Core: Guests encounter permission error when searching

[jordanjay29]

When searching as a guest (or a user without the View User List permission) an error message will appear claiming "You do not have permission to do this."

Flarum should discard this error for the search field and simply not display results from the users list to guests/non-permissible users.

[luceos]

What we forgot to do is add a check for this permission when adding the user search source;

https://github.com/flarum/core/blob/3bf74eaf10135cf683440b56741937a4a2713613/js/forum/src/components/Search.js#L214

In the above snippet the search source is added, we need to add a conditional that will check whether the user is allowed to use the search. To do so we need to use the following permission:

https://github.com/flarum/core/blob/3bf74eaf10135cf683440b56741937a4a2713613/js/admin/src/components/PermissionGrid.js#L97

[datitisev]

As guests are not users (at least not present in app.session.user), how would one check if a guest has permission to do something via the front end?

[tobyzerner]

Add to ForumSerializer, accessible in the front end via app.forum.
We have already added a viewUserList permission along with a canViewUserList attribute so it should be as simple as adding a check for app.forum.attribute('canViewUserList').