skip encounters with no access (unsanitized query now)

WildMeOrg · Dec 20, 2024 · 089329c · 089329c
1 parent 792d5d6
commit 089329c
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/src/main/java/org/ecocean/EncounterQueryProcessor.java b/src/main/java/org/ecocean/EncounterQueryProcessor.java
@@ -105,7 +105,8 @@ public static String queryStringBuilder(HttpServletRequest request, StringBuffer
                         return failed;
                     }
                     // Encounter enc = myShepherd.getEncounter(hId);
-                    encIds.add(hId);
+                    boolean hasAccess = Encounter.opensearchAccess(h, user, myShepherd);
+                    if (hasAccess) encIds.add(hId);
                 }
             } catch (Exception ex) {
                 ex.printStackTrace();
@@ -1597,8 +1598,11 @@ public static EncounterQueryResult processQuery(Shepherd myShepherd, HttpServlet
                         return new EncounterQueryResult(rEncounters, searchQuery.toString(),
                                 "OpenSearch id " + searchQueryId);
                     }
-                    Encounter enc = myShepherd.getEncounter(hId);
-                    if (enc != null) rEncounters.add(enc);
+                    boolean hasAccess = Encounter.opensearchAccess(h, user, myShepherd);
+                    if (hasAccess) {
+                        Encounter enc = myShepherd.getEncounter(hId);
+                        if (enc != null) rEncounters.add(enc);
+                    }
                 }
             } catch (Exception ex) {
                 ex.printStackTrace();