From d57758daf9d1348bb0f63501bb9e191426980d32 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 16 Jul 2026 10:40:12 +0000
Subject: [PATCH] Fix infinite redirect loop after OTP verification in
 phone-verified surveys

participateSurvey() only checked session "user" (admin) instead of the
participant's own "participator" session, so a successfully OTP-verified
participant kept bouncing between /d/{slug} and /participate, spamming
requests until the host's rate limiter kicked in.
---
 app/controllers/main.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/main.php b/app/controllers/main.php
index faa2411..8fa709f 100644
--- a/app/controllers/main.php
+++ b/app/controllers/main.php
@@ -204,7 +204,7 @@ public function participateSurvey(string $slug)
             ]);
         }
         
-        if ($survey->verifyPhone && !session_check("user")) {
+        if ($survey->verifyPhone && !session_check("user") && !session_check("participator")) {
             session_set("surveySlug", $slug);
             session_set("surveyId", $survey->id);
             redirect("/participate");