '".$db->escape($user_ip)."'";
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
$i = 0;
while ($i < $num) {
$i++;
$obj = $db->fetch_object($resql);
$nb_post_ip = $obj->nb_comments;
}
}
}
if ($nb_post_max > 0 && $nb_post_ip >= $nb_post_max) {
setEventMessages($langs->trans("AlreadyTooMuchPostOnThisIPAdress"), null, 'errors');
$error++;
}
if (!$error) {
$resql = $object->addComment($comment, $comment_user);
$resql = $object->addComment($comment, $comment_user, $user_ip);
if (!$resql) {
dol_print_error($db);
@ -125,6 +151,28 @@ if (GETPOST("boutonp") || GETPOST("boutonp.x") || GETPOST("boutonp_x")) { // bo
}
}
$user_ip = getUserRemoteIP();
$nb_post_max = getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 1000);
// Calculate nb of post for IP
$nb_post_ip = 0;
if ($nb_post_max > 0) { // Calculate only if there is a limit to check
$sql = "SELECT COUNT(id_users) as nb_records";
$sql .= " FROM ".MAIN_DB_PREFIX."opensurvey_user_studs";
$sql .= " WHERE ip = '".$db->escape($user_ip)."'";
$resql = $db->query($sql);
if ($resql) {
$num = $db->num_rows($resql);
$i = 0;
while ($i < $num) {
$i++;
$obj = $db->fetch_object($resql);
$nb_post_ip = $obj->nb_records;
}
}
}
$nom = substr(GETPOST("nom", 'alphanohtml'), 0, 64);
// Check if vote already exists
@ -137,12 +185,16 @@ if (GETPOST("boutonp") || GETPOST("boutonp.x") || GETPOST("boutonp_x")) { // bo
}
$num_rows = $db->num_rows($resql);
if ($num_rows > 0) {
setEventMessages($langs->trans("VoteNameAlreadyExists"), null, 'errors');
$error++;
} elseif ($nb_post_max > 0 && $nb_post_ip >= $nb_post_max) {
setEventMessages($langs->trans("AlreadyTooMuchPostOnThisIPAdress"), null, 'errors');
$error++;
} else {
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'opensurvey_user_studs (nom, id_sondage, reponses)';
$sql .= " VALUES ('".$db->escape($nom)."', '".$db->escape($numsondage)."','".$db->escape($nouveauchoix)."')";
$sql = 'INSERT INTO '.MAIN_DB_PREFIX.'opensurvey_user_studs (nom, id_sondage, reponses, ip)';
$sql .= " VALUES ('".$db->escape($nom)."', '".$db->escape($numsondage)."','".$db->escape($nouveauchoix)."', '".$db->escape($user_ip)."')";
$resql = $db->query($sql);
if ($resql) {