2.1 TSWVote 2.3

Two endpoints.

1. One to request if a player is online when they vote from the website, this would take one parameter, an IP, and use tshock functions to look up the player and see if they are online/etc you want to do, returning true/false I assume.
2. One to inform the server that the vote is ok and valid and not totally spoofed. Param name with the IP so that the server knows who voted. You could even include info like how many times theyve voted, etc etc.

The benefits are clear as simon pointed out: No security flaws, no extraneous data being leaked outside. Server owner can set up the config file with whatever commands they want executed. You can use a replace statement to swap in macros, like %playername% or %accountname% for usage.

 

Wow, nice thinking.
Yes, you can instead tell people to vote on the website and then once they do - notify the server.
Moreover - if you do this, there is even no need to query the server about the player, it would be sufficient to just send voter IP to the server and then your plugin (or any custom plugin, since vote is still happening on the website) will decide what to do with the IP (aka find the player, or user, or if there's no user - just store the IP for reward to be claimed later or just ignore it, etc...). But then, you could as well just store voter IPs and let the server query them, like *one of your competitors* does.

But all that is still not what you want, this is not in-game voting.

 

Dang it.. I was getting to it, but suddenly had to take a nap. You beat me to it
As I was trying to say, too many security flaws..
Anyway, I heard XGhozt likes removing valid votes... (No personal gain intended. Scientific interest)

♫ Shockwave Sound - Call For Heroes (Rock Mix)​

 

Vote cheater found, Terrafun has 1600 votes within no time. No way possible.

Should ban this guy from your website.

EDIT: 2008 votes now, raising within minutes.

 

Please read the post above you first, okay?

btw, not "no time", but 2 seconds per vote, cause rest-requests are slooow.

 

This is exactly what I was talking about...

 

I was trying to prove my point the whole night... But oh well. Took like 10 minutes to write a wrapper.

 

Man... Ok... At least stop now may be?

 

Almost. It runs on its own, I can't stop it. Should be done in 10-20 minutes... (I dumped my Banlist into it)
I'm also curious, how XGhozt will explain to me, which of those are "fake", as he claimed my old, real votes a few weeks earlier.

 

2000+ votes and raising within seconds now, lmao cantaloupe melon.

 

Hang in there, almost. Should stop at around 2500.

 

At this point it is sufficient to consider all your votes fake.

 

But I'd like to get the proof from website's point of view. Cause the requests and responses are exactly the same as of the original plugin. And all IPs are different (cause BanDB has IPs as a Primary key)
-Done-
Otherwise I'd like to have my old votes back (around 600)

Disclaimer: No damage or personal gain intended. Only to describe the bugs, this plugin exposed for the website. Done with good fun and proof-of-concept. (I should be thanked for explaining the vulnerabilities of your system (c) "Social Network")

 

Don't be surprised in case all of a sudden they decide to test some of the other security flaws on you. Like, command executing and such.

 

I always revert the rest user to useapi only permission... No worries ))

 

Xghozt if you read this please come online on skype :I

 

Can I ask a personal favor - can he erase all votes on my server? A hater has been "unliking" it for months, so I am stuck with a melonton of dislikes... (130 likes vs 111 dislikes)