Introduce new permission to use the open-search and fix some related problems

src/main/java/sirius/biz/tycho/search/OpenSearchController.java

@@ -27,6 +27,7 @@
 import sirius.web.controller.Routed;
 import sirius.web.http.WebContext;
 import sirius.web.security.LoginRequired;
+import sirius.web.security.Permission;
 import sirius.web.services.JSONStructuredOutput;
 
 import java.io.IOException;
@@ -56,7 +57,7 @@
 public class OpenSearchController extends BizController {
 
     /**
-     * Contains the framework which controls of the system wide search / open search is pvoided or not.
+     * Contains the framework which controls of the system wide search / open search is provided or not.
      */
     public static final String FRAMEWORK_TYCHO_OPEN_SEARCH = "tycho.open-search";
 
@@ -119,6 +120,7 @@ public class OpenSearchController extends BizController {
      */
     @Routed("/open-search")
     @LoginRequired
+    @Permission("permission-open-search")
     public void search(WebContext webContext) {
         webContext.respondWith()
                   .template("/templates/biz/tycho/search/search.html.pasta", webContext.get(PARAM_QUERY).asString());
@@ -132,6 +134,7 @@ public void search(WebContext webContext) {
      */
     @Routed("/open-search/api")
     @LoginRequired
+    @Permission("permission-open-search")
     public Future searchAPI(WebContext webContext) {
         webContext.markAsLongCall();
 

src/main/java/sirius/biz/tycho/search/OpenSearchResult.java

@@ -14,6 +14,7 @@
 import sirius.kernel.health.Exceptions;
 import sirius.kernel.health.Log;
 import sirius.pasta.noodle.compiler.CompileException;
+import sirius.pasta.noodle.sandbox.SandboxMode;
 import sirius.pasta.tagliatelle.Tagliatelle;
 import sirius.pasta.tagliatelle.Template;
 import sirius.pasta.tagliatelle.compiler.TemplateCompilationContext;
@@ -79,8 +80,10 @@ public OpenSearchResult withDescription(String description) {
      */
     public OpenSearchResult withTemplateFromCode(String template, Object... args) {
         try {
-            TemplateCompilationContext context =
-                    tagliatelle.createInlineCompilationContext("OpenSearchResult", template, null);
+            TemplateCompilationContext context = tagliatelle.createInlineCompilationContext("OpenSearchResult",
+                                                                                            template,
+                                                                                            SandboxMode.DISABLED,
+                                                                                            null);
             TemplateCompiler templateCompiler = new TemplateCompiler(context);
             templateCompiler.compile();
             this.htmlDescription = context.getTemplate().renderToString(args);

src/main/resources/component-070-biz.conf

@@ -1432,6 +1432,8 @@ security {
         permission-view-audit-log       : "Required to view the audit log"
         permission-unlock-files         : "Required to unlock read-only files"
 
+        permission-open-search          : "Required to use the open-search"
+
         feature-bypass-process-log-limits : "Required to bypass log limits of processes via a job parameter"
 
         # legacy storage framework...
@@ -1462,6 +1464,7 @@ security {
             permission-view-files = true
             permission-view-processes = true
             permission-view-audit-log = true
+            permission-open-search = true
         }
 
         # If a user belongs to the system tenant, we set the member&affiliate flag

src/main/resources/default/extensions/tycho-page-menu/menu.html.pasta

@@ -10,22 +10,24 @@
     <i:block name="right">
         <t:permission permission="flag-logged-in">
             <i:if test="isFrameworkEnabled('tycho.open-search')">
-                <li class="nav-item dropdown right-menu-icon d-none d-xxl-inline">
-                    <form class="d-flex menu-search-form align-items-baseline" method="POST" action="/open-search">
-                        <span><i class="fa-solid fa-search"></i></span>
-                        <input name="query"
-                               class="form-control autofocus-js"
-                               type="search"
-                               placeholder="@i18n('OpenSearchController.label')"
-                               aria-label="Search">
-                    </form>
-                </li>
-                <li class="nav-item dropdown right-menu-icon d-xxl-none">
-                    <a class="nav-link" href="/open-search">
-                        <i class="fa-solid fa-search fa-w-20"></i>
-                        <span class="d-lg-none">@i18n('OpenSearchController.label')</span>
-                    </a>
-                </li>
+                <t:permission permission="permission-open-search">
+                    <li class="nav-item dropdown right-menu-icon d-none d-xxl-inline">
+                        <form class="d-flex menu-search-form align-items-baseline" method="POST" action="/open-search">
+                            <span><i class="fa-solid fa-search"></i></span>
+                            <input name="query"
+                                   class="form-control autofocus-js"
+                                   type="search"
+                                   placeholder="@i18n('OpenSearchController.label')"
+                                   aria-label="Search">
+                        </form>
+                    </li>
+                    <li class="nav-item dropdown right-menu-icon d-xxl-none">
+                        <a class="nav-link" href="/open-search">
+                            <i class="fa-solid fa-search fa-w-20"></i>
+                            <span class="d-lg-none">@i18n('OpenSearchController.label')</span>
+                        </a>
+                    </li>
+                </t:permission>
             </i:if>
             <t:menuImageItem framework="biz.processes"
                              class="d-none d-xxl-inline"
@@ -34,10 +36,11 @@
                              active="part(sirius.biz.process.Processes.class).hasActiveProcesses()"
                              link="/ps"
                              permission="permission-view-processes"/>
-            <t:menuImageDropdownItem icon="@user().tryAs(sirius.biz.web.UserIconProvider.class).flatMap(|provider| provider.getUserIcon()).orElse('/images/icons/user_avatar_d.png')"
-                                     label="@format('<b>${user}</b>[<br>${tenant}]').set('user', currentUserName()).set('tenant', user().getTenantName()).smartFormat()"
-                                     smallLabel="@currentUserName()"
-                                     class="right-large-menu-icon">
+            <t:menuImageDropdownItem
+                    icon="@user().tryAs(sirius.biz.web.UserIconProvider.class).flatMap(|provider| provider.getUserIcon()).orElse('/images/icons/user_avatar_d.png')"
+                    label="@format('<b>${user}</b>[<br>${tenant}]').set('user', currentUserName()).set('tenant', user().getTenantName()).smartFormat()"
+                    smallLabel="@currentUserName()"
+                    class="right-large-menu-icon">
                 <i:extensions target="biz-tycho-menu" point="user"/>
             </t:menuImageDropdownItem>
             <t:menuImageDropdownItem icon="/images/icons/server.png"

src/main/resources/default/extensions/wondergem-page-menu/menu.html.pasta

@@ -10,16 +10,18 @@
     <i:block name="right">
         <t:permission permission="flag-logged-in">
             <i:if test="isFrameworkEnabled('tycho.open-search')">
-                <li class="nav-item dropdown right-menu-icon d-none d-xl-inline">
-                    <form class="form-inline menu-search-form" method="POST" action="/open-search">
-                        <span><i class="fa fa-search"></i></span>
-                        <input name="query"
-                               class="form-control autofocus"
-                               type="search"
-                               placeholder="@i18n('OpenSearchController.label')"
-                               aria-label="Search">
-                    </form>
-                </li>
+                <t:permission permission="permission-open-search">
+                    <li class="nav-item dropdown right-menu-icon d-none d-xl-inline">
+                        <form class="form-inline menu-search-form" method="POST" action="/open-search">
+                            <span><i class="fa fa-search"></i></span>
+                            <input name="query"
+                                   class="form-control autofocus"
+                                   type="search"
+                                   placeholder="@i18n('OpenSearchController.label')"
+                                   aria-label="Search">
+                        </form>
+                    </li>
+                </t:permission>
             </i:if>
             <t:menuImageItem framework="biz.processes"
                              icon="/images/icons/ps.png"

src/main/resources/default/templates/biz/tycho/kb/welcome.html.pasta

@@ -1,17 +1,23 @@
 <div class="pb-4">
-    <img src="/assets/images/login_logo.png" style="max-height: 100px"/>
+    <img src="/assets/images/login_logo.png" alt="@sirius.kernel.info.Product.getProduct().getName()"
+         style="max-height: 100px"/>
 </div>
 
 <p>
     Welcome to the knowledge base of @sirius.kernel.info.Product.getProduct().getName()
 </p>
 <p>
-    This provides you with an overview of all articles and tutorials we provide. Please note that you can use the
-    <k:link link="/open-search" icon="fa-solid fa-search" name="System-wide Search"/> to find articles for a given
-    keyword.
+    Here you will find an overview of all the help pages and instructions we provide for you.
+    Please note that matching articles and tutorials are directly shown in the applications. Lookout for this
+    symbol <a class="btn btn-info"><i class="fa-solid fa-lightbulb"></i></a> in the upper right area.
 
-    Also note that matching articles and tutorials are also directly shown in the applications. Lookout for this
-    symbol <a class="btn btn-info"><i class="fa-solid fa-lightbulb"></i></a> im in the upper right area.
+    <i:if test="isFrameworkEnabled('tycho.open-search')">
+        <t:permission permission="tycho.open-search">
+            Also note that you can use the
+            <k:link link="/open-search" icon="fa-solid fa-search" name="System-wide Search"/>
+            to find articles for a given keyword.
+        </t:permission>
+    </i:if>
 
     Keep in mind that articles are only visible to authenticated users with the appropriate permissions. If you want
     to forward a link to an article who doesn't have access to the system, use this button, which will generated

src/main/resources/default/templates/biz/tycho/kb/welcome_de.html.pasta

@@ -1,19 +1,26 @@
 <div class="pb-4">
-    <img src="/assets/images/login_logo.png" style="max-height: 100px"/>
+    <img src="/assets/images/login_logo.png" alt="@sirius.kernel.info.Product.getProduct().getName()"
+         style="max-height: 100px"/>
 </div>
 
 <p>
-Willkommen in der Knowledge Base von @sirius.kernel.info.Product.getProduct().getName()
+    Willkommen in der Knowledge Base von @sirius.kernel.info.Product.getProduct().getName()
 </p>
 <p>
-    Hier finden Sie eine Übersicht über alle Hilfeseiten und Anleitungen die wir für Sie bereitstellen. Bitte beachten
-    Sie, dass Sie auch die <k:link link="/open-search" icon="fa-solid fa-search" name="Systemweite Suche"/> verwenden
-    können, um entsprechende Hilfeseiten zu finden.
-
-    Passende Anleitungen oder Erklärungen finden Sie auch direkt in den Anwendungen. Achten Sie hierfür auf dieses
+    Hier finden Sie eine Übersicht über alle Hilfeseiten und Anleitungen die wir für Sie bereitstellen.
+    Passende Anleitungen oder Erklärungen finden Sie direkt in den Anwendungen. Achten Sie hierfür auf dieses
     Symbol <a class="btn btn-info"><i class="fa-solid fa-lightbulb"></i></a> im rechten oberen Bereich.
 
-    Bitte beachten Sie, dass einige Hilfeseiten nur mit einer entsprechenden Berechtigung und nach einem Login sichtbar
+    <i:if test="isFrameworkEnabled('tycho.open-search')">
+        <t:permission permission="tycho.open-search">
+            Bitte beachten Sie, dass Sie auch die
+            <k:link link="/open-search" icon="fa-solid fa-search" name="Systemweite Suche"/>
+            verwenden können, um entsprechende Hilfeseiten zu finden.
+        </t:permission>
+    </i:if>
+
+    Bitte beachten Sie, dass einige Hilfeseiten nur mit einer entsprechenden Berechtigung und nach einem Login
+    sichtbar
     sind. Wenn Sie eine Hilfeseite an weitere Personen versenden möchten, nutzen Sie hierfür den Button
     <a class="btn btn-outline-secondary"><i class="fa-solid fa-link"></i></a> im rechten oberen Bereich.
 </p>

src/main/resources/default/templates/biz/tycho/search/search.html.pasta

@@ -75,7 +75,7 @@
                         if (!_category) {
                             _auxiliary.innerHTML = Mustache.render('' +
                                 '<div class="category" data-category="{{category}}" data-priority="{{priority}}">' +
-                                '   <div><h2>{{category}}</h2>  </div>' +
+                                '   <div><a href="{{categoryUrl}}"><h2>{{category}}</h2></a></div>' +
                                 '   <div class="row row-cols-1 row-cols-lg-2 row-cols-xl-3 items"></div>'
                                 , node);
                             _category = _auxiliary.childNodes[0];