radiobrowser-api icon indicating copy to clipboard operation
radiobrowser-api copied to clipboard

Vote for station several times

Open ghost opened this issue 6 years ago • 1 comments

In the documentation, it's written that we can vote by the same IP for one station every 10 minutes: http://www.radio-browser.info/webservice But it doesn't seem right at all, I will take in example the station with the id 73987. I can make requests to the link every seconds and my vote is always recorded: http://www.radio-browser.info/webservice/json/vote/73987 The message '{"ok":"true","message":"voted for station successfully"}' appears at each request.

Someone could get a lot of votes with just a command: while true; do curl http://www.radio-browser.info/webservice/json/vote/73987; done

ghost avatar May 15 '18 18:05 ghost

The source code in the function "voteForStation" in the file db.php seems correct, but on radio-browser.info the bug is still present. The bug probably comes from the server configuration that doesn't support ipv6. Vote several times for a station doesn't work through ipv4. In the function IPVoteChecker there is:

  $ip = $_SERVER['REMOTE_ADDR'];
   // delete ipcheck entries after 10 minutes
   $db->query('DELETE FROM IPVoteCheck WHERE TIME_TO_SEC(TIMEDIFF(Now(),VoteTimestamp))>10*60');
   // was there a vote from the ip in the last 10 minutes?
   $stmt = $db->prepare('SELECT COUNT(*) FROM IPVoteCheck WHERE StationID=:id AND IP=:ip');

You should check the content of the global variable $_SERVER['REMOTE_ADDR'] though ipv6.

To finish, I just would like to put a PoC: peek 23-05-2018 14-41

ghost avatar May 23 '18 12:05 ghost