[Admin]

Ok, if a user can find a searchid of a search that was done by an admin / mod, and goes to that search, he will see all posts inlcuding these in private forums he shouldn't see.
Of course, this hack makes it even easier to find these searches as they are just one click away.

To solve the problem the hack created, replace the query:

 $lastsearches=$DB_site->query('SELECT searchid,querystring FROM search WHERE querystring!="" ORDER BY searchid desc LIMIT 0,10');

with this:

 $lastsearches=$DB_site->query('SELECT searchid,querystring FROM search LEFT JOIN user USING (userid) WHERE querystring!="" AND usergroupid NOT IN (5,6,7) ORDER BY searchid desc LIMIT 0,10');

This will make sure no searches submitted by admins, mods and super mods will show up on the list.