From: Scott Worley <scottworley@scottworley.com>
Date: Sun, 7 Apr 2024 13:12:24 +0000 (-0700)
Subject: Disallow voting for eliminated candidates server-side
X-Git-Tag: v0.3.0~1
X-Git-Url: http://git.scottworley.com/voter/commitdiff_plain/5ee4072bf723ad5b091bcf8e5869382fed9f00ba?hp=82977580a924521c805fb47231bdfaf968923a15

Disallow voting for eliminated candidates server-side
---

diff --git a/Changelog.md b/Changelog.md
index ade0188..9ba73d5 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,3 +1,8 @@
+# Unreleased
+
+New feature: Eliminated candidates
+
+
 # 0.2.6 (November 23, 2022)
 
 Add license, README, and Changelog
diff --git a/src/main.rs b/src/main.rs
index 1ec9d9c..92937e5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -275,6 +275,13 @@ fn record_vote(dir: &Path, request: &cgi::Request) -> Result<cgi::Response, cgi:
     {
         return Err(cgi::text_response(415, "Invalid vote"));
     }
+    let elim =
+        read_elim_list(dir).map_err(|_| cgi::text_response(503, "Couldn't read eliminations"))?;
+    if elim.contains(
+        std::str::from_utf8(&body[2..]).map_err(|_| cgi::text_response(415, "Vote not UTF-8"))?,
+    ) {
+        return Err(cgi::text_response(403, "Candidate eliminated"));
+    }
     write_vote(dir, get_voter(request)?, body)
         .map_err(|_| cgi::text_response(503, "Couldn't record vote"))?;
     Ok(cgi::text_response(200, "Vote recorded"))