I just made a search as admin in a private forum and then logged in as a regular user, tried to view the results of the search i just did by using the search id and it didn't show up any results. However, when i went back to the search page I could see which query has been run and how many results were returned.
Some of those security issues were apparently solved, but not every one of them as it seems.
The regular user can still see what an admin/mod was looking for and how many results were returned, although you don't see the actual results. This is not necessarily a security issue, but a privacy issue.
Let's assume the following: An admin searched for "ban AND user x", the reason why he did this is not really relevant, as this scenario is hypothetical. Now user y finds out that there was this search and that several results were returned, he tells this user x and user x makes it public.
Now what? Or am I just being paranoid?
Icheb
|