Skip to content

Add server-side search for visitors without JavaScript - #14

Merged
bonelifer merged 3 commits into
mainfrom
search-server-fallback
Oct 7, 2026
Merged

bonelifer merged 3 commits into
mainfrom
search-server-fallback

Conversation

@bonelifer

Copy link
Copy Markdown
Contributor

Visitors without JavaScript can search the documentation again, and the number of search results is configurable.

  • Server-side search: when the browser doesn't run scripts, or the build has no Pagefind bundles, the search page searches the search-index.json of each section the user may read. These files are written by phpbbdocs-hugo. Every word must match, title matches come first, and excerpts are plain text.
  • No double work: documentation.js sets js=1 on the search form, so the server skips its own search when Pagefind will run. documentation-search.js replaces server results with Pagefind's when it can, and keeps them if Pagefind fails.
  • Search results limit: a new ACP setting, 10-200, default 50 (migration m8_search_max_results). It is used by both searches and replaces the previously fixed 50.
  • Safety: index files are read with the same containment checks as pages, only for sections the user may read, and are capped at 16 MiB. They are never served to the browser.

Needs phpbbmodders/phpbbdocs-hugo search-index-fallback for the index files. Builds without them behave as before.

Testing
Claude added tests for matching and ordering, the limit, index containment, and the choice between server search and Pagefind (128 tests). They pass in Docker on PHP 8.2 and 8.4. Claude also ran the phpbb-release-tools feature checks on a 3.3.19 board, including a real search without JavaScript (needs phpbbmodders/phpbb-release-tools documentation-no-js-search). The script's handling of server results was checked in a browser against a stand-in Pagefind module, not a real bundle. EPV gives the same result as on main.


Investigated and written by Claude on behalf of William Jacoby (bonelifer).

bonelifer and others added 3 commits October 6, 2026 13:59
- Move the ACP permission labels into the language file (the one
  valdeny): listener formats ACL_U_DOCUMENTATION_LANG/_SECTION.
- Skip build directories whose names can't become ACL options (charset,
  50-char auth_option limit, lang_ sections), and list them in the ACP.
- Default the docs build path to store/phpbbmodders_documentation via a
  new migration; boards with a build at the old default keep it.
- Set the language cookie with $user->set_cookie(), use login_box() for
  guests, inject the language service, guard getimagesize() by size
  instead of @, read the image page parameter as multibyte.
- Cache section and docs-root lookups per request; explicit nullable
  parameters for PHP 8.4.
- Escape build-derived values in templates; public static and & in
  the notification type; tabs and braces in the JavaScript.
- Cap phpBB at 3.3.x (soft-require and is_enableable), match the
  skeleton license, consistent array syntax.
- Regression tests for each fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The search page searches each allowed section's search-index.json (written
again by phpbbdocs-hugo) on the server when the browser doesn't run scripts
or the build has no Pagefind bundles. Every word must match and title
matches come first. documentation.js sets js=1 on the search form so the
server skips its own search when Pagefind will run, and
documentation-search.js replaces server results with Pagefind's when it
can, keeping them if Pagefind fails.

Index files are read with the same containment checks as pages, only for
sections the user may read, and are capped at 16 MiB.

The result limit, previously fixed at 50, is a new ACP setting, Search
results limit (10-200, default 50; migration m8), used by both searches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts:
#	README.md
#	controller/documentation_controller.php
#	controller/documentation_helper.php
#	docs/securing-docs-build.md
#	styles/all/template/js/documentation-search.js
#	tests/controller/documentation_controller_test.php
#	tests/controller/documentation_helper_test.php
@bonelifer
bonelifer requested a review from kaileymsnay October 7, 2026 13:44
@bonelifer
bonelifer merged commit 4b4d48a into main Oct 7, 2026
7 checks passed
@bonelifer
bonelifer deleted the search-server-fallback branch October 7, 2026 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants