Search results and user's list of replies show replies from protected topics to everyone

[tatiana_k]

The issue is about the replies in the password protected topics.

When a person enters the password protected topic name (or a part of it, or just some words that hidden replies can include) in the Search field, the forum shows the list of replies without any restrictions. While the title says that the topic is protected, the content of the reply is not hidden at all, and anyone can read it.
The link is like that: ​http://example.com/forum/search/my-search-words

The same is with the list of user's replies in their profile. Everyone can read all the replies, even those in protected topics.
The link is like that: ​http://example.com/forum/users/user_name/replies

I possess that replies from hidden topics should be either excluded from the search results and replies list at all, or their content should be hidden.

[johnjamesjacoby]

You're probably right, and it's a case I hadn't considered. Password protected forums and topics are really only loosely supported currently, so we'll need to spend some time looking into what fully supporting it should look like.

Going to move this into 2.7, because 2.5 and 2.6 are filling up.

Any patches or discussion are welcome and encouraged.

Thanks for the report.

[netweb]

Related: #2517

[johnjamesjacoby]

Bumping all 2.7 to 2.8 milestone.