[BUG] Search is revealing invisible space content

[001101]

Hello,

running a public HumHub as community and just noticed that content from invisible spaces are completely visible in the search.

Running HumHub 1.2.1 and did now a update to 1.2.2, but same results.

Tested it with another keyword and it seems, that it only appears to posts which involves a image, maybe that is the bug?

It was revealed the whole post with answers.

Tested it also with different testing users, which was created with a timespan from 1 year and it appears on both of them, both of them are normal users, which have no permissions on viewing this private space , which was never in it and was never been admin.

Best wishes

system: kvm based vps, centos 7.3, php7, apache2, nginx proxy

[001101]

So now, did today the update to 1.2.3 and now the search is reveling any content for guests, without being logged in!

Can someone (@buddh4) please tell me how to stop that?

[001101]

Fixed it for myself, but I think it is a bug or my files are not completly updated by the updater module, some things are strange sometimes on this old installation, the rewrite rule for users is also not working and has never, whatever, here is the fix:

/protected/humhub/modules/search/controllers/SearchController.php

public function behaviors()
{
return [
'acl' => [
'class' => \humhub\components\behaviors\AccessControl::className(),
'guestAllowedActions' => ['login']
]
];
}

Which unfortunately does not working as expected (in DirectoryController.php it does, maybe in future), but it stops the search function for guests.

[Felli]

@001101 You should try modifying the following which is how the notifications overview.

public function behaviors()
    {
        return [
            'acl' => [
                'class' => \humhub\components\behaviors\AccessControl::className(),
            ]
        ];
    }

    /**
     * Returns a List of all notifications for the session user
     */
    public function actionIndex()
    {
        if (Yii::$app->user->isGuest) {
            return Yii::$app->user->loginRequired();
        }