Handle permissions on private mailing-lists

1 files changed, 6 insertions, 0 deletions

diff --git a/hyperkitty/views/search.py b/hyperkitty/views/search.py
index d398ae2..3eb179f 100644
--- a/hyperkitty/views/search.py
+++ b/hyperkitty/views/search.py
@@ -30,6 +30,7 @@ from hyperkitty.lib.view_helpers import paginate
 from hyperkitty.lib.voting import set_message_votes
 
 from hyperkitty.views.list import _thread_list
+from hyperkitty.lib.mailman import check_mlist_private, is_mlist_authorized
 
 
 class SearchPaginator(Paginator):
@@ -46,6 +47,7 @@ class SearchPaginator(Paginator):
         return Page(self.object_list, number, self)
 
 
+@check_mlist_private
 def search_tag(request, mlist_fqdn, tag):
     '''Returns threads having a particular tag'''
     store = get_store(request)
@@ -84,6 +86,10 @@ def search(request, page=1):
         mlist = store.get_list(mlist_fqdn)
         if mlist is None:
             raise Http404("No archived mailing-list by that name.")
+        if not is_mlist_authorized(request, mlist):
+            return render(request, "error-private.html", {
+                            "mlist": mlist,
+                          }, status=403)
 
     if not query:
         return render(request, "search_results.html", {