Simple Machines Community Forum

SMF Development => Bug Reports => Topic started by: vbgamer45 on March 24, 2019, 01:10:27 AM

Title: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: vbgamer45 on March 24, 2019, 01:10:27 AM
#### Description
If you have a board/membergroup with post approval.  Replies made by admins/mods will be searchable in the SMF search system.
And also shown in action=recent page as well... Affects SSI functions as well such as recent posts.

### Steps to reproduce
1. Turn on poster moderation for a membergroup
2. Post as that membergroup in causing a topic to require approval.
3. Post as an admin to reply to that topic. Enter text for example such as "hidden"
4. Then logout and search as guest on your forum and search for "hidden" and it will appear in search results.


Affects SMF 2.0.x and SMF 2.1 RC1 reported on github

Title: Re: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: Arantor on March 25, 2019, 06:31:53 PM
Reason: the replies are marked approved and search doesn't filter to topic level approved - but to individual message level approval.

I actually think this has been reported before.
Title: Re: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: vbgamer45 on March 25, 2019, 06:34:40 PM
Yeah, I saw when looking at the code. It applies to recent.php as well as SSI hopefully not to big of a performance hit.
Title: Re: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: Arantor on March 25, 2019, 06:35:24 PM
Adding the join to topics could conceivably be a big hit :(
Title: Re: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: shawnb61 on February 23, 2020, 08:54:08 PM
I have a proposal for this one...  I don't think I want to add the other join in there for the reasons described above.

But... 

Could we simply have the post inherit the 'approved' flag from the original post?  No DB hit...  So the admin/mod posts will not be visible until approved as well?
Title: Re: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: live627 on February 24, 2020, 02:24:19 AM
Check the query on line 1747 in Search.php, it joins smf_topics only if sorting by num_replies.
Title: Re: [2.0] Post Approval Admin/Moderator Reply Search System Disclosure
Post by: Illori on February 24, 2020, 05:02:37 AM
what about replies by the person that started the topic? not always are those moderated but should not be searchable until the topic is approved. think about our showcase board here.