fixed a bug where search returned internal pages to unauthenticated users

pkg/db/page.go

@@ -38,6 +38,19 @@ func (db *DB) GetAllPages(username string) (pages core.Pages) {
 	return
 }
 
+func (db *DB) ValidatePage(st, username string) bool {
+	p := db.cache.Get(st)
+	if p == nil {
+		p, err := db.getPage(st, username)
+		if err != nil {
+			return false
+		}
+		db.cache.Add(st, p)
+		return true
+	}
+	return core.ReadPerm(username, p)
+}
+
 func (db *DB) GetPage(section, title, username string) (p *core.Page, err error) {
 	st := render.StoreTitle(section, title)
 	p = db.cache.Get(st)

pkg/server/handler.go

@@ -181,7 +181,17 @@ func searchHandler(ctx *Context) {
 			ctx.Error(err)
 			return
 		}
-		ctx.Data.Data = res
+		user := ctx.User()
+		r := make([]core.Result, len(res))
+		i := 0
+		for _, v := range res {
+			if ctx.Srv.DB.ValidatePage(v.StoreTitle, user) {
+				r[i] = v
+				i++
+			}
+		}
+
+		ctx.Data.Data = r[:i]
 		ctx.Data.Search = search
 		ctx.Exec()
 	}