@Svnt I read it before you deleted it. Did you solve the assets problem? Often when I have problem with assets I have a route that matches anything and it prevents the assets from loading. I don’t know if that was you problem, but anyway…
Yes, solved it. Works great now.
At first it was messed up but after some times i realised the problem was on my side and it worked like described in your docs.
I have found a untranslated text in your plugins/kirby-ratings/snippets/modal.php
<?php
l::set('plugin.ratings.success', 'Sie haben den Artikel bewertet!');
l::set('plugin.ratings.vote.for', 'Bewerten sie');
l::set('plugin.ratings.send', 'Bewerten');
l::set('plugin.ratings.not.rated', 'Sie haben den Artikel nicht bewertet!');
l::set('plugin.ratings.average', 'Durchschnittliche Bewertung');
l::set('plugin.ratings.count', 'Bewertungen');
l::set('plugin.ratings.delete.blacklist', 'Blacklist löschen');
l::set('plugin.ratings.delete.votes', 'Bewertungen löschen');
l::set('plugin.ratings.stars', 'Sterne');
l::set('plugin.ratings.already.voted', 'Sie haben diesen Artikel bereits bewertet!');
l::set('plugin.ratings.invalid.ip', 'Die IP ist nicht gültig!');
l::set('plugin.ratings.invalid.secret', 'Die geheime Nummer ist falsch!');
l::set('plugin.ratings.invalid.format', 'Das Eingabeformat ist falsch!');
l::set('plugin.ratings.page.does.not.exist', 'Diese Seite existiert nicht!');
l::set('plugin.ratings.modal.close', 'Schließen');
i have a question: how does the plugin identify users who have already voted?
A colleague told me he tested it with a “fresh” browser and a VPN and was still
identified. really good but how you do it?
That sounds strange. I store IP numbers as files, one file for each visitor (IP-number). A VPN should give a new IP which should be seen as a new visitor. Did you try that it’s possible to vote at all? That it’s not blocking all users or anything like that?
right, but i don’t see any security issues here.
ok, you can brute force IPs against the hash and get the ip in max. 4294967295 tries.
But why somebody should do this here? Dunno…
Maybe, but this is crypting therefore there is a crypt::decode method… with a password.
And this password have to be stored on the server somewhere otherwise the plugin
can’t create ‘hashcrypts’ on it’s own.
So if somebody steal your password: every crypted entry is exposed.
I feel like using a more advanced hash is a bit overkill. The main reason I use md5 is that it’s a lazy way to create character allowed filenames. But I understand that it can be good for laws to not write the IPs in plain text.
Well, no. There are rainbow tables that make it very easy to reverse an MD5 hash. So storing an MD5 hash is essentially the same as storing the IP in the first place.
If you really want to avoid storing the IP, use something like PHP’s password_hash(). But of course it doesn’t only use characters that are safe in filenames as @jenstornell wrote.
Best compromise: MD5 with a salt. Rainbow tables won’t work with that. And because no one would ever brute-force IP addresses, I think it’s fine (but I’m not a lawyer).
If I will add it in the future, it’s most likely that I will add it to Kirby Nja. If someone want to be adventurous, the code for it should probably look something like this (untested):