Merge pull request #1299 from hmhealey/plt974

PLT-974 Prevented searching for "*"

2 files changed, 8 insertions, 1 deletions

diff --git a/api/post.go b/api/post.go
index 31a7ab3b5..b52db8752 100644
--- a/api/post.go
+++ b/api/post.go
@@ -890,7 +890,10 @@ func searchPosts(c *Context, w http.ResponseWriter, r *http.Request) {
 	channels := []store.StoreChannel{}
 
 	for _, params := range paramsList {
-		channels = append(channels, Srv.Store.Post().Search(c.Session.TeamId, c.Session.UserId, params))
+		// don't allow users to search for everything
+		if params.Terms != "*" {
+			channels = append(channels, Srv.Store.Post().Search(c.Session.TeamId, c.Session.UserId, params))
+		}
 	}
 
 	posts := &model.PostList{}
diff --git a/api/post_test.go b/api/post_test.go
index 3452c9788..0cb437e88 100644
--- a/api/post_test.go
+++ b/api/post_test.go
@@ -450,6 +450,10 @@ func TestSearchPosts(t *testing.T) {
 	if len(r3.Order) != 1 && r3.Order[0] == post3.Id {
 		t.Fatal("wrong serach")
 	}
+
+	if r4 := Client.Must(Client.SearchPosts("*")).Data.(*model.PostList); len(r4.Order) != 0 {
+		t.Fatal("searching for just * shouldn't return any results")
+	}
 }
 
 func TestSearchHashtagPosts(t *testing.T) {