[QGIS-Developer] Rating abuse issue on the QGIS Plugins Website

[Lova Andriarimalala]

Hello everyone,

Following the plugin rating abuse issue reported at
https://github.com/qgis/QGIS-Plugins-Website/issues/416 and
https://github.com/qgis/QGIS-Plugins-Website/issues/420, I wonder if
someone could help or share some thoughts about it.

We have released some fixes to enforce throttles (
https://github.com/qgis/QGIS-Plugins-Website/pull/418), reject forged
cookies and add a cap votes per address (
https://github.com/qgis/QGIS-Plugins-Website/pull/423). However, it is not
fully working because every IP recorded against a vote is a Cloudflare edge
IP, not a real user IP. I checked 100 recent votes against Cloudflare's
published ranges: 100 out of 100 match. So the per-IP cap is counting
Cloudflare's proxy pool, which rotates per request. So, storing real client
IPs would probably require some discussions regarding GDPR and retention
angle.

The reporter also asks us to (a) purge the fake votes and recompute the
affected plugin scores, and (b) require a logged-in account to vote. Both
are policy calls, not just code. And noting that the latter will probably
break how the QGIS Desktop plugin manager submits ratings anonymously over
XML-RPC.

Thanks so much in advance for any input.

Lova Andriarimalala


*QGIS Full Stack Developer   *
*T *: +27(0) 87 809 2702          *E *: lova at kartoza.com          *W* :
kartoza.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/qgis-developer/attachments/20260819/82c268ff/attachment.htm>