Version: 1.00, by AntiOnline
Developer Last Online: Jun 2004
Version: 2.2.x
Rating:
Released: 03-06-2002
Last Update: Never
Installs: 156
No support by the author.
Greetings All:
Updated 3/11/2002: Hack now shows the date and time each search was made, plus the number of results. Also included is the security fix by firefly (thanks).
Updated 3/8/2002: It now also links those search words to the previous search results.
Here's just a little fun feature that I added for my users, and thought that I would share with everyone else. It works with versions 2.03 and up, requires no modifications to your database, and should take less than 2 minutes to install:
This hack displays the last 10 searches made by your users on your main site search page. It uses your censor options to make sure nothing naughty shows up (unless, that is, you want it to).
Strange, its not really working for me. After I installed, one search showed up under latest searches, so I thought it was working. However, whenever I search something, it doesnt update the search list, it only shows the same one.
I just made a search as admin in a private forum and then logged in as a regular user, tried to view the results of the search i just did by using the search id and it didn't show up any results. However, when i went back to the search page I could see which query has been run and how many results were returned.
Some of those security issues were apparently solved, but not every one of them as it seems.
The regular user can still see what an admin/mod was looking for and how many results were returned, although you don't see the actual results. This is not necessarily a security issue, but a privacy issue.
Let's assume the following: An admin searched for "ban AND user x", the reason why he did this is not really relevant, as this scenario is hypothetical. Now user y finds out that there was this search and that several results were returned, he tells this user x and user x makes it public.
Hey FireFly, you might want to check me on this one...
I looked into this because I have not been able to see any searchs that I am performing.. Based on the below quote from the MySQL manual:
Quote:
If there is no matching record for the right table in the ON or USING part in a LEFT JOIN, a row with all columns set to NULL is used for the right table.
If the search was performed by a guest which has an account value of "0", it tries to do the NOT IN which it can not compare to anything because that account does not exist in the user table...
I think this should be a correct query, I have tested here and it is working with no issues:
SELECT searchid,postids,dateline,querystring FROM search LEFT JOIN user USING (userid) WHERE querystring!="" AND (usergroupid NOT IN (5,6,7) OR search.userid = "0") ORDER BY searchid desc LIMIT 0,10
Also, as a note to some people, I had to upgrade my search.php in order the get the links created correctly so other users could access them. Otherwise, I got a user is not authorized message.
Last 10 Searches Details »»
About Developer
Visit Web Site
No support by the author.
11-01-2002, 07:08 PM
- 
