honour sys channel permissions for who can view the sys owned content

1 files changed, 7 insertions, 1 deletions

diff --git a/mod/search.php b/mod/search.php
index 663d355e2..15ac71376 100644
--- a/mod/search.php
+++ b/mod/search.php
@@ -23,6 +23,7 @@ function search_content(&$a,$update = 0, $load = false) {
 
 
 	$observer = $a->get_observer();
+	$observer_hash = (($observer) ? $observer['xchan_hash'] : '');
 
 	$o = '<div id="live-search"></div>' . "\r\n";
 
@@ -113,7 +114,7 @@ function search_content(&$a,$update = 0, $load = false) {
 
 	}
 
-	$pub_sql = public_permissions_sql(get_observer_hash());
+	$pub_sql = public_permissions_sql($observer_hash);
 
 	require_once('include/identity.php');
 
@@ -124,6 +125,11 @@ function search_content(&$a,$update = 0, $load = false) {
 		$a->set_pager_itemspage(((intval($itemspage)) ? $itemspage : 20));
 		$pager_sql = sprintf(" LIMIT %d, %d ",intval($a->pager['start']), intval($a->pager['itemspage']));
 
+		// in case somebody turned off public access to sys channel content with permissions
+
+		if(! perm_is_allowed($sys['channel_id'],$observer_hash,'view_stream'))
+			$sys['xchan_hash'] .= 'disabled';
+
 		if($load) {
 			$r = null;