Jonathan M
Member
- Affected version
- 2.2.8
Steps to reproduce
1) Either visit [thread]/poll/create directly or open the thread view's 'create poll' link in a new tab.
2) Fill the form and submit.
3) The page will submit to itself, creating the poll, but will then redirect to itself and display a no permission error.
This happens because XF\ControllerPlugin\Poll::actionCreate uses a dynamic redirect after the poll is created. Since these 2 scenarios don't have referrers or ajax referrers, and since the poll creation form doesn't provide a redirect url, it just redirects to itself.
The no permission error is correct though, albeit misleading. Another poll can't be created because the thread type is now poll.
1) Either visit [thread]/poll/create directly or open the thread view's 'create poll' link in a new tab.
2) Fill the form and submit.
3) The page will submit to itself, creating the poll, but will then redirect to itself and display a no permission error.
This happens because XF\ControllerPlugin\Poll::actionCreate uses a dynamic redirect after the poll is created. Since these 2 scenarios don't have referrers or ajax referrers, and since the poll creation form doesn't provide a redirect url, it just redirects to itself.
The no permission error is correct though, albeit misleading. Another poll can't be created because the thread type is now poll.