Bug In `XF\Pub\Controller\Search`, `actionResults` is missing checks from `actionSearch`

[Xon]

In practice, The XF\Pub\Controller\Search::actionResults endpoint is laregly a replica of the XF\Pub\Controller\Search::actionSearch method, but with fewer checks.

• \XF::visitor()->canSearch() is not checked.
• When re-running search, it does not call $searcher->isQueryEmpty() and instead half bakes this depending on if it is a user vs a guest.
• Search is always re-run for logged in users even for an empty query or if they are not allowed todo searches...

Read more

Continue reading...