Subject: Issue report: search function not working for private lists

From: Célestin Matte <[email-masked]>
Date: Thu, 4 Nov 2021 10:41:55 +0100

There are several issues that prevent the correct installation of search functions for private lists:
- it is only possible to define a single archive search server in pgweb's settings.py, which makes it impossible to define both a public and a private archives server,
- there does not seem to be any kind of permissions verifications in pgweb/search/views.py that would allow only users subscribed to a list to search into it.

I've been told that this functionality did not indeed work for postresql.org's private lists.
-- 
Célestin Matte

---

From: Magnus Hagander <[email-masked]>
Date: Thu, 4 Nov 2021 11:25:57 +0100

On Thu, Nov 4, 2021 at 10:42 AM Célestin Matte <[email-masked]>
wrote:

> - it is only possible to define a single archive search server in pgweb's
> settings.py, which makes it impossible to define both a public and a
> private archives server,
> - there does not seem to be any kind of permissions verifications in
> pgweb/search/views.py that would allow only users subscribed to a list to
> search into it.
>

Yes, this is a known limitation. This is "documented" in a code comment:

def search(request):
    if not settings.PUBLIC_ARCHIVES:
        # We don't support searching of non-public archives at all at this
point.
        # XXX: room for future improvement
        return HttpResponseForbidden('Not public archives')

-- 
 Magnus Hagander
 Me: https://www.hagander.net/ <http://www.hagander.net/>
 Work: https://www.redpill-linpro.com/ <http://www.redpill-linpro.com/>