From 182882f61d70a801923efe3d04deb1bbc6efedcb Mon Sep 17 00:00:00 2001
From: naskya <m@naskya.net>
Date: Sat, 28 Oct 2023 01:08:17 +0900
Subject: [PATCH] chore: require credentials for post search

---
 README.md                                                 | 3 +++
 packages/backend/src/server/api/endpoints/notes/search.ts | 4 ++++
 packages/client/src/router.ts                             | 5 ++++-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 7e5e5212d..fa4b8d431 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,9 @@
 
 ## 細かい変更点
 
+- ログインしていなければ投稿検索ができないように
+  - 攻撃対策のため
+  - もしこのせいでサードパーティークライアントに不具合が出る場合には変更するかもしれません
 - 投稿と投稿の間を空けて表示する設定をデフォルトでは無効に
 - Enter キーのみでチャットを送信する設定をデフォルトでは無効に
 - 管理者アカウントも引っ越しできるように
diff --git a/packages/backend/src/server/api/endpoints/notes/search.ts b/packages/backend/src/server/api/endpoints/notes/search.ts
index 6247bd652..093aad657 100644
--- a/packages/backend/src/server/api/endpoints/notes/search.ts
+++ b/packages/backend/src/server/api/endpoints/notes/search.ts
@@ -15,6 +15,7 @@ import { sqlLikeEscape } from "@/misc/sql-like-escape.js";
 export const meta = {
 	tags: ["notes"],
 
+	// but the result will be empty if no credentials provided
 	requireCredential: false,
 	requireCredentialPrivateMode: true,
 
@@ -69,6 +70,9 @@ export const paramDef = {
 } as const;
 
 export default define(meta, paramDef, async (ps, me) => {
+	// disable the post search if no credentials are provided
+	if (me == null) return [];
+
 	if (es == null && sonic == null && meilisearch == null) {
 		const query = makePaginationQuery(
 			Notes.createQueryBuilder("note"),
diff --git a/packages/client/src/router.ts b/packages/client/src/router.ts
index 0e348347a..9350b4243 100644
--- a/packages/client/src/router.ts
+++ b/packages/client/src/router.ts
@@ -315,7 +315,10 @@ export const routes = [
 	},
 	{
 		path: "/search",
-		component: page(() => import("./pages/search.vue")),
+		component:
+			$i != null
+				? page(() => import("./pages/search.vue"))
+				: page(() => import("./pages/not-found.vue")),
 		query: {
 			q: "query",
 			channel: "channel",