Hooks from: & to: syntax in yml to disable anonymous searches

Support
1

Hi, I would like to rebuild the app including some modification to a file in order to disable the search feature for anonymous users.(more than with just css)

Can anyone provide me some documentation for the syntax of those hooks for the from: & to: part?

    - replace:
        filename: "/var/www/discourse/app/assets/javascripts/discourse/app/components/search-menu.js"
        from: /get classNames()/
        to: |
          if (!this.currentUser) {return false;} get classNames()

Discourse accepts the syntax now but at the end of the rebuild it fails with

 Error: Parse Error at discourse/components/search-menu.gjs:88:7"

replace failed with the params {"filename"=>"/var/www/discourse/app/assets/javascripts/discourse/app/components/search-menu.gjs", "from"=>"/get classNames()/", "to"=>"if (!this.currentUser) {return false;} get classNames()\n"}
2

There is a hidden site setting to accomplish that:

rate_limit_search_anon_global_per_minute
1 Like
3

Thanks for pointing that out. Just to clarify, what’s the name of the hidden site setting? And does it fully disable search for anonymous users, or just hide the results? I’m looking for a way to block access at the controller level, so wondering if that setting alone is enough or if some custom code is still needed.

4

Thanks for providing with the variable, with this documentation I could make it work.

So I modified the app.yml with the following, saved, then ./launcher restart app(no rebuild needed)

env:
  DISCOURSE_RATE_LIMIT_SEARCH_ANON_GLOBAL_PER_MINUTE: 0

Now the /search page is unreachable = great
Now the front end search button instantly returns : you’ve performed this action too many times = great
You may hide the search button with :

.anon #search-button {
	display: none !important;
}

But the question is : is this thorough? Can anyone just create a simple session cookie to make it look like they are connected so that they can access the content of the site through searches?

More thorough but uncomplete solution :

The file is : /var/www/discourse/app/controllers/search_controller.rb
The modification : add “if current_user.present?” after “def show” and add an “end” at the bottom of the condition.

However I could not make it persistent after restart, so anybody is welcome to tell how to make it persistent after restart with the app.yml hooks after_code replace: feature.

5

As in log in to do searches?

On the OP you specified that you want to

And this is what this setting does.

Of course it won’t affect uses who are logged in.

6

I mean non logged in user that would create a session cookie to pretend they are logged in but maybe I am fetching a bit too far here as I guess that the currentUser function checks the session key.

7

:face_with_raised_eyebrow:

That would be a security issue. If you can achieve that make sure to report to HackerOne

8

" That would be a security issue. If you can achieve that make sure to report to HackerOne"

No, I am new to discourse, I cannot even quote properly :slight_smile: , I was just asking, maybe there was some discourse engineer around :slight_smile: ; anyway, we got our solution to this thread thanks to you Falco

1 Like