Skip to content

fix(search): stop user:me matching other usernames - #1666

Open
PDGGK wants to merge 1 commit into
apache:devfrom
PDGGK:fix/search-user-me-prefix
Open

PDGGK wants to merge 1 commit into
apache:devfrom
PDGGK:fix/search-user-me-prefix

Conversation

@PDGGK

@PDGGK PDGGK commented Nov 10, 2026

Copy link
Copy Markdown

Fixes #1665

Proposed Changes

  • In parseUserID, treat the query as user:me only when the username in the user: token is exactly me, instead of whenever the query contains the text user:me.
  • Add search_parser_test.go with cases for user:me and for a username that starts with me, with and without an extra search word.

Searching user:melissa (or any username that starts with me) was handled as user:me. A visitor got results from every author, a signed-in user got only their own posts, and lissa was left over as a search word. The parse happens before the search plugin is called, so plugins got the same wrong condition.

I ran Answer from dev (ec5e0e9) in Docker with SQLite and searched through GET /answer/api/v1/search with two users, melissa and bob, one question each. Before the change, user:melissa returned 0 results and user:melissa service as a visitor returned 2 (melissa's and bob's question). With the change both return melissa's question only. user:bob, user:me and user:me service return the same results as before.

TestParseStructureUser fails on dev for the two user:melissa cases (expected: "2", actual: "1", the searcher's own ID) and passes with the change. go test ./internal/service/... ./internal/schema/..., go vet and golangci-lint run (v2.6.2) pass, and go mod tidy leaves go.mod unchanged. I did not run the ASF header check (hawkeye) or test with a search plugin installed.

parseUserID checked strings.Contains(q, "user:me"), so a search for
"user:melissa" (or any username that starts with "me") was treated as
"user:me": it filtered by the searcher's own ID, or by no one for a
visitor, and left "lissa" behind as a search word.

Treat the query as "user:me" only when the username in the user: token
is exactly "me".

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant