snoopdave commented on code in PR #222:
URL: https://github.com/apache/roller/pull/222#discussion_r4394331803
##########
app/src/main/java/org/apache/roller/weblogger/ui/struts2/ajax/UserDataServlet.java:
##########
@@ -109,6 +109,11 @@ public void doGet(HttpServletRequest request,
HttpServletResponse response)
List<User> users = umgr.getUsersStartingWith(startsWith,
enabledOnly, offset, length);
for (User user : users) {
+ // the query also matches email addresses, which only
+ // admins may search by
+ if (!admin && !userNameStartsWith(user, startsWith)) {
Review Comment:
**Important:** Filtering after the query breaks pagination for non-admins.
The named query matches on `userName LIKE … OR emailAddress LIKE …` with
`offset`/`length` applied by the database, so rows that match only by email
address still consume page slots and are then discarded here — a non-admin page
can come back short or empty while later pages hold username matches that were
pushed out of view. Cleaner and correct: for non-admins run a username-only
query (e.g. a `User.getByUserNameStartsWith` named query with the same `ESCAPE
'!'` handling) so the paging and the filter agree, and keep the OR-query for
admins only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
