Skip to content

Fix voting security: block voting before game starts and after game ends#2591

Closed
khushal-winner wants to merge 7 commits into
OWASP:masterfrom
khushal-winner:voting-security-fix
Closed

Fix voting security: block voting before game starts and after game ends#2591
khushal-winner wants to merge 7 commits into
OWASP:masterfrom
khushal-winner:voting-security-fix

Conversation

@khushal-winner

Copy link
Copy Markdown
Contributor

Closes - #2568

  • Pre-game voting blocked - No voting before started_at is set
  • Post-game voting blocked - No voting after finished_at is set
  • Server-side validation - Cannot be bypassed by client manipulation
  • Security logging - Logs unauthorized voting attempts
  • Comprehensive tests - Covers all edge cases

@sydseter

sydseter commented Mar 12, 2026

Copy link
Copy Markdown
Collaborator

@khushal-winner your code has a build error.

@sydseter sydseter left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You need to fix the build.

- Add missing end statement to close defmodule
- Remove duplicate def topic/1 function
- Add missing display_game_session/1 function
- Resolve compilation errors for voting-security-fix branch
- Keep security validation from HEAD (voting-security-fix)
- Preserve game_active? checks for voting lifecycle
- Remove duplicate code blocks and merge markers
- Maintain proper error handling and logging
- Fix function structure and remove conflicts
@khushal-winner khushal-winner requested a review from sydseter March 23, 2026 13:57
@khushal-winner

Copy link
Copy Markdown
Contributor Author

@sydseter , is everything clear for merging?

@sydseter

sydseter commented Apr 8, 2026

Copy link
Copy Markdown
Collaborator

@khushal-winner The test coverage has gone down. Please make sure it's higher then on master: https://github.com/OWASP/cornucopia/actions/runs/24130754439/job/70406497565

@sydseter sydseter closed this May 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants