[Backport 5.1.x] Fixed search fields lookup

geonode/base/api/filters.py

@@ -33,8 +33,10 @@
 
 
 class DynamicSearchFilter(SearchFilter):
+    # search_fields from the request are restricted to the view's allow-list
     def get_search_fields(self, view, request):
-        return request.GET.getlist("search_fields", [])
+        allowed = getattr(view, "search_fields", None) or []
+        return [f for f in request.GET.getlist("search_fields", []) if f in allowed]
 
 
 class ExtentFilter(BaseFilterBackend):

geonode/base/api/tests.py

@@ -871,6 +871,44 @@ def test_search_resources(self):
         # Pagination
         self.assertEqual(len(response.data["resources"]), 1)
 
+    def test_search_fields_allow_list(self):
+        """
+        search_fields not allowed by the view are ignored.
+        """
+        term = "no-such-value-b3wf"
+
+        def _check(url, allowed, rejected):
+            total = self.client.get(url, format="json").data["total"]
+            self.assertGreater(total, 0)
+            for field in allowed:
+                response = self.client.get(f"{url}?search={term}&search_fields={field}", format="json")
+                self.assertEqual(response.status_code, 200)
+                self.assertEqual(response.data["total"], 0, field)
+            for field in rejected:
+                response = self.client.get(f"{url}?search={term}&search_fields={field}", format="json")
+                self.assertEqual(response.status_code, 200)
+                self.assertEqual(response.data["total"], total, field)
+
+        resource_rejected = ["owner__password__startswith", "owner__email__regex", "owner__username", "uuid", "^title"]
+        # anonymous
+        for name in ("base-resources-list", "datasets-list", "maps-list", "documents-list"):
+            _check(reverse(name), allowed=["title", "abstract"], rejected=resource_rejected)
+
+        admin = get_user_model().objects.get(username="admin")
+        GeoApp.objects.create(title="search fields geoapp", owner=admin)
+        self.assertTrue(self.client.login(username="admin", password="admin"))
+        _check(reverse("geoapps-list"), allowed=["title", "abstract"], rejected=resource_rejected)
+        _check(
+            reverse("users-list"),
+            allowed=["username", "first_name", "last_name"],
+            rejected=["password__startswith", "email", "username__regex"],
+        )
+        _check(
+            reverse("group-profiles-list"),
+            allowed=["title", "slug"],
+            rejected=["group__user__password__startswith", "description"],
+        )
+
     def test_filter_resources(self):
         """
         Ensure we can filter across the Resource Base list.

geonode/base/api/views.py

@@ -127,6 +127,7 @@ class GroupViewSet(DynamicModelViewSet):
         IsManagerEditOrAdmin,
     ]
     filter_backends = [DynamicFilterBackend, DynamicSortingFilter, DynamicSearchFilter]
+    search_fields = ["title", "slug"]
     serializer_class = GroupProfileSerializer
     pagination_class = GeoNodeApiPagination
 
@@ -307,6 +308,7 @@ class ResourceBaseViewSet(ApiPresetsInitializer, MultiLangViewMixin, DeprecatedE
         FavoriteFilter,
     ]
     queryset = ResourceBase.objects.select_related("owner").order_by("-created")
+    search_fields = ["title", "abstract"]
     serializer_class = ResourceBaseSerializer
     pagination_class = GeoNodeApiPagination
 

geonode/documents/api/views.py

@@ -63,6 +63,7 @@ class DocumentViewSet(ApiPresetsInitializer, MultiLangViewMixin, DynamicModelVie
         DocumentPermissionsFilter,
     ]
     queryset = Document.objects.all().order_by("-created")
+    search_fields = ["title", "abstract"]
     serializer_class = DocumentSerializer
     pagination_class = GeoNodeApiPagination
 

geonode/geoapps/api/views.py

@@ -57,6 +57,7 @@ class GeoAppViewSet(ApiPresetsInitializer, MultiLangViewMixin, DynamicModelViewS
         GeoAppPermissionsFilter,
     ]
     queryset = GeoApp.objects.all().order_by("-created")
+    search_fields = ["title", "abstract"]
     serializer_class = GeoAppSerializer
     pagination_class = GeoNodeApiPagination
 

geonode/layers/api/views.py

@@ -81,6 +81,7 @@ class DatasetViewSet(ApiPresetsInitializer, MultiLangViewMixin, DynamicModelView
         DatasetPermissionsFilter,
     ]
     queryset = Dataset.objects.all().order_by("-created")
+    search_fields = ["title", "abstract"]
     serializer_class = DatasetSerializer
     pagination_class = GeoNodeApiPagination
 

geonode/maps/api/views.py

@@ -64,6 +64,7 @@ class MapViewSet(ApiPresetsInitializer, MultiLangViewMixin, DynamicModelViewSet)
         MapPermissionsFilter,
     ]
     queryset = Map.objects.all().order_by("-created")
+    search_fields = ["title", "abstract"]
     serializer_class = MapSerializer
     pagination_class = GeoNodeApiPagination
 

geonode/people/api/views.py

@@ -55,6 +55,7 @@ class UserViewSet(DynamicModelViewSet):
         IsOwnerOrAdmin,
     ]
     filter_backends = [DynamicFilterBackend, DynamicSortingFilter, DynamicSearchFilter]
+    search_fields = ["username", "first_name", "last_name"]
     serializer_class = UserSerializer
     pagination_class = GeoNodeApiPagination