Hello everyone, Following the plugin rating abuse issue reported at https://github.com/qgis/QGIS-Plugins-Website/issues/416 and https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if someone could help or share some thoughts about it.
We have released some fixes to enforce throttles ( https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged cookies and add a cap votes per address ( https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is not fully working because every IP recorded against a vote is a Cloudflare edge IP, not a real user IP. I checked 100 recent votes against Cloudflare's published ranges: 100 out of 100 match. So the per-IP cap is counting Cloudflare's proxy pool, which rotates per request. So, storing real client IPs would probably require some discussions regarding GDPR and retention angle. The reporter also asks us to (a) purge the fake votes and recompute the affected plugin scores, and (b) require a logged-in account to vote. Both are policy calls, not just code. And noting that the latter will probably break how the QGIS Desktop plugin manager submits ratings anonymously over XML-RPC. Thanks so much in advance for any input. Lova Andriarimalala *QGIS Full Stack Developer * *T *: +27(0) 87 809 2702 *E *: [email protected] *W* : kartoza.com
_______________________________________________ QGIS-Developer mailing list [email protected] List info: https://lists.osgeo.org/mailman/listinfo/qgis-developer Unsubscribe: https://lists.osgeo.org/mailman/listinfo/qgis-developer
