search: add unaliased:<tag> metatag.

* Add unaliased:<tag> metatag. This allows you to search for a tag
  without applying aliases. This is mainly useful for debugging purposes
  and for searching for large tags that are in the process of being
  aliased but haven't had all their posts moved yet.

* Remove the "raw" url param from the posts index page. The "raw" param
  also caused the search to ignore aliases, but it was undocumented and
  exploitable. It was possible to use the raw param to view private
  favorites since favorites are treated like a hidden tag.
This commit is contained in:
evazion
2020-04-30 12:14:28 -05:00
parent 986bc6e314
commit 2cbe4d3672
7 changed files with 31 additions and 12 deletions

View File

@@ -10,7 +10,7 @@ class PostsController < ApplicationController
end
else
tag_query = params[:tags] || params.dig(:post, :tags)
@post_set = PostSets::Post.new(tag_query, params[:page], params[:limit], raw: params[:raw], random: params[:random], format: params[:format])
@post_set = PostSets::Post.new(tag_query, params[:page], params[:limit], random: params[:random], format: params[:format])
@posts = authorize @post_set.posts, policy_class: PostPolicy
respond_with(@posts) do |format|
format.atom