1

How can I limit submissions within a period of time?

I am moving from webforms to entity forms and need to limit the number of submissions a user can make within a given time. I want to restrict access to form based on this. This would be only apply to anonymous users.

  • List item

1 Submission per week 3 submission per day etc. Similar to the setting on webforms

Improve this question
7
  • You cannot use the user ID since anonymous users all have ID 0. The only thing you can do is either setting a cookie (but users can delete that and resubmit) or you can track the IP address (but the IP changes at least once a day). So technically there is no reliable somution for that. Workarounds like email confirmation have the same problem because everybody can have/create multiple. – schlicki Feb 18 '17 at 10:11
  • "the IP changes at least once a day" - that's not necessarily true. My home ip address has not changed in two years. – Jaypan Feb 19 '17 at 5:09
  • @Brent - are submissions open to anonymous users? – Jaypan Feb 19 '17 at 5:10
  • 1
    Assuming this question is about authenticated users, and about D7, then the Goals module (disclosure: I'm its maintainer ...) could be a good starting point ... but for anonymous users, there is not full-proof solution (as illustrated also by the bold phrase in the exiting answer). If both of my assumptions are confirmed, I'd be happy to convert this comment to a real answer ... PS to @Jaypan : and you only accessed the internet from your house during those 2 years? – Pierre.Vriens Feb 19 '17 at 9:05
  • 1
    @Pierre.Vriens (Goals module link has an extra 'r' ;) ). Interesting module by the way. Nice. – rovr138 Feb 20 '17 at 15:18
0

You need to identify a unique identifier.

It can't be the UID as schlicki mentioned in the comment.

You can add an email field. But if you don't add validation to this, people can just make up something up.

If you're going to add email + validation, would an account on the site be worth it?

 

Another option is a combination that identifier the browser as unique. You can look into https://github.com/Valve/fingerprintjs2. You can take all those properties and hash all of those together. That should give you a good identifier.

THIS CAN BE FOOLED. BY DEFAULT THEY WILL BE ABLE TO SUBMIT A FORM PER EACH BROWSER ON EACH DEVICE THEY HAVE.

If it doesn't have to be super strict, it would work.

This link, https://panopticlick.eff.org/ may have more information on what you're exploiting.

 

What I would do,

  • Generate a hash based on all the properties from fingerprintjs2.
  • Take that hash and add it to a hidden field
  • On submit, you can check the value
    • Validate that it's not empty.
    • Check the value in the database (you'll need a table for this)
    • If it is on your table,
      • Check when was the last time this was submitted
      • Apply your rules.
        • If it can be submitted again, perfect.
        • If it can't be submitted again, show a message. You can show how much time they need to wait for the next submission.
    • If it's not on your table,
      • Add the value to the database
      • Allow the submission through

 

That's the logic that you would have to apply.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.