Skip to:
Content

bbPress.org

Opened 2 years ago

Closed 3 weeks ago

#3473 closed defect (bug) (fixed)

Search displays hidden forums to participants

Reported by: wpsolr's profile wpsolr Owned by: johnjamesjacoby's profile johnjamesjacoby
Milestone: 2.6.10 Priority: high
Severity: normal Version: 2.6.9
Component: Component - Search Keywords: needs-patch
Cc:

Description

Hi,

1) I created a hidden forum with topics and replies as a keymaster
2) I logged in as a Participant
3) A search will not display topics and replies as expected, but the forum itself is displayed!
4) Clicking on the forum shows a 404 page, as expected

WordPress 6.0
Plugins active: bbPress, Classic Editor

Attachments (6)

bbpress-track-support-hidden-forum-in-search.png (457.2 KB) - added by wpsolr 2 years ago.
Capture of search showing a hidden forum to a particpant
bbpress-track-support-hidden-forum-in-search-1.png (429.3 KB) - added by wpsolr 2 years ago.
Hidden forum not shown in list, as expected
bbpress-track-support-hidden-forum-in-search-2.png (701.2 KB) - added by wpsolr 2 years ago.
Hidden forum settings
bbpress-track-support-hidden-forum-in-search-3.png (836.0 KB) - added by wpsolr 2 years ago.
All topics of hidden forum not shown on search, as expected
bbpress-track-support-hidden-forum-in-search-4.png (780.8 KB) - added by wpsolr 2 years ago.
Participant role
bbpress-track-support-hidden-forum-in-search-5.png (757.7 KB) - added by wpsolr 2 years ago.
Hidden forum created by keymaster (not by the participant)

Change History (11)

@wpsolr
2 years ago

Capture of search showing a hidden forum to a particpant

@wpsolr
2 years ago

Hidden forum not shown in list, as expected

@wpsolr
2 years ago

Hidden forum settings

@wpsolr
2 years ago

All topics of hidden forum not shown on search, as expected

@wpsolr
2 years ago

Hidden forum created by keymaster (not by the participant)

#1 @johnjamesjacoby
2 years ago

  • Keywords needs-patch added
  • Milestone changed from Awaiting Review to 2.6.10
  • Owner set to johnjamesjacoby
  • Priority changed from normal to high
  • Status changed from new to assigned

#2 @Robin W
2 years ago

I could not replicate this in my test site.

User has not responded further in support topic

https://bbpress.org/forums/topic/search-displays-hidden-forums-to-participants/

#3 @Robin W
2 years ago

correction, I've now replicated

the issue is in \bbpress\includes\search\template.php line 49 onwards

mods and above get permissions to see all from line 50 which sets a list of {{{#!php
<?php
$defaultpost_status?
}}}

participants/spectators get {{{#!php
<?php
$defaultperm? = 'readable'
}}}

set instead of {{{#!php

<?php
$defaultpost_status?.
}}}

'perm' is a wordpress wp_query setting, and wordpress does not have 'hidden' status, so allows hidden forums to show, nit sure why, but it does !

if the 'else' line is revised to set permissions, then all works as it should

this filter fixes

add_filter ('bbp_after_has_search_results_parse_args', 'bsp_search_hide_hidden_forums') ;


<?php
function bsp_search_hide_hidden_forums ($args) {
                if (!empty($args['perm'])) {
                unset ($args['perm']) ;
                $post_statuses = array(bbp_get_public_status_id()) ;
                // Add support for private status
                if ( current_user_can( 'read_private_topics' ) || current_user_can( 'read_private_forums' ) ) {
                        $post_statuses[] = bbp_get_private_status_id();
                }
                // Add support for hidden status
                if ( current_user_can( 'read_hidden_forums' )) {
                        $post_statuses[] = bbp_get_hidden_status_id();
                }
                // Join post statuses together
                $args['post_status'] = $post_statuses;
        }
return $args ;
}
Last edited 2 years ago by Robin W (previous) (diff)

#4 @johnjamesjacoby
3 weeks ago

This is a fun one, because it is a combination of bugs!

  1. "Hidden" forum IDs are being excluded via a meta_query through bbp_pre_get_posts_normalize_forum_visibility(), but that doesn't work on the forums themselves because they don't store their own forum ID in their own meta data.
  2. "Private" forum IDs are only being made visible to: Key Masters, or the authors of the private forums.

I have a fix for both incoming.

#5 @johnjamesjacoby
3 weeks ago

  • Resolution set to fixed
  • Status changed from assigned to closed

In 7262:

Search: prevent hidden forums from appearing in results.

This change includes the following changes:

  • Removes readable perm check from bbp_has_search_results() and replaces it with public topic statuses by default, while conditionally adding private & hidden statuses if user is capable
  • Tweaks the logic inside of bbp_pre_get_posts_normalize_forum_visibility() to always handle both of its internal conditions (forum query, or any query that includes forums/topics/replies connected via meta data)
  • Tweaks output of content-search.php template part to not show the "Oh bother" error when visiting a search page for the first time
  • Adds a string feedback-no-search.php template part to address both "no results" and "no terms" conditions

These changes address some faulty search logic that was allowing hidden forums to appear in global search results to users who should not have been able to see them, while also improving the search page experience itself.

Fixes #3473.

Props wpsolr, robin-w.

In branches/2.6, for 2.6.10.

Note: See TracTickets for help on using tickets.