Challenges: Possible to sign up for the same challenge more than once using multiple pseuds

Description

When creating a new ChallengeSignup, the validations check whether the same pseud has already created a sign-up for the same collection, but not whether a different pseud owned by the same user has already created a sign-up for the same collection. The only thing preventing a user with multiple pseuds from signing up with multiple pseuds is the code in ChallengeSignupsController#new that redirects the user to the edit action if they already have a sign-up in the collection. However, this check only prevents displaying the form – if you load multiple copies of the form before the first sign-up is created, you can submit as many sign-ups as you have pseuds.

Steps to Reproduce:

  1. Create a new challenge (either a gift exchange or a prompt meme) with open sign-ups.

  2. Log in as a user with multiple pseuds, or create several pseuds for this purpose.

  3. Visit the challenge profile.

  4. Open multiple copies of the challenge sign-up form in different tabs, one for each pseud.

  5. In the first tab, select your first pseud from the dropdown, fill out the rest of the form, and submit it.

  6. In the second tab, select your second pseud from the dropdown, fill out the rest of the form, and submit it.

  7. Repeat for the rest of your pseuds.

Note that if you click on the "My Signup" link in the sidebar, it'll only show you one sign-up. But if you view the list of requests, you should be able to see all of them. And if you view the list of all your challenge sign-ups, you can see all of them listed there as well.

All sign-ups created this way appear to be treated as valid sign-ups by the system. You can edit them without errors, and even run matching.

Environment

None

Assignee

Unassigned

Reporter

ticking instant

Roadmap

Challenges

Priority

Medium

Affects versions

Fix versions

None

Components

BackEnd

Difficulty

Medium

Required Access Level

None

Milestone

Internal 0.9
Configure