Output of search results show comments even though user has no rights to view

Hi snicers.

I took a look at the code, and it seems to be building the node body the same way as the core search module. Could you do me a favor and see if the core search is affected by this problems as well?

Thanks for the post,
Chris

Looks like you have discovered a core bug :-) If you look at the "search" $op in node_search(), you will see on line 1283 in modules/node/node.module that it appends the comments to the node body without any access control. To me, that seems to be where the problem lies.

As for Search Lucene API, I think that this is a good bug report, and a fix can be applied to respect the comment permissions. I am flagging for the 6.x-2.1 release. As for an immediate fix, you can actually implement hook_luceneapi_result_alter() to control what is displayed. Unfortunately you will have to re-load the node, rebuild the body, and re-create the snippet which may be too performance intensive. I would wait for the upcoming release, which should happen in a week or so, maybe sooner.

Great catch!
Chris

To me, I think this should definitely be brought up to the core search maintainer. Let's see what they have to say about the issue. Feel free to reference the post here for a description of what is happening.

Fix applied to Search Lucene API in commit #330200.