Admin Search - no unplubished Pages can be searched

[Erik Richter]

Hey folks,

If I search for a page that is unpublished it can not be found by using the ajax search in the right corner in admin. 

It can only be found when I am logged in as a Superuser, but not if I am logged in as an Editor (who has page-edit rights!). 

Searching through lister works - but only if I choose to only search unpublished pages; but not via the ajax search at all.

I already looked at the process page search module file and there is a line that allows unpublished pages to be searched if someone has paeg-edit rights, but somehow it does not work at all.

Can someone help?

Thank you so much!

[Jan Romero]

I would like to take issue with this as well. It’s awkward for non-superusers not to find pages (or other users) they can otherwise reach, and I don’t really see why this restriction is in place by default. It is also not easy to implement a hook to change this behavior, which would be trivial to do the other way around.

I.e. if the “include” parameter weren’t overridden by the Process function, that feature could be retrofitted like so:

wire()->addHookBefore('ProcessPageSearch::executeFor', function($event) {
    if(!$this->user->isSuperuser())
        wire()->input->get->include = 'hidden';
});

As well as any other custom restrictions one might need to respect custom roles and permissions.

However, as it is now the restriction is hardcoded into the function and I’m not sure how to modify it in a non-destructive manner.

Are there security reasons for the way it’s currently done?

[Soma]

This is like this since a long time already. I'm surprized this has never been addressed.

[adrian]

This should be fixed now: https://github.com/ryancramerdesign/ProcessWire/commit/d45781d5af21e6aa6b838463a2acc4bcecbcc1a4

Can you guys test and confirm?

[Jan Romero]

I’m not on 3.0, but I figured I’d just swap out the function and it’s working fine. Users still won’t show up even if you’re allowed to edit them, but that seems to be a separate issue I opened on GitHub.