Skip to content
Latest commit 0169f59 @pixeltrix pixeltrix Prevent signing when petition is closed
Whilst the petition page shows that the petition is closed and removes
the link to the new signature form there is nothing to stop someone
editing the url to go to the form directly. This may be an innocent
mistake where someone has followed a link to the form directly.

To stop this from happening we need to detect the petition has closed
in four places. The first is on the form, the second is when confirming
your email address, the third is when actually trying to create the
signature and then finally when someone follows a validation link after
the petition has closed.

I did consider adding a petition closed check in the Signature model
but decided against it because it would caused extra contention in a
process that is already a hot spot and would still not prevent race
conditions occurring where a petition is being closed as the signature
was being validated. The only way to prevent those race conditions
would be a check constraint or trigger in the database which again
would introduce contention on the petitions table. It's good enough
that signing is halted within a few seconds after midnight on the
closing date of the petition.
Something went wrong with that request. Please try again.