Details
-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
6.2.7, 6.4.5
-
None
-
Unknown
-
Description
When searching with a user that doesn't have rights to see all the results, the results themselves are filtered from the list of results, but still taken into account for the facets: numbers of results for each facet will be off, and in facets that display information, the information from these results will be displayed (e.g. space name).
How to reproduce:
- on a standard fresh wiki instance, create 2 spaces: SpacePublic and SpacePrivate
- in both these spaces webhomes, use a specific word that would allow you to retrieve them, e.g. "supercalifragilistic"
- Create 2 more pages in the space SpacePrivate containing the word "supercalifragilistic"
- search "supercalifragilistic" with a logged in user (Admin): 4 results, in both spaces
- remove the view rights on the SpacePrivate to guest, for example (or another test user)
- open the wiki with the guest user, search "supercalifragilistic"
- in the results list you will see only one result, the webhome of SpacePublic. all facets will display document counts that either are exactly 4, or sumup to 4 (see the screenshots)
- also, unfold the "Space" facet, you will see 2 values: SpacePublic and SpacePrivate (the space that you just hidden from guest)
- also, in the "page name" , you can see the name of the page that was just protected from guest access (which could be considered a security issue if it wouldn't be the same behaviour in the document index )
- if the value "SpacePrivate" from the Spaces facet is selected, no result will be displayed even if the number "3" is still displayed next to it in the facets.
I consider the last 4 bullets as defects, unexpected result.
What I expected instead:
- numbers from the facets are or sum up to 1, the space SpacePrivate is not at all shown in the facets, the only page name is WebHome, since this is my result, etc.
Attachments
Issue Links
- is related to
-
XWIKI-8583 Correctly handle pagination for results that are not viewable by the user
- Open