--- a/usrajax.php	Thu Jan 26 00:30:58 2017 +0200
+++ b/usrajax.php	Thu Jan 26 00:38:06 2017 +0200
@@ -81,6 +81,31 @@
 
 $voteKeyId = stGetSessionItem("key_id");
 
+//
+// Check vote key validity
+//
+$sql = stPrepareSQL("SELECT * FROM votekeys WHERE id=%d", $voteKeyId);
+if (($key = stFetchSQL($sql)) === false)
+{
+  stError("Votekey does not exist.");
+}
+else
+{
+  // Validate login based on current vote key mode
+  switch (stGetSetting("voteKeyMode"))
+  {
+    case VOTE_ACTIVATE:
+      if ($key["active"] == 0)
+        stError("Votekey is not active.");
+      break;
+
+    case VOTE_ASSIGN:
+      $sql = stPrepareSQL("SELECT id FROM attendees WHERE key_id=%d", $key["id"]);
+      if (stFetchSQL($sql) === false)
+        stError("Votekey is not assigned to any user.");
+      break;
+  }
+}
 
 //
 // Handle the request
@@ -91,6 +116,7 @@
     //
     // Set vote, if voting is enabled
     //
+    $ajax = TRUE;
     if (!stChkSetting("allowVoting"))
       stError("Voting is not enabled.");
     else
@@ -113,34 +139,27 @@
     break;
 
   case "submit":
+    //
+    // Submit all votes, if voting is enabled
+    //
+    $ajax = FALSE;
     if (!stChkSetting("allowVoting"))
       stError("Voting is not enabled.");
     else
+    foreach (stExecSQL("SELECT * FROM compos WHERE visible<>0 AND voting<>0") as $compo)
     {
-      foreach (stExecSQL("SELECT * FROM compos WHERE visible<>0 AND voting<>0") as $compo)
+      stDBBeginTransaction();
+      foreach (stExecSQL("SELECT * FROM entries WHERE compo_id=".$compo["id"]) as $entry)
       {
-        stDBBeginTransaction();
-        foreach (stExecSQL("SELECT * FROM entries WHERE compo_id=".$compo["id"]) as $entry)
+        if (stCheckVoteValue("ventry".$entry["id"], $value))
         {
-          if (stCheckVoteValue("ventry".$entry["id"], $value))
-          {
-            if (!stUpdateVote($voteKeyId, $entry["id"], $value))
-              stError("Could not set vote for compo #".$compo["id"].", entry #".$entry["id"]);
-          }
+          if (!stUpdateVote($voteKeyId, $entry["id"], $value))
+            stError("Could not set vote for compo #".$compo["id"].", entry #".$entry["id"]);
         }
-        stDBCommitTransaction();
       }
-
-      if ($errorSet)
-      {
-        stSetSessionItem("mode", "error");
-        stSetSessionItem("error", $errorMsgs);
-      }
-      else
-        stSetSessionItem("mode", "done");
-
-      header("Location: ".stGetRequestItem("goto", "vote"));
+      stDBCommitTransaction();
     }
+    stSetSessionItem("mode", "done");
     break;
 
   default:
@@ -148,10 +167,22 @@
     break;
 }
 
+
 if ($errorSet)
 {
   ob_clean();
-  stDumpAJAXStatusErrors();
+  stSetSessionItem("mode", "error");
+  stSetSessionItem("error", $errorMsgs);
+}
+
+if ($ajax)
+{
+  if ($errorSet)
+    stDumpAJAXStatusErrors();
+}
+else
+{
+  header("Location: ".stGetRequestItem("goto", "vote"));
 }
 
 ob_end_flush();