Kirby Ratings - Vote for a page with a 5 star scale

Plugins
21

Hello,

is the rating “readable” by google and the stars visible on the search results there?

it seems the snippet in the kirby template need a special format. look at: http://www.webpagefx.com/blog/seo/how-to-get-stars-search/

and: https://schema.org/Rating

Haven’t tested the plugin right now… just want to know if this feature is right there.

beste regards,
Sven

22

Not out of the box. But if you know the syntax you prefer for it you can use these functions:

echo $page->ratingAverage();
echo $page->ratingCount();
1 Like
24

@Svnt I read it before you deleted it. Did you solve the assets problem? Often when I have problem with assets I have a route that matches anything and it prevents the assets from loading. I don’t know if that was you problem, but anyway…

25

Yes, solved it. Works great now.
At first it was messed up but after some times i realised the problem was on my side and it worked like described in your docs.

I have found a untranslated text in your plugins/kirby-ratings/snippets/modal.php

<div class="ratings-success-close" href="<?php echo $go; ?>">Stäng</div>

I added a translation to my de.php file:

<?php
l::set('plugin.ratings.success', 'Sie haben den Artikel bewertet!');
l::set('plugin.ratings.vote.for', 'Bewerten sie');
l::set('plugin.ratings.send', 'Bewerten');
l::set('plugin.ratings.not.rated', 'Sie haben den Artikel nicht bewertet!');
l::set('plugin.ratings.average', 'Durchschnittliche Bewertung');
l::set('plugin.ratings.count', 'Bewertungen');
l::set('plugin.ratings.delete.blacklist', 'Blacklist löschen');
l::set('plugin.ratings.delete.votes', 'Bewertungen löschen');
l::set('plugin.ratings.stars', 'Sterne');
l::set('plugin.ratings.already.voted', 'Sie haben diesen Artikel bereits bewertet!');
l::set('plugin.ratings.invalid.ip', 'Die IP ist nicht gültig!');
l::set('plugin.ratings.invalid.secret', 'Die geheime Nummer ist falsch!');
l::set('plugin.ratings.invalid.format', 'Das Eingabeformat ist falsch!');
l::set('plugin.ratings.page.does.not.exist', 'Diese Seite existiert nicht!');
l::set('plugin.ratings.modal.close', 'Schließen');

thanks a lot,
Sven

26

Thanks! :slight_smile:
I see that I have already an issue about german translation. It’s not exactly as yours. Hard to tell which one is most correct. https://github.com/jenstornell/kirby-ratings/issues/20

27

@jenstornell: I think the translation you linked to above is a better fit (and more neutral).

1 Like
28

Hello @jenstornell

i have a question: how does the plugin identify users who have already voted?
A colleague told me he tested it with a “fresh” browser and a VPN and was still
identified. really good but how you do it? :smiley:

best regards,
Svnt

29

That sounds strange. I store IP numbers as files, one file for each visitor (IP-number). A VPN should give a new IP which should be seen as a new visitor. Did you try that it’s possible to vote at all? That it’s not blocking all users or anything like that?

(I now like this plugin more: https://github.com/jenstornell/kirby-nja, but it’s a bit different)

30

yes, voting works. i have to check this tomorrow.

Btw, you don’t store ‘ip numbers’… you store md5 hashes of the ip… and this is good because german law is stupid: https://www.technologylawdispatch.com/2017/05/in-the-courts/german-federal-supreme-court-confirms-dynamic-ip-addresses-may-constitute-personal-data/

thank you for the plugin! :+1:

2 Likes
31

md5 is not secure, right? switch to something else like crypt::encode?

1 Like
32

right, but i don’t see any security issues here.
ok, you can brute force IPs against the hash and get the ip in max. 4294967295 tries.
But why somebody should do this here? Dunno…

Maybe, but this is crypting therefore there is a crypt::decode method… with a password.
And this password have to be stored on the server somewhere otherwise the plugin
can’t create ‘hashcrypts’ on it’s own.

So if somebody steal your password: every crypted entry is exposed.

A one way hash is much better in this case.

Svnt

1 Like
33

I feel like using a more advanced hash is a bit overkill. The main reason I use md5 is that it’s a lazy way to create character allowed filenames. But I understand that it can be good for laws to not write the IPs in plain text.

What do you think?

  • The current md5 solution is fine
  • Use crypt::encode instead
  • Use something else instead (reply required)
  • I don’t care
  • I don’t know

0 voters

Show results
1 Like
34

Well, no. There are rainbow tables that make it very easy to reverse an MD5 hash. So storing an MD5 hash is essentially the same as storing the IP in the first place.

If you really want to avoid storing the IP, use something like PHP’s password_hash(). But of course it doesn’t only use characters that are safe in filenames as @jenstornell wrote.

Best compromise: MD5 with a salt. Rainbow tables won’t work with that. And because no one would ever brute-force IP addresses, I think it’s fine (but I’m not a lawyer).

3 Likes
35

I agree, it would be a good compromise.

If I will add it in the future, it’s most likely that I will add it to Kirby Nja. If someone want to be adventurous, the code for it should probably look something like this (untested):

$filename = md5(c::get('nja.salt', u()) . $ip);
36

I can only vote once per article.
Changing IP/Browser does not help. I always get “already voted”.

Any idea what’s wrong?

Svnt

37

:slight_smile: Doesn’t it what a good vote system must do ? Prevent users to vote mutliple times because if they could, it would be total anarchy ?

38

But in my case only one user can vote. All others are blocked by the “already voted” message.

39

Mhmm ok sorry it wasn’t clear for me but unfortunaly, I don’t know well this plugin, I let the creator answer to you

40

How did you test it by another user? Did you walk to another computer, switched browser or something else?

41

Yes, all of this… switched apartment, browser, ip :smiley: