CODE:
exports.create = function (req, res) {
var article = new Article(req.body);
article.user = req.user;
console.log("1) LAST: "+article.user.last.getTime());
console.log("Date.now() "+Date.now());
if (article.user.last != null && article.user.last != undefined) {
console.log("1");
console.log("DATE: "+(Date.now() - article.user.last));
if ((Date.now() - article.user.last.getTime() > 1000 * 60 * 60)) {
article.save(function (err) {
if (err) {
return res.status(422).send({
message: errorHandler.getErrorMessage(err)
});
} else {
res.json(article);
if (article.user) {
article.user.last = Date.now();
console.log("2) LAST: "+article.user.last.getTime());
} else {
res.status(401).send({
message: 'User is not signed in'
});
}
}
});
}
else {
return res.status(422).send({
message: "You need to wait 1 hour between Article creations or if you just created an account."
});
}
}
else {
console.log("2");
article.save(function (err) {
if (err) {
return res.status(422).send({
message: errorHandler.getErrorMessage(err)
});
} else {
res.json(article);
if (article.user) {
article.user.last = Date.now();
console.log("3) LAST: "+article.user.last.getTime());
} else {
res.status(401).send({
message: 'User is not signed in'
});
}
}
});
}
};
SITUATION:
Instead of using Date.now()
, I would like to use the server time.
My anti-spam timer prevents a user from posting more than once every hour.
It works fine except for one thing: if I use Date.now(), I am able to bypass the timer by simply advancing my local clock by 1 hour.