sbp-jm
/
sbp-flarum-search
1
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases 2 Wiki Activity

prevent leaking deleted discussions

This commit is contained in:
Daniël Klabbers 2022-02-28 20:32:27 +01:00
parent cc8145c236
commit c6fd942bf1
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Api/Controllers/SearchController.php
View File

@ -131,8 +131,13 @@ class SearchController extends ListDiscussionsController
$discussions = Discussion::query() $discussions = Discussion::query()
->select('discussions.*') ->select('discussions.*')
->join('posts', 'posts.discussion_id', 'discussions.id') ->join('posts', 'posts.discussion_id', 'discussions.id')
// Extra safety to prevent leaking hidden discussion (titles) towards search results.
->when(! $actor->hasPermission('discussion.hide'), fn($query) => $query->whereNull('hidden_at'))
->where(function ($query) use ($results) {
$query
->whereIn('discussions.id', $results->pluck('discussion_id')->filter()) ->whereIn('discussions.id', $results->pluck('discussion_id')->filter())
->orWhereIn('posts.id', $results->pluck('most_relevant_post_id')->filter()) ->orWhereIn('posts.id', $results->pluck('most_relevant_post_id')->filter())
})
->get() ->get()
->each(function (Discussion $discussion) use ($results) { ->each(function (Discussion $discussion) use ($results) {
if (in_array($discussion->id, $results->pluck('discussion_id')->toArray())) { if (in_array($discussion->id, $results->pluck('discussion_id')->toArray())) {