Description:
Hi wpDiscuz team,
I've identified a significant behavioral change introduced in newest wpDiscuz versions in the `voteOnComment()` method of `class.WpdiscuzHelperAjax.php` that causes the error "You are not allowed to vote for this comment (Voting from same IP)" to fire in cases where it shouldn't.
What changed:
In earlier versions the same-IP check in `voteOnComment()` was gated behind `!$isUserLoggedIn`:
```php
// Only guests are checked by IP
if (!$isUserLoggedIn && md5($comment->comment_author_IP) == $userIdOrIp) {
wp_send_json_error("wc_deny_voting_from_same_ip");
}
```
In v7.6.66, this condition was removed, and the check now applies to all users unconditionally, including logged-in administrators:
```php
// v7.6.66 — Everyone is checked by IP, regardless of login status
if ($comment->comment_author_IP == $userIP) {
wp_send_json_error("wc_deny_voting_from_same_ip");
} elseif ($userID && $userID == $comment->user_id) {
wp_send_json_error("wc_self_vote");
}
```
Two issues arise from this change:
1.Logged-in users should not be subject to IP-based restrictions. They are already uniquely identifiable by their `user_id`. The original logic correctly recognized this distinction. Two different registered users who happen to share the same public IP (e.g., coworkers on a corporate network) are two distinct, authenticated identities, blocking one from voting on the other's comment based solely on IP is incorrect.
2.The `elseif` structure prevents the correct error message from being displayed. When a logged-in user tries to vote on their own comment from the same IP, they receive the generic "Voting from same IP" message instead of the correct "You Cannot Vote On Your Comment" message. The IP check intercepts the request before the `user_id` self-vote check can run.
Real-world production scenarios affected:
- CGNAT (Carrier-Grade NAT): Mobile carriers (4G/5G) share a single public IP among hundreds of subscribers. Two different registered users browsing via the same carrier could be blocked from voting on each other's comments.
- Corporate/University networks: Employees or students behind a shared gateway IP cannot vote on each other's comments.
- Misconfigured CDN/Proxy: If Cloudflare or another reverse proxy doesn't properly forward the visitor's real IP (e.g., missing `X-Forwarded-For` header), all visitors appear to have the proxy's IP.
- Localhost development: All traffic originates from `127.0.0.1` or `::1`, making it impossible to test voting features locally.
Suggested fix:
Restore the `!$isUserLoggedIn` guard that existed in earlier versions, so that the IP-based restriction only applies to guests, and change the `elseif` back to a separate `if` so that the self-vote check is always evaluated independently:
```php
$userIP = WpdiscuzHelper::getRealIPAddr();
$userID = get_current_user_id();
// IP-based restriction should only apply to guests
if (!$userID && $comment->comment_author_IP == $userIP) {
wp_send_json_error("wc_deny_voting_from_same_ip");
}
// Self-vote check should always run independently for logged-in users
if ($userID && $userID == $comment->user_id) {
wp_send_json_error("wc_self_vote");
}
```
This preserves the anti-abuse intent for guests while correctly relying on `user_id` for authenticated users.
Environment:
- wpDiscuz version: 7.6.66 (free)
- WordPress version: 7.0.4
- PHP version: 8.3.30
Disclosure: This bug report was drafted with the assistance of an AI coding assistant (Antigravity/Claude) based on my manual comparison of the wpDiscuz source code between versions. The analysis, code excerpts, and suggested fix were reviewed and approved by me before posting. All described behaviors were observed and reproduced in my local development environment (WampServer64 / WordPress 7.0.4 / PHP 8.3.30).
Thank you for your time and for maintaining such a great plugin.