fix: dont show search input if user doesn't have tag search priv

NodeBB · Mar 27, 2023 · a83734f · a83734f
1 parent 68db271
commit a83734f
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 12 deletions.
diff --git a/public/src/modules/tagFilter.js b/public/src/modules/tagFilter.js
@@ -27,12 +27,17 @@ define('tagFilter', ['hooks', 'alerts', 'bootstrap'], function (hooks, alerts, b
 		}
 		initialTags = selectedTags.slice();
 
+		const toggleSearchVisibilty = searchEl.parent('[component="tag/filter"]').length &&
+			app.user.privileges['search:tags'];
+
 		el.on('show.bs.dropdown', function () {
-			el.find('.dropdown-toggle').css({ visibility: 'hidden' });
-			searchEl.removeClass('hidden');
-			searchEl.css({
-				'z-index': el.find('.dropdown-toggle').css('z-index') + 1,
-			});
+			if (toggleSearchVisibilty) {
+				el.find('.dropdown-toggle').css({ visibility: 'hidden' });
+				searchEl.removeClass('hidden');
+				searchEl.css({
+					'z-index': el.find('.dropdown-toggle').css('z-index') + 1,
+				});
+			}
 
 			function doSearch() {
 				const val = searchEl.find('input').val();
@@ -61,8 +66,11 @@ define('tagFilter', ['hooks', 'alerts', 'bootstrap'], function (hooks, alerts, b
 		});
 
 		el.on('hidden.bs.dropdown', function () {
-			el.find('.dropdown-toggle').css({ visibility: 'inherit' });
-			searchEl.addClass('hidden');
+			if (toggleSearchVisibilty) {
+				el.find('.dropdown-toggle').css({ visibility: 'inherit' });
+				searchEl.addClass('hidden');
+			}
+
 			searchEl.off('click');
 			searchEl.find('input').off('keyup');
 

diff --git a/src/socket.io/topics/tags.js b/src/socket.io/topics/tags.js
@@ -73,11 +73,6 @@ module.exports = function (SocketTopics) {
 
 	// used by tag filter search
 	SocketTopics.tagFilterSearch = async function (socket, data) {
-		const allowed = await privileges.global.can('search:tags', socket.uid);
-		if (!allowed) {
-			throw new Error('[[error:no-privileges]]');
-		}
-
 		let cids = [];
 		if (Array.isArray(data.cids)) {
 			cids = await privileges.categories.filterCids('topics:read', data.cids, socket.uid);
@@ -87,6 +82,10 @@ module.exports = function (SocketTopics) {
 
 		let tags = [];
 		if (data.query) {
+			const allowed = await privileges.global.can('search:tags', socket.uid);
+			if (!allowed) {
+				throw new Error('[[error:no-privileges]]');
+			}
 			tags = await topics.searchTags({
 				query: data.query,
 				cid: cids.length === 1 ? cids[0] : null,