Fixes minor vulnerability when using target="_blank" on links (RSPEC-5148)

[bookstack] / app / Http / Controllers / SearchController.php

diff --git a/app/Http/Controllers/SearchController.php b/app/Http/Controllers/SearchController.php
index bf8165afe6f45db2d8db507249f4fee3cb58f425..8598575004f04a5e1c679288e6f5d7060b57a54a 100644 (file)
--- a/app/Http/Controllers/SearchController.php
+++ b/app/Http/Controllers/SearchController.php
@@ -1,110 +1,99 @@
 <?php namespace BookStack\Http\Controllers;
 
 <?php namespace BookStack\Http\Controllers;
 

-use BookStack\Repos\EntityRepo;
-use BookStack\Services\SearchService;
-use BookStack\Services\ViewService;
+use BookStack\Entities\Queries\Popular;
+use BookStack\Entities\Tools\SearchRunner;
+use BookStack\Entities\Tools\ShelfContext;
+use BookStack\Entities\Tools\SearchOptions;
+use BookStack\Entities\Tools\SiblingFetcher;

 use Illuminate\Http\Request;
 
 class SearchController extends Controller
 {
 use Illuminate\Http\Request;
 
 class SearchController extends Controller
 {

-    protected $entityRepo;
-    protected $viewService;
-    protected $searchService;
-
-    /**
-     * SearchController constructor.
-     * @param EntityRepo $entityRepo
-     * @param ViewService $viewService
-     * @param SearchService $searchService
-     */
-    public function __construct(EntityRepo $entityRepo, ViewService $viewService, SearchService $searchService)
-    {
-        $this->entityRepo = $entityRepo;
-        $this->viewService = $viewService;
-        $this->searchService = $searchService;
-        parent::__construct();
+    protected $searchRunner;
+    protected $entityContextManager;
+
+    public function __construct(
+        SearchRunner $searchRunner,
+        ShelfContext $entityContextManager
+    ) {
+        $this->searchRunner = $searchRunner;
+        $this->entityContextManager = $entityContextManager;

     }
 
     /**
      * Searches all entities.
     }
 
     /**
      * Searches all entities.

-     * @param Request $request
-     * @return \Illuminate\View\View
-     * @internal param string $searchTerm

      */
     public function search(Request $request)
     {
      */
     public function search(Request $request)
     {

-        $searchTerm = $request->get('term');
-        $this->setPageTitle(trans('entities.search_for_term', ['term' => $searchTerm]));
+        $searchOpts = SearchOptions::fromRequest($request);
+        $fullSearchString = $searchOpts->toString();
+        $this->setPageTitle(trans('entities.search_for_term', ['term' => $fullSearchString]));

 
 

-        $page = $request->has('page') && is_int(intval($request->get('page'))) ? intval($request->get('page')) : 1;
-        $nextPageLink = baseUrl('/search?term=' . urlencode($searchTerm) . '&page=' . ($page+1));
+        $page = intval($request->get('page', '0')) ?: 1;
+        $nextPageLink = url('/search?term=' . urlencode($fullSearchString) . '&page=' . ($page+1));

 
 

-        $results = $this->searchService->searchEntities($searchTerm, 'all', $page, 20);
-        $hasNextPage = $this->searchService->searchEntities($searchTerm, 'all', $page+1, 20)['count'] > 0;
+        $results = $this->searchRunner->searchEntities($searchOpts, 'all', $page, 20);

 
 

-        return view('search/all', [
+        return view('search.all', [

             'entities'   => $results['results'],
             'totalResults' => $results['total'],
             'entities'   => $results['results'],
             'totalResults' => $results['total'],

-            'searchTerm' => $searchTerm,
-            'hasNextPage' => $hasNextPage,
-            'nextPageLink' => $nextPageLink
+            'searchTerm' => $fullSearchString,
+            'hasNextPage' => $results['has_more'],
+            'nextPageLink' => $nextPageLink,
+            'options' => $searchOpts,

         ]);
     }
 
         ]);
     }
 

-

     /**
      * Searches all entities within a book.
     /**
      * Searches all entities within a book.

-     * @param Request $request
-     * @param integer $bookId
-     * @return \Illuminate\View\View
-     * @internal param string $searchTerm

      */
      */

-    public function searchBook(Request $request, $bookId)
+    public function searchBook(Request $request, int $bookId)

     {
         $term = $request->get('term', '');
     {
         $term = $request->get('term', '');

-        $results = $this->searchService->searchBook($bookId, $term);
-        return view('partials/entity-list', ['entities' => $results]);
+        $results = $this->searchRunner->searchBook($bookId, $term);
+        return view('partials.entity-list', ['entities' => $results]);

     }
 
     /**
      * Searches all entities within a chapter.
     }
 
     /**
      * Searches all entities within a chapter.

-     * @param Request $request
-     * @param integer $chapterId
-     * @return \Illuminate\View\View
-     * @internal param string $searchTerm

      */
      */

-    public function searchChapter(Request $request, $chapterId)
+    public function searchChapter(Request $request, int $chapterId)

     {
         $term = $request->get('term', '');
     {
         $term = $request->get('term', '');

-        $results = $this->searchService->searchChapter($chapterId, $term);
-        return view('partials/entity-list', ['entities' => $results]);
+        $results = $this->searchRunner->searchChapter($chapterId, $term);
+        return view('partials.entity-list', ['entities' => $results]);

     }
 
     /**
      * Search for a list of entities and return a partial HTML response of matching entities.
      * Returns the most popular entities if no search is provided.
     }
 
     /**
      * Search for a list of entities and return a partial HTML response of matching entities.
      * Returns the most popular entities if no search is provided.

-     * @param Request $request
-     * @return mixed

      */
     public function searchEntitiesAjax(Request $request)
     {
      */
     public function searchEntitiesAjax(Request $request)
     {

-        $entityTypes = $request->has('types') ? collect(explode(',', $request->get('types'))) : collect(['page', 'chapter', 'book']);
-        $searchTerm = ($request->has('term') && trim($request->get('term')) !== '') ? $request->get('term') : false;
+        $entityTypes = $request->filled('types') ? explode(',', $request->get('types')) : ['page', 'chapter', 'book'];
+        $searchTerm =  $request->get('term', false);
+        $permission = $request->get('permission', 'view');

 
         // Search for entities otherwise show most popular
         if ($searchTerm !== false) {
 
         // Search for entities otherwise show most popular
         if ($searchTerm !== false) {

-            $searchTerm .= ' {type:'. implode('|', $entityTypes->toArray()) .'}';
-            $entities = $this->searchService->searchEntities($searchTerm)['results'];
+            $searchTerm .= ' {type:'. implode('|', $entityTypes) .'}';
+            $entities = $this->searchRunner->searchEntities(SearchOptions::fromString($searchTerm), 'all', 1, 20, $permission)['results'];

         } else {
         } else {

-            $entityNames = $entityTypes->map(function ($type) {
-                return 'BookStack\\' . ucfirst($type);
-            })->toArray();
-            $entities = $this->viewService->getPopular(20, 0, $entityNames);
+            $entities = (new Popular)->run(20, 0, $entityTypes, $permission);

         }
 
         }
 

-        return view('search/entity-ajax-list', ['entities' => $entities]);
+        return view('search.entity-ajax-list', ['entities' => $entities]);

     }
 
     }
 

-}
-
+    /**
+     * Search siblings items in the system.
+     */
+    public function searchSiblings(Request $request)
+    {
+        $type = $request->get('entity_type', null);
+        $id = $request->get('entity_id', null);

 
 

+        $entities = (new SiblingFetcher)->fetch($type, $id);
+        return view('partials.entity-list-basic', ['entities' => $entities, 'style' => 'compact']);
+    }
+}