33349097533fc93369bf6670266a3c96bc1101b9,xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/resources/BaseSearchResult.java,BaseSearchResult,searchObjects,#String#String#String#boolean#number#number#String#String#Boolean#,448
Before Change
String pageFullName = Utils.getPageFullName(wikiName, spaceName, pageName);
/* Check if the user has the right to see the found document */
if (Utils.getXWikiApi(componentManager).hasAccessLevel("view", pageId)) {
Document doc = Utils.getXWikiApi(componentManager).getDocument(pageFullName);
String title = doc.getDisplayTitle();
SearchResult searchResult = objectFactory.createSearchResult();
searchResult.setType("object");
After Change
boolean hasProgrammingRights, int number, int start, String orderField, String order, Boolean withPrettyNames)
throws QueryException, IllegalArgumentException, UriBuilderException, XWikiException
{
XWiki xwikiApi = Utils.getXWikiApi(componentManager);
String database = Utils.getXWikiContext(componentManager).getDatabase();
/* This try is just needed for executing the finally clause. */
try {
List<SearchResult> result = new ArrayList<SearchResult>();
if (keywords == null) {
return result;
}
Formatter f = new Formatter();
/*
* If the order field is already one of the field hard coded in the base query, then do not add it to the
* select clause.
*/
String addColumn =
(orderField.equals("") || orderField.equals("fullName") || orderField.equals("name") || orderField
.equals("space")) ? "" : ", doc." + orderField;
if (space != null) {
f.format("select distinct doc.fullName, doc.space, doc.name, obj.className, obj.number");
f.format(addColumn);
f.format(" from XWikiDocument as doc, BaseObject as obj, StringProperty as sp, LargeStringProperty as lsp where doc.space = :space and obj.name=doc.fullName and sp.id.id = obj.id and lsp.id.id = obj.id and (upper(sp.value) like :keywords or upper(lsp.value) like :keywords) ");
} else {
f.format("select distinct doc.fullName, doc.space, doc.name, obj.className, obj.number");
f.format(addColumn);
f.format(" from XWikiDocument as doc, BaseObject as obj, StringProperty as sp, LargeStringProperty as lsp where obj.name=doc.fullName and sp.id.id = obj.id and lsp.id.id = obj.id and (upper(sp.value) like :keywords or upper(lsp.value) like :keywords) ");
}
/* Build the order clause. */
String orderClause = null;
if (StringUtils.isBlank(orderField)) {
orderClause = "doc.fullName asc";
} else {
/* Check if the order parameter is a valid "asc" or "desc" string, otherwise use "asc" */
if ("asc".equals(order) || "desc".equals(order)) {
orderClause = String.format("doc.%s %s", orderField, order);
} else {
orderClause = String.format("doc.%s asc", orderField);
}
}
/* Add some filters if the user doesn't have programming rights. */
if (hasProgrammingRights) {
f.format(" order by %s", orderClause);
} else {
f.format(
" and doc.space<>'XWiki' and doc.space<>'Admin' and doc.space<>'Panels' and doc.name<>'WebPreferences' order by %s",
orderClause);
}
String query = f.toString();
List<Object> queryResult = null;
/* This is needed because if the :space placeholder is not in the query, setting it would cause an exception */
if (space != null) {
queryResult =
queryManager.createQuery(query, Query.XWQL)
.bindValue("keywords", String.format("%%%s%%", keywords.toUpperCase()))
.bindValue("space", space).setLimit(number).execute();
} else {
queryResult =
queryManager.createQuery(query, Query.XWQL)
.bindValue("keywords", String.format("%%%s%%", keywords.toUpperCase())).setLimit(number)
.execute();
}
/* Build the result. */
for (Object object : queryResult) {
Object[] fields = (Object[]) object;
String spaceName = (String) fields[1];
String pageName = (String) fields[2];
String className = (String) fields[3];
int objectNumber = (Integer) fields[4];
String id = Utils.getObjectId(wikiName, spaceName, pageName, className, objectNumber);
String pageId = Utils.getPageId(wikiName, spaceName, pageName);
String pageFullName = Utils.getPageFullName(wikiName, spaceName, pageName);
/* Check if the user has the right to see the found document */
if (xwikiApi.hasAccessLevel("view", pageId)) {
Document doc = xwikiApi.getDocument(pageFullName);
String title = doc.getDisplayTitle();
SearchResult searchResult = objectFactory.createSearchResult();
searchResult.setType("object");