threadlist: Automatically hide threads the user should not see + display hidden/private flags

3 files changed, 11 insertions, 5 deletions

diff --git a/lib/VNWeb/Discussions/Index.pm b/lib/VNWeb/Discussions/Index.pm
index 4902c0e0..d178c579 100644
--- a/lib/VNWeb/Discussions/Index.pm
+++ b/lib/VNWeb/Discussions/Index.pm
@@ -25,7 +25,7 @@ TUWF::get qr{/t}, sub {
                 a_ href => "/t/$b", $BOARD_TYPE{$b}{txt};
             };
             threadlist_
-                where   => sql('NOT t.private AND NOT t.hidden AND t.id IN(SELECT tid FROM threads_boards WHERE type =', \$b, ')'),
+                where   => sql('t.id IN(SELECT tid FROM threads_boards WHERE type =', \$b, ')'),
                 boards  => sql('NOT (tb.type =', \$b, 'AND tb.iid = 0)'),
                 results => $BOARD_TYPE{$b}{index_rows},
                 page    => 1;
diff --git a/lib/VNWeb/Discussions/Lib.pm b/lib/VNWeb/Discussions/Lib.pm
index c58c9020..85265301 100644
--- a/lib/VNWeb/Discussions/Lib.pm
+++ b/lib/VNWeb/Discussions/Lib.pm
@@ -20,8 +20,14 @@ sub threadlist_ {
     my $count = $opt{paginate} && tuwf->dbVali('SELECT count(*) FROM threads t WHERE', $opt{where});
     return 0 if $opt{paginate} && !$count;
 
+    my $where = sql_and
+        # Make sure we can only see threads we're allowed to see.
+        auth->permBoardmod ? () : ('NOT t.hidden'),
+        sql('NOT t.private OR EXISTS(SELECT 1 FROM threads_boards WHERE tid = t.id AND type = \'u\' AND iid =', \auth->uid, ')'),
+        $opt{where}||();
+
     my $lst = tuwf->dbPagei(\%opt, q{
-        SELECT t.id, t.title, t.count, t.locked, t.poll_question IS NOT NULL AS haspoll
+        SELECT t.id, t.title, t.count, t.locked, t.private, t.hidden, t.poll_question IS NOT NULL AS haspoll
              , }, sql_user('tfu', 'firstpost_'), ',', sql_totime('tf.date'), q{ as firstpost_date
              , }, sql_user('tlu', 'lastpost_'),  ',', sql_totime('tl.date'), q{ as lastpost_date
           FROM threads t
@@ -29,7 +35,7 @@ sub threadlist_ {
           JOIN threads_posts tl ON tl.tid = t.id AND tl.num = t.count
           JOIN users tfu ON tfu.id = tf.uid
           JOIN users tlu ON tlu.id = tl.uid
-         WHERE }, $opt{where}, q{
+         WHERE }, $where, q{
          ORDER BY tl.date DESC
     });
     return 0 if !@$lst;
@@ -59,6 +65,8 @@ sub threadlist_ {
                 td_ class => 'tc1', sub {
                     a_ mkclass(locked => $l->{locked}), href => "/t$l->{id}", sub {
                         span_ class => 'pollflag', '[poll]' if $l->{haspoll};
+                        span_ class => 'pollflag', '[private]' if $l->{private};
+                        span_ class => 'pollflag', '[hidden]' if $l->{hidden};
                         txt_ shorten $l->{title}, 50;
                     };
                     b_ class => 'boards', sub {
diff --git a/lib/VNWeb/Discussions/Search.pm b/lib/VNWeb/Discussions/Search.pm
index 3718bad7..6d21380a 100644
--- a/lib/VNWeb/Discussions/Search.pm
+++ b/lib/VNWeb/Discussions/Search.pm
@@ -123,8 +123,6 @@ sub threads_ {
     my($filt) = @_;
 
     my $where = sql_and
-        'NOT t.hidden',
-        'NOT t.private',
         $filt->{b}->@* < keys %BOARD_TYPE ? sql('t.id IN(SELECT tid FROM threads_boards WHERE type IN', $filt->{b}, ')') : (),
         map sql('t.title ilike', \('%'.($_ =~ s/%//gr).'%')), grep length($_) > 0, split /[ -,._]/, $filt->{bq};