radiobrowser-api
radiobrowser-api copied to clipboard
Vote for station several times
In the documentation, it's written that we can vote by the same IP for one station every 10 minutes: http://www.radio-browser.info/webservice But it doesn't seem right at all, I will take in example the station with the id 73987. I can make requests to the link every seconds and my vote is always recorded: http://www.radio-browser.info/webservice/json/vote/73987 The message '{"ok":"true","message":"voted for station successfully"}' appears at each request.
Someone could get a lot of votes with just a command:
while true; do curl http://www.radio-browser.info/webservice/json/vote/73987; done
The source code in the function "voteForStation" in the file db.php seems correct, but on radio-browser.info the bug is still present. The bug probably comes from the server configuration that doesn't support ipv6. Vote several times for a station doesn't work through ipv4. In the function IPVoteChecker there is:
$ip = $_SERVER['REMOTE_ADDR'];
// delete ipcheck entries after 10 minutes
$db->query('DELETE FROM IPVoteCheck WHERE TIME_TO_SEC(TIMEDIFF(Now(),VoteTimestamp))>10*60');
// was there a vote from the ip in the last 10 minutes?
$stmt = $db->prepare('SELECT COUNT(*) FROM IPVoteCheck WHERE StationID=:id AND IP=:ip');
You should check the content of the global variable $_SERVER['REMOTE_ADDR']
though ipv6.
To finish, I just would like to put a PoC: