| @@ -7,13 +7,16 @@ | ||
| 7 | 7 | add_action( 'wp_ajax_bbpress_post_vote_link_clicked', 'bbpress_post_add_vote' ); |
| 8 | 8 | add_action( 'wp_ajax_nopriv_bbpress_post_vote_link_clicked', 'bbpress_post_add_vote' ); |
| 9 | 9 | |
| 10 | 10 | function bbpress_post_add_vote() { |
| 11 | + // Verify nonce for security | |
| 12 | + check_ajax_referer( 'forumax-nonce', 'nonce' ); | |
| 13 | + | |
| 11 | 14 | header( 'Content-type: application/json' ); |
| 12 | 15 | $post_id = (int) $_POST['post_id']; |
| 13 | 16 | |
| 14 | 17 | // View only for visitors. |
| 15 | - if ( ! is_user_logged_in() && apply_filters( 'bbp_voting_disable_voting_for_visitors', false ) ) { | |
| 18 | + if ( ! is_user_logged_in() && forumax_get_opt( 'is_disabled_voting_for_non_logged_users', false ) ) { | |
| 16 | 19 | die( json_encode( [ 'error' => 'Voting is disabled for visitors.' ] ) ); |
| 17 | 20 | } |
| 18 | 21 | |
| 19 | 22 | // View only for closed topics |
| @@ -18,47 +21,68 @@ | ||
| 18 | 21 | |
| 19 | 22 | // View only for closed topics |
| 20 | 23 | $topic_id = bbp_get_reply_topic_id( $post_id ); |
| 21 | 24 | $topic_status = get_post_status( $topic_id ); |
| 22 | - if ( $topic_status == 'closed' && apply_filters( 'bbp_voting_disable_voting_on_closed_topic', false ) ) { | |
| 25 | + if ( $topic_status == 'closed' && forumax_get_opt( 'is_disabled_voting_closed_topics', false ) ) { | |
| 23 | 26 | die( json_encode( [ 'error' => 'Voting is disabled on closed topics.' ] ) ); |
| 24 | 27 | } |
| 25 | 28 | // View only for author of post |
| 26 | - if ( is_user_logged_in() && apply_filters( 'bbp_voting_disable_author_vote', false ) && get_post_field( 'post_author', $post_id ) == get_current_user_ID() ) { | |
| 29 | + if ( is_user_logged_in() && forumax_get_opt( 'is_disabled_voting_own_topic_reply', false ) && get_post_field( 'post_author', $post_id ) == get_current_user_ID() ) { | |
| 27 | 30 | die( json_encode( [ 'error' => 'Voting is disabled on for the author.' ] ) ); |
| 28 | 31 | } |
| 29 | 32 | // Direction |
| 30 | 33 | $direction = (int) $_POST['direction']; |
| 31 | 34 | $direction = in_array( $direction, [ 1, -1 ] ) ? $direction : 0; // Enforce 1 or -1 |
| 35 | + | |
| 36 | + // Check if down votes are disabled | |
| 37 | + if ( $direction === -1 && forumax_get_opt( 'is_down_votes_disabled', 0 ) != 1 ) { | |
| 38 | + die( json_encode( [ 'error' => 'Down voting is disabled.' ] ) ); | |
| 39 | + } | |
| 40 | + | |
| 32 | 41 | // $voting_cookie = unserialize($_COOKIE['bbp_voting']); |
| 33 | 42 | $voting_log = get_post_meta( $post_id, 'bbp_voting_log', true ); |
| 34 | 43 | $voting_log = is_array( $voting_log ) ? $voting_log : []; // Set up new array |
| 35 | - $client_ip = $_SERVER['REMOTE_ADDR']; | |
| 36 | - $identifier = is_user_logged_in() ? get_current_user_id() : $client_ip; | |
| 37 | - $admin_bypass = current_user_can( 'administrator' ) && apply_filters( 'bbp_voting_admin_bypass', false ); | |
| 44 | + | |
| 45 | + // Use hashed IP for anonymous users (GDPR compliant - real IP is never stored) | |
| 46 | + $identifier = is_user_logged_in() ? get_current_user_id() : forumax_get_hashed_ip(); | |
| 47 | + $legacy_identifier = null; | |
| 48 | + | |
| 49 | + // Backward compatibility: Check for legacy raw IP entries (pre-2.3.1) | |
| 50 | + // This allows migration from raw IP to hashed IP without losing vote history | |
| 51 | + if ( ! is_user_logged_in() ) { | |
| 52 | + $raw_ip = forumax_get_raw_ip(); | |
| 53 | + if ( $raw_ip && array_key_exists( $raw_ip, $voting_log ) ) { | |
| 54 | + $legacy_identifier = $raw_ip; | |
| 55 | + } | |
| 56 | + } | |
| 57 | + | |
| 58 | + $admin_bypass = current_user_can( 'administrator' ) && forumax_get_opt( 'is_admin_can_vote_unlimited', false ); | |
| 38 | 59 | $remove_vote = false; |
| 39 | 60 | $reverse_vote = false; |
| 40 | 61 | // Admin bypass skips the restriction checks |
| 41 | 62 | if ( ! $admin_bypass ) { |
| 42 | - // Catch user voted already (by cookie) | |
| 43 | - // if(isset($voting_cookie[$post_id])) { | |
| 44 | - // echo 'Not allowed to vote twice'; | |
| 45 | - // exit; | |
| 46 | - // } else { | |
| 47 | - // Catch user voted already (by user ID or IP) | |
| 48 | - if ( array_key_exists( $identifier, $voting_log ) ) { | |
| 49 | - // Identifier found | |
| 50 | - if ( $voting_log[ $identifier ] == $direction ) { | |
| 63 | + // Check for existing vote - first by new hashed identifier, then by legacy raw IP | |
| 64 | + $check_identifier = array_key_exists( $identifier, $voting_log ) ? $identifier : $legacy_identifier; | |
| 65 | + | |
| 66 | + if ( $check_identifier && array_key_exists( $check_identifier, $voting_log ) ) { | |
| 67 | + // Identifier found (either hashed or legacy) | |
| 68 | + if ( $voting_log[ $check_identifier ] == $direction ) { | |
| 51 | 69 | // Voting again in the same direction |
| 52 | 70 | $remove_vote = true; |
| 53 | - } elseif ( $voting_log[ $identifier ] == $direction * -1 ) { | |
| 71 | + } elseif ( $voting_log[ $check_identifier ] == $direction * -1 ) { | |
| 54 | 72 | // Changing the vote in different direction |
| 55 | 73 | $reverse_vote = true; |
| 56 | 74 | } else { |
| 57 | 75 | // Changing vote from 0 |
| 58 | 76 | } |
| 77 | + | |
| 78 | + // Migrate legacy raw IP to hashed IP (one-time migration per vote) | |
| 79 | + if ( $legacy_identifier && $check_identifier === $legacy_identifier ) { | |
| 80 | + $voting_log[ $identifier ] = $voting_log[ $legacy_identifier ]; | |
| 81 | + unset( $voting_log[ $legacy_identifier ] ); | |
| 82 | + update_post_meta( $post_id, 'bbp_voting_log', $voting_log ); | |
| 83 | + } | |
| 59 | 84 | } |
| 60 | - // } | |
| 61 | 85 | } |
| 62 | 86 | // All good, add the user's vote |
| 63 | 87 | // But first get all the data |
| 64 | 88 | $score = (int) get_post_meta( $post_id, 'bbp_voting_score', true ); |
