chef-server-api-0.8.6.search_restrict.patch

--- /usr/lib64/ruby/gems/1.8/gems/chef-server-api-0.8.6/app/controllers/search.rb	2010-03-17 18:49:07.000000000 +0300
+++ chef-0.8.7.search.rb	2010-03-17 18:51:24.000000000 +0300
@@ -45,7 +45,20 @@
     params[:sort]  ||= nil
     params[:start] ||= 0
     params[:rows]  ||= 20
-    objects, start, total = query.search(params[:id], params[:q], params[:sort], params[:start], params[:rows])
+    text_query = params[:q]
+    if @auth_user.name != 'chef-webui' and not @auth_user.admin
+      node = Chef::Node.cdb_load(@auth_user.name)
+      shared_key = '""'
+      begin
+        shared_key = "\"#{node.shared_key}\""
+      rescue
+        shared_key = '""'
+      end
+      text_query.gsub!(/(shared_key\:).+/, '\1' + shared_key)
+      text_query = ( text_query == "*:*" ) ? "shared_key:#{shared_key}" : "shared_key:#{shared_key} AND #{text_query}"
+    end
+
+    objects, start, total = query.search(params[:id], text_query, params[:sort], params[:start], params[:rows])
     display({
       "rows" => objects,
       "start" => start,