How to check the uniqueness of users in "hot link" badge?

AI-generated summary

The discussion revolves around verifying the uniqueness of users for the “hot link” badge in Discourse. pkulkov initially reported an issue where reloading a link with their username multiple times granted the badge, raising a security concern. SidV suggested using the Data Explorer Plugin to create a query, but pkulkov revealed that the “hot link” badge uses a different query.

zogstrip provided the correct query for the Hot Link badge, and mikechristopher provided the query for the “nice share” badge. pkulkov discovered that their instance of Discourse granted the badge after reloading the link 25 times, but meta.discourse.org did not. codinghorror suggested that this might be due to an incorrect configuration where the correct user IP is not passed through.

After testing, pkulkov confirmed that the issue is indeed related to the IP address, as the badge was not granted when accessing the link from a different IP.

If i reload page with my name in link (?u=username) 300 times, i’ll get this badge. How do secure it?

Well, I did it…

  1. Use Data Explorer Plugin.
  2. Create new query
  3. Use this query
  4. Execute and view the “clicks” on your topic
  5. Open that “topic” on new window, and repload that page with your user’s link a few times… such 10 times or less.
  6. Re-execute the query… do you see changes? (I do not.)

Finish the test… check complete :wink:

Ps, query’s list updated :rocket:

This query is like “Great share” badge. In Hot link different query. I’ll test it.

Ah… I don’t use English language right now on admin panel.
What badge’s id is the “hot link” badge?

I don’t use it too))
30 is like your query,
21 - hot link

What query is in this badge?
https://meta.discourse.org/badges/29/hot-link

Here’s the query for the Hot Link badge

Tnx.
And what query for this?
https://meta.discourse.org/badges/21/nice-share

Thnx.
My instance of discourse granted me this badge after reloading link with my username 25 times by myself, but meta.discourse.org didn’t. Why?

Probably an error in configuration where the correct user IP is not passed through on your site?

:face_with_monocle:
Hmm… It was the same IP. I’ll try from another.

Looks like this is it. From another IP badge not granted