If i reload page with my name in link (?u=username) 300 times, i’ll get this badge. How do secure it?
AI-generated summary
The discussion revolves around verifying the uniqueness of users for the “hot link” badge in Discourse. pkulkov initially reported an issue where reloading a link with their username multiple times granted the badge, raising a security concern. SidV suggested using the Data Explorer Plugin to create a query, but pkulkov revealed that the “hot link” badge uses a different query.
zogstrip provided the correct query for the Hot Link badge, and mikechristopher provided the query for the “nice share” badge. pkulkov discovered that their instance of Discourse granted the badge after reloading the link 25 times, but meta.discourse.org did not. codinghorror suggested that this might be due to an incorrect configuration where the correct user IP is not passed through.
After testing, pkulkov confirmed that the issue is indeed related to the IP address, as the badge was not granted when accessing the link from a different IP.
Well, I did it…
- Use Data Explorer Plugin.
- Create new query
- Use this query
- Execute and view the “clicks” on your topic
- Open that “topic” on new window, and repload that page with your user’s link a few times… such 10 times or less.
- Re-execute the query… do you see changes? (I do not.)
Finish the test… check complete ![]()
This query is like “Great share” badge. In Hot link different query. I’ll test it.
Ah… I don’t use English language right now on admin panel.
What badge’s id is the “hot link” badge?
I don’t use it too))
30 is like your query,
21 - hot link
What query is in this badge?
https://meta.discourse.org/badges/29/hot-link
Here’s the query for the Hot Link badge
Tnx.
And what query for this?
https://meta.discourse.org/badges/21/nice-share
Thnx.
My instance of discourse granted me this badge after reloading link with my username 25 times by myself, but meta.discourse.org didn’t. Why?
Probably an error in configuration where the correct user IP is not passed through on your site?
![]()
Hmm… It was the same IP. I’ll try from another.
Looks like this is it. From another IP badge not granted