make search results privacy-aware

actions/noticesearch.php

@@ -63,6 +63,21 @@ class NoticesearchAction extends SearchAction
                             303);
         }
 
+        if (!empty($this->q)) {
+
+            $profile = Profile::current();
+            $stream  = new SearchNoticeStream($this->q, $profile);
+            $page    = $this->trimmed('page');
+
+            if (empty($page)) {
+                $page = 1;
+            } else {
+                $page = (int)$page;
+            }
+
+            $this->notice = $stream->getNotices((($page-1)*NOTICES_PER_PAGE), NOTICES_PER_PAGE + 1);
+        }
+
         common_set_returnto($this->selfUrl());
 
         return true;
@@ -117,18 +132,25 @@ class NoticesearchAction extends SearchAction
      */
     function showResults($q, $page)
     {
-        $notice        = new Notice();
+        if ($this->notice->N === 0) {
-
+            $this->showEmptyResults($q, $page);
-        $search_engine = $notice->getSearchEngine('notice');
-        $search_engine->set_sort_mode('chron');
-        // Ask for an extra to see if there's more.
-        $search_engine->limit((($page-1)*NOTICES_PER_PAGE), NOTICES_PER_PAGE + 1);
-        if (false === $search_engine->query($q)) {
-            $cnt = 0;
-        } else {
-            $cnt = $notice->find();
         }
-        if ($cnt === 0) {
+
+        if (Event::handle('StartNoticeSearchShowResults', array($this, $q, $this->notice))) {
+            $terms = preg_split('/[\s,]+/', $q);
+            $nl = new SearchNoticeList($this->notice, $this, $terms);
+            $cnt = $nl->show();
+            $this->pagination($page > 1,
+                              $cnt > NOTICES_PER_PAGE,
+                              $page,
+                              'noticesearch',
+                              array('q' => $q));
+            Event::handle('EndNoticeSearchShowResults', array($this, $q, $this->notice));
+        }
+    }
+
+    function showEmptyResults($q, $page)
+    {
             // TRANS: Text for notice search results is the query had no results.
             $this->element('p', 'error', _('No results.'));
 
@@ -148,15 +170,6 @@ class NoticesearchAction extends SearchAction
             $this->raw(common_markup_to_html($message));
             $this->elementEnd('div');
             return;
-        }
-        if (Event::handle('StartNoticeSearchShowResults', array($this, $q, $notice))) {
-            $terms = preg_split('/[\s,]+/', $q);
-            $nl = new SearchNoticeList($notice, $this, $terms);
-            $cnt = $nl->show();
-            $this->pagination($page > 1, $cnt > NOTICES_PER_PAGE,
-                              $page, 'noticesearch', array('q' => $q));
-            Event::handle('EndNoticeSearchShowResults', array($this, $q, $notice));
-        }
     }
 
     function showScripts()

classes/Memcached_DataObject.php

@@ -273,24 +273,23 @@ class Memcached_DataObject extends Safe_DataObject
     function getSearchEngine($table)
     {
         require_once INSTALLDIR.'/lib/search_engines.php';
-        static $search_engine;
+
-        if (!isset($search_engine)) {
+        if (Event::handle('GetSearchEngine', array($this, $table, &$search_engine))) {
-            if (Event::handle('GetSearchEngine', array($this, $table, &$search_engine))) {
+            if ('mysql' === common_config('db', 'type')) {
-                if ('mysql' === common_config('db', 'type')) {
+                $type = common_config('search', 'type');
-                    $type = common_config('search', 'type');
+                if ($type == 'like') {
-                    if ($type == 'like') {
+                    $search_engine = new MySQLLikeSearch($this, $table);
-                        $search_engine = new MySQLLikeSearch($this, $table);
+                } else if ($type == 'fulltext') {
-                    } else if ($type == 'fulltext') {
+                    $search_engine = new MySQLSearch($this, $table);
-                        $search_engine = new MySQLSearch($this, $table);
-                    } else {
-                        // Low level exception. No need for i18n as discussed with Brion.
-                        throw new ServerException('Unknown search type: ' . $type);
-                    }
                 } else {
-                    $search_engine = new PGSearch($this, $table);
+                    // Low level exception. No need for i18n as discussed with Brion.
+                    throw new ServerException('Unknown search type: ' . $type);
                 }
+            } else {
+                $search_engine = new PGSearch($this, $table);
             }
         }
+
         return $search_engine;
     }
 

lib/searchnoticestream.php

@@ -0,0 +1,92 @@
+<?php
+/**
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2011, StatusNet, Inc.
+ *
+ * Stream of notice results
+ * 
+ * PHP version 5
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * @category  Stream
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2011 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @link      http://status.net/
+ */
+
+if (!defined('STATUSNET')) {
+    // This check helps protect against security problems;
+    // your code file can't be executed directly from the web.
+    exit(1);
+}
+
+/**
+ * Stream of notice search results
+ *
+ * @category  General
+ * @package   StatusNet
+ * @author    Evan Prodromou <evan@status.net>
+ * @copyright 2011 StatusNet, Inc.
+ * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @link      http://status.net/
+ */
+
+class SearchNoticeStream extends ScopingNoticeStream
+{
+    function __construct($q, $profile = -1)
+    {
+        if (is_int($profile) && $profile == -1) {
+            $profile = Profile::current();
+        }
+
+        parent::__construct(new RawSearchNoticeStream($q), $profile);
+    }
+}
+
+class RawSearchNoticeStream extends NoticeStream
+{
+    protected $q;
+
+    function __construct($q)
+    {
+        $this->q = $q;
+    }
+
+    function getNoticeIds($offset, $limit, $since_id, $max_id)
+    {
+        $notice = new Notice();
+
+        $search_engine = $notice->getSearchEngine('notice');
+        $search_engine->set_sort_mode('chron');
+
+        $search_engine->limit($offset, $limit);
+
+        $ids = array();
+
+        // wtf?
+
+        $search_engine->query($this->q);
+
+        if ($notice->find()) {
+            while ($notice->fetch()) {
+                $ids[] = $notice->id;
+            }
+        }
+
+        return $ids;
+    }
+}