fix: #8069, dont show hidden groups in search

public/src/admin/manage/groups.js

@@ -101,7 +101,7 @@ define('admin/manage/groups', ['translator', 'benchpress'], function (translator
 				}, function (html) {
 					translator.translate(html, function (html) {
 						groupsEl.find('[data-groupname]').remove();
-						groupsEl.find('tr').after(html);
+						groupsEl.find('tbody').append(html);
 					});
 				});
 			});

src/socket.io/groups.js

@@ -291,7 +291,7 @@ SocketGroups.search = async (socket, data) => {
 		const groupData = await groups.getGroupsBySort(data.options.sort, 0, groupsPerPage - 1);
 		return groupData;
 	}
-
+	data.options.filterHidden = data.options.filterHidden || !await user.isAdministrator(socket.uid);
 	return await groups.search(data.query, data.options);
 };
 
@@ -309,6 +309,13 @@ SocketGroups.loadMore = async (socket, data) => {
 
 SocketGroups.searchMembers = async (socket, data) => {
 	data.uid = socket.uid;
+	const [isOwner, isAdmin] = await Promise.all([
+		groups.ownership.isOwner(socket.uid, data.groupName),
+		user.isAdministrator(socket.uid),
+	]);
+	if (!isOwner && !isAdmin) {
+		throw new Error('[[error:no-privileges]]');
+	}
 	return await groups.searchMembers(data);
 };
 

test/groups.js

@@ -196,6 +196,15 @@ describe('Groups', function () {
 				done();
 			});
 		});
+
+		it('should not return hidden groups', async function () {
+			await Groups.create({
+				name: 'hiddenGroup',
+				hidden: '1',
+			});
+			const result = await socketGroups.search({ uid: testUid }, { query: 'hiddenGroup' });
+			assert.equal(result.length, 0);
+		});
 	});
 
 	describe('.isMember()', function () {