From 629c1549b549253020011531ff9af2ff030c49b5 Mon Sep 17 00:00:00 2001
From: raven <citrons@mondecitronne.com>
Date: Fri, 30 Oct 2026 20:17:50 -0500
Subject: exclude posts that user does not have permission to see from
 search/user page

---
 apioforum/forum.py |  3 ++-
 apioforum/user.py  | 32 ++++++++++++++++----------------
 2 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/apioforum/forum.py b/apioforum/forum.py
index 79bb3ee..3abe839 100644
--- a/apioforum/forum.py
+++ b/apioforum/forum.py
@@ -546,7 +546,7 @@ def search():
 		results = db.execute("""
 		SELECT posts.id, highlight(posts_fts, 0, '<mark>', '</mark>') AS 
 			content, posts.thread, posts.author, posts.created, posts.edited, 
-			posts.updated, threads.title AS thread_title
+			posts.updated, threads.title AS thread_title, threads.forum
 		FROM posts_fts
 		JOIN posts ON posts_fts.rowid = posts.id
 		JOIN threads ON threads.id = posts.thread
@@ -559,6 +559,7 @@ def search():
 		print(e)
 		flash('your search query was malformed.')
 		return redirect(url_for("forum.not_actual_index"))
+	results = [p for p in results if has_permission(p['forum'], g.user, "p_view_threads")]
 
 	display_thread_id = [ True ] * len(results)
 	last_thread = None
diff --git a/apioforum/user.py b/apioforum/user.py
index cead2fe..a41707d 100644
--- a/apioforum/user.py
+++ b/apioforum/user.py
@@ -7,6 +7,7 @@ from flask import (
 
 from werkzeug.security import check_password_hash, generate_password_hash
 from .db import get_db
+from .roles import has_permission
 import math
 
 bp = Blueprint("user", __name__, url_prefix="/user")
@@ -14,30 +15,29 @@ bp = Blueprint("user", __name__, url_prefix="/user")
 @bp.route("/<username>")
 @bp.route("/<username>/page/<int:page>")
 def view_user(username, page=1):
-	if page < 1:
-		abort(400)
-	
 	db = get_db()
 	user = db.execute("SELECT * FROM users WHERE username = ?;",(username,)).fetchone()
-   
+
+	if page < 1:
+		abort(404)
 	if user is None:
 		abort(404)
 	posts = db.execute("""
-		SELECT * FROM posts
-		JOIN public_posts ON public_posts.id = posts.id
-		WHERE author = ? AND deleted = 0 AND public_posts.public
-		ORDER BY created DESC
-		LIMIT ? OFFSET ?;""",(username,POSTS_PER_PAGE,(page-1)*POSTS_PER_PAGE,)).fetchall()
-	num_posts = db.execute("""
-		SELECT count(*) as count FROM posts
-		JOIN public_posts ON public_posts.id = posts.id
-		WHERE author = ? AND public_posts.public;
-		""",(username,)).fetchone()['count']
-	max_pageno = math.ceil(num_posts/POSTS_PER_PAGE)
+		SELECT posts.*, threads.forum FROM posts
+		JOIN threads ON threads.id = posts.thread
+		WHERE author = ? AND deleted = 0
+		ORDER BY created DESC;""",(username,)).fetchall()
+	posts = [p for p in posts if has_permission(p['forum'], g.user, "p_view_threads")]
+	max_pageno = math.ceil(len(posts)/POSTS_PER_PAGE)
+	if max_pageno > 0 and page > max_pageno:
+		abort(404)
+
+	start = min((page-1)*POSTS_PER_PAGE, len(posts))
+	end = min(start + POSTS_PER_PAGE, len(posts))
 	return render_template(
 		"view_user.html",
 		user=user,
-		posts=posts,
+		posts=posts[start:end],
 		page=page,
 		max_pageno=max_pageno,
 	)
-- 
cgit v1.2.3