[Rene Kriest]

Hello folks!

I am finally back after some testing and I also had a look at the source code of this addon aswell.

To make it short:

1. This addon is save only under certain additional conditions which need to be set by an admin
   
2. The addon has no flaws

Kinda paradoxical, or? But read on!

Here are now the results of my investigations regarding the so-called security flaws

The "search postings" issue is a flaw but not of the addon but of the cache.
You need to rebuild your search index cache to make the addon work 100%. After rebuilding there will be a message in the search posting preview "This is message from private thread". Technically the addon is flawless - the problem is the forum search cache.

How to fix that issue

• Rebuild your cache often via cron
• Allow the addon only in certain forums which aren't searchable
• Allow the addon only in certain forums which are restricted to certain usergroups only, but take care: then the problem applies to the members of the usergroup itself if you do not alter the search rules to the forum
• Turn of "posting preview" or reduce the number of letters (standard: 200, to be found in search.php)
• Use a spoiler to at least 200 letters for each posting

My suggestions
Use the addon only in forums where the search function is put off or at least restricted to titles only.

Rebuildung your Search Index Cache somehow sucks, because of the time gaps and the huge server load it creates.