FriendsOfFlarum Polls

Versions 0.1.5 and 0.2.1 - Security update!

• Fix missing permission check when voting via API #28
• Fix validation and permission errors not appearing on screen (beta 14 only)
• Export javascript components for extensibility

If you are running beta 13:

composer require fof/polls:^0.1.5

If you are running beta 14:

composer require fof/polls:^0.2.1

Note on the security fix: any registered user was able to vote on any poll by using the REST API, even if they were suspended. The vulnerability did not allow voting on polls that ended.

The impact is probably limited on forums that already allowed any registered user to vote, and mostly impacts forums where only some groups were given vote permission.

Hi! Would it be possible to hide percentages on the polls? If so, how could this be done?

diegoc with the way the extension is currently designed, I believe the full list of all votes is always exposed publicly through the API. You could hide the totals using CSS, but removing the data from public access will likely requires a lot of work.

clarkwinkelmann Hi! Thanks for the idea. I hid the CSS, but the votes still show when you hover, as a little popup appears with the number of votes. I've tried hiding that element, but it might be triggered by JS? Is there any way of disabling that?

diegoc Is there any way of disabling that?

.PollOption .tooltip {
    display: none !important;
}

Pollux Thank you very much!!!

Hi, I've just noticed an error repeated in my console (firefox browser) caused by polls extension. It looks minor because everything seems to work in the forum, but I think it can interest you :

Uncaught (in promise) TypeError: t is undefined
r extend.js:22
exports addPollToDiscussion.js:57
promise callback*module.exports</</< addPollToDiscussion.js:23
e extend.js:27
a render.js:30
exports render.js:971
a mount-redraw.js:14
c mount-redraw.js:25
c mount-redraw.js:23
goToNumber PostStreamState.js:118
promise callback*flarum.core</Nt</e.goToNumber PostStreamState.js:118
show DiscussionPage.js:166
setTimeout handler*flarum.core</Ot</n.load DiscussionPage.js:106
oninit DiscussionPage.js:35
a render.js:30
M render.js:917
l render.js:153
l render.js:160
l render.js:66
u render.js:50
l render.js:103
l render.js:62
f render.js:487
f render.js:419
h render.js:302
exports render.js:964
a mount-redraw.js:14
v router.js:114
promise callback*t router.js:126
S router.js:95
a render.js:30
exports render.js:971
mount mount-redraw.js:45
y router.js:160
mount Application.js:198
mount ForumApplication.js:121
boot Application.js:176
<anonymous> 235:233
extend.js:22:19

0.3.0

• Flarum beta 15 support

Seems like a typo in code:

[2020-12-21 12:12:26] flarum.ERROR: ParseError: syntax error, unexpected ')' in /app/vendor/fof/polls/src/Api/Controllers/DeletePollController.php:54
Stack trace:
#0 /app/vendor/composer/ClassLoader.php(322): Composer\Autoload\includeFile('/app/vendor/com...')
#1 [internal function]: Composer\Autoload\ClassLoader->loadClass('FoF\\Polls\\Api\\C...')
#2 [internal function]: spl_autoload_call('FoF\\Polls\\Api\\C...')
#3 /app/vendor/illuminate/container/Container.php(803): ReflectionClass->__construct('FoF\\Polls\\Api\\C...')
#4 /app/vendor/illuminate/container/Container.php(681): Illuminate\Container\Container->build('FoF\\Polls\\Api\\C...')
#5 /app/vendor/illuminate/container/Container.php(629): Illuminate\Container\Container->resolve('FoF\\Polls\\Api\\C...', Array)
#6 /app/vendor/flarum/core/src/Http/RouteHandlerFactory.php(74): Illuminate\Container\Container->make('FoF\\Polls\\Api\\C...')
#7 /app/vendor/flarum/core/src/Http/RouteHandlerFactory.php(34): Flarum\Http\RouteHandlerFactory->resolveController('FoF\\Polls\\Api\\C...')
#8 /app/vendor/flarum/core/src/Http/Middleware/ExecuteRoute.php(27): Flarum\Http\RouteHandlerFactory->Flarum\Http\{closure}(Object(Laminas\Diactoros\ServerRequest), Array)
#9 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ExecuteRoute->process(Object(Laminas\Diactoros\ServerRequest), Object(Closure))
#10 /app/vendor/flarum/core/src/Api/Middleware/ThrottleApi.php(33): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#11 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Api\Middleware\ThrottleApi->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#12 /app/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php(48): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#13 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\CheckCsrfToken->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#14 /app/vendor/flarum/core/src/Http/Middleware/ResolveRoute.php(67): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#15 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ResolveRoute->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#16 /app/vendor/flarum/core/src/Http/Middleware/SetLocale.php(50): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#17 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\SetLocale->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#18 /app/vendor/flarum/core/src/Http/Middleware/AuthenticateWithHeader.php(55): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#19 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\AuthenticateWithHeader->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#20 /app/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php(32): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#21 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\AuthenticateWithSession->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#22 /app/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php(51): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#23 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\RememberFromCookie->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#24 /app/vendor/flarum/core/src/Http/Middleware/StartSession.php(61): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#25 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\StartSession->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#26 /app/vendor/flarum/core/src/Api/Middleware/FakeHttpMethods.php(29): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#27 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Api\Middleware\FakeHttpMethods->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#28 /app/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php(28): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#29 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ParseJsonBody->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#30 /app/vendor/flarum/core/src/Http/Middleware/HandleErrors.php(57): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#31 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\HandleErrors->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#32 /app/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(84): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#33 /app/vendor/middlewares/request-handler/src/RequestHandler.php(84): Laminas\Stratigility\MiddlewarePipe->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#34 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\RequestHandler->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#35 /app/vendor/middlewares/base-path-router/src/BasePathRouter.php(97): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#36 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\BasePathRouter->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#37 /app/vendor/laminas/laminas-stratigility/src/Middleware/OriginalMessages.php(42): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#38 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Laminas\Stratigility\Middleware\OriginalMessages->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#39 /app/vendor/middlewares/base-path/src/BasePath.php(53): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#40 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\BasePath->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#41 /app/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(84): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#42 /app/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(73): Laminas\Stratigility\MiddlewarePipe->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\EmptyPipelineHandler))
#43 /app/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php(96): Laminas\Stratigility\MiddlewarePipe->handle(Object(Laminas\Diactoros\ServerRequest))
#44 /app/vendor/flarum/core/src/Http/Server.php(42): Laminas\HttpHandlerRunner\RequestHandlerRunner->run()
#45 /app/public/index.php(22): Flarum\Http\Server->listen()
#46 {main}  

beta.15, version 0.3.0, happens when trying to remove a poll.

SKevo oops, thanks for letting me know. I’ll sort this ASAP today

SKevo Just sitting down to look at this now. I'm not seeing this error, these steps:

• Create a new discussion with poll
• View the discussion
• Select post controls, select 'Delete poll'

Can you provide any additional info please @SKevo ?

SKevo I'm afraid I cannot replicate the 500 error, although I do see that a refresh is required to see that the poll is removed.

I've created an issue for the refresh here FriendsOfFlarum/polls32

Well, on FreeFlarum, 500 error appears in console and the poll can't be removed at all (page refreshing won't help). Not sure if it's an issue on our side.

0.3.1

• Address 500 described by SKevo (Issue was related to PHP version)

Upgrading

composer require fof/polls:"*"

Littlegolden please try composer require fof/polls:dev-master and let me know how you get on with that

IanM Updated, error gone.

0.3.2

• Fix JS error when removing a poll (Littlegolden )

Updating

composer require fof/polls:"*"
php flarum cache:clear