diff --git a/src/routes/voteOnSponsorTime.js b/src/routes/voteOnSponsorTime.js index 506c6db..0b75b49 100644 --- a/src/routes/voteOnSponsorTime.js +++ b/src/routes/voteOnSponsorTime.js @@ -248,8 +248,8 @@ async function voteOnSponsorTime(req, res) { // Only change the database if they have made a submission before and haven't voted recently let ableToVote = isVIP - || (db.prepare("get", "SELECT count(*) as count FROM sponsorTimes WHERE userID = ?", [nonAnonUserID]).count > 0 - && privateDB.prepare("get", "SELECT count(*) as count FROM votes WHERE UUID = ? AND hashedIP = ? AND userID != ?", [UUID, hashedIP, userID]).count === 0); + || (db.prepare("get", "SELECT userID FROM sponsorTimes WHERE userID = ?", [nonAnonUserID]) !== undefined + && privateDB.prepare("get", "SELECT UUID FROM votes WHERE UUID = ? AND hashedIP = ? AND userID != ?", [UUID, hashedIP, userID]) === undefined); if (ableToVote) { //update the votes table diff --git a/test/cases/voteOnSponsorTime.js b/test/cases/voteOnSponsorTime.js index 505f97d..c1776f6 100644 --- a/test/cases/voteOnSponsorTime.js +++ b/test/cases/voteOnSponsorTime.js @@ -17,6 +17,7 @@ describe('voteOnSponsorTime', () => { db.exec(startOfQuery + "('vote-multiple', 20, 33, 2, 'vote-uuid-7', 'testman', 0, 50, 'intro', 0)"); db.exec(startOfQuery + "('voter-submitter', 1, 11, 2, 'vote-uuid-8', '" + getHash("randomID") + "', 0, 50, 'sponsor', 0)"); db.exec(startOfQuery + "('voter-submitter2', 1, 11, 2, 'vote-uuid-9', '" + getHash("randomID2") + "', 0, 50, 'sponsor', 0)"); + db.exec(startOfQuery + "('voter-submitter2', 1, 11, 2, 'vote-uuid-10', '" + getHash("randomID3") + "', 0, 50, 'sponsor', 0)"); db.exec("INSERT INTO vipUsers (userID) VALUES ('" + getHash("VIPUser") + "')"); }); @@ -57,6 +58,24 @@ describe('voteOnSponsorTime', () => { }); }); + it('Should not be able to downvote the same segment when voting from a different user on the same IP', (done) => { + request.get(utils.getbaseURL() + + "/api/voteOnSponsorTime?userID=randomID3&UUID=vote-uuid-2&type=0", null, + (err, res, body) => { + if (err) done(err); + else if (res.statusCode === 200) { + let row = db.prepare('get', "SELECT votes FROM sponsorTimes WHERE UUID = ?", ["vote-uuid-2"]); + if (row.votes === 9) { + done() + } else { + done("Vote did not fail. Submission went from 9 votes to " + row.votes); + } + } else { + done("Status code was " + res.statusCode); + } + }); + }); + it("Should not be able to upvote a segment if the user hasn't submitted yet", (done) => { request.get(utils.getbaseURL() + "/api/voteOnSponsorTime?userID=hasNotSubmittedID&UUID=vote-uuid-1&type=1", null,