From a2832af01fbe2b1b6bada85651b1207de5f5af9e Mon Sep 17 00:00:00 2001
From: Alexander Skvortsov <38059171+askvortsov1@users.noreply.github.com>
Date: Wed, 13 Oct 2021 14:57:45 -0400
Subject: [PATCH] Only search users via rest API if user has permission (#73)

Closes https://github.com/flarum/core/issues/3070

If the user doesn't have permission to search users, there will currently be browser errors, as the current implementation will still attempt to search and autocomplete. In this PR, we check for permission before searching. The dropdown will still support autocomplete of users currently participating in the discussion.
---
 extensions/mentions/js/src/forum/addComposerAutocomplete.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/mentions/js/src/forum/addComposerAutocomplete.js b/extensions/mentions/js/src/forum/addComposerAutocomplete.js
index 1fedafeac..c93ef2d44 100644
--- a/extensions/mentions/js/src/forum/addComposerAutocomplete.js
+++ b/extensions/mentions/js/src/forum/addComposerAutocomplete.js
@@ -224,7 +224,7 @@ export default function addComposerAutocomplete() {
 
         // Don't send API calls searching for users until at least 2 characters have been typed.
         // This focuses the mention results on users and posts in the discussion.
-        if (typed.length > 1) {
+        if (typed.length > 1 && app.forum.attribute('canSearchUsers')) {
           throttledSearch(typed, searched, returnedUsers, returnedUserIds, dropdown, buildSuggestions);
         }
       }