Merge branch 'master' into imprv/growi_renderer-in-reveal

CHANGES.md

@@ -3,16 +3,21 @@ CHANGES
 
 ## 3.3.7-RC
 
-* 
+* Feature: Editor toolbar
+* Fix: Anonymous users couldn't search
+    * Introduced by 3.3.6
+* Support: Prepare to suppoert Node.js v10
+* Support: Upgrade libs
+    * node-sass
 
 ## 3.3.6
 
 * Improvement: Site URL settings must be set
 * Improvement: Site URL settings can be set with environment variable
 * Fix: "Anyone with the link" ACL doesn't work correctly
-    * Introduced 3.3.0
+    * Introduced by 3.3.0
 * Fix: Related pages list of /admin/user-group-detail/xxx doesn't show anything
-    * Introduced 3.3.0
+    * Introduced by 3.3.0
 * Fix: Diff of revision contents doesn't appeared when notifing with slack
 * Fix: NPE occured on /admin/security when Crowi Classic Auth Mechanism is set
 * Fix: Coudn't render Timing Diagram with PlantUML
@@ -56,7 +61,7 @@ CHANGES
 ## 3.3.2
 
 * Fix: Specified Group ACL is not persisted correctly
-    * Introduced 3.3.0
+    * Introduced by 3.3.0
 
 ## 3.3.1
 

src/server/util/search.js

@@ -541,14 +541,20 @@ SearchClient.prototype.filterPagesByViewer = async function(query, user, userGro
 
   const grantConditions = [
     { term: { grant: GRANT_PUBLIC } },
-    { bool: {
-      must: [
-        { term: { grant: GRANT_RESTRICTED } },
-        { term: { granted_users: user._id.toString() } }
-      ]
-    } },
   ];
 
+  // ensure to hit to GRANT_RESTRICTED pages that the user specified at own
+  if (user != null) {
+    grantConditions.push(
+      { bool: {
+        must: [
+          { term: { grant: GRANT_RESTRICTED } },
+          { term: { granted_users: user._id.toString() } }
+        ]
+      } }
+    );
+  }
+
   if (showPagesRestrictedByOwner) {
     grantConditions.push(
       { term: { grant: GRANT_SPECIFIED } },