From b040201764a0b7815df7ab3973296d201ad7f3e9 Mon Sep 17 00:00:00 2001
From: psychobunny <psycho.bunny@hotmail.com>
Date: Thu, 26 Jun 2014 13:52:47 -0400
Subject: [PATCH] prevent hax voting via websockets if system disabled

---
 src/favourites.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/favourites.js b/src/favourites.js
index a1a7b63fea..8a032cdcdc 100644
--- a/src/favourites.js
+++ b/src/favourites.js
@@ -98,10 +98,18 @@ var async = require('async'),
 	}
 
 	Favourites.upvote = function(pid, uid, callback) {
+		if (meta.config['votingEnabled'] === false) {
+			return callback(false);
+		}
+		
 		toggleVote('upvote', pid, uid, callback);
 	};
 
 	Favourites.downvote = function(pid, uid, callback) {
+		if (meta.config['votingEnabled'] === false) {
+			return callback(false);
+		}
+
 		user.getUserField(uid, 'reputation', function(err, reputation) {
 			if (reputation < meta.config['privileges:downvote']) {
 				return callback(new Error('[[error:not-enough-reputation-to-downvote]]'));