Add check to make sure users don’t search for parties/guilds they are not part of

website/server/controllers/api-v4/members.js

@@ -1,4 +1,5 @@
 import {model as User} from '../../models/user';
+import {authWithHeaders} from '../../middlewares/auth';
 
 let api = {};
 
@@ -6,7 +7,7 @@ let api = {};
 api.getUsernameAutocompletes = {
   method: 'GET',
   url: '/members/find/:username',
-  middlewares: [],
+  middlewares: [authWithHeaders()],
   async handler (req, res) {
     res.set('Cache-Control', 'public, max-age=300000'); // 5 minutes
     req.checkParams('username', res.t('invalidReqParams')).notEmpty();
@@ -28,12 +29,16 @@ api.getUsernameAutocompletes = {
     let id = req.query.id;
     if (context && id) {
       if (context === 'party') {
-        query['party._id'] = id;
+        query['party._id'] = res.locals.user.party._id;
       } else if (context === 'privateGuild') {
-        query.guilds = id;
+        if (res.locals.user.guilds.includes(id)) {
+          query.guilds = id;
+        }
       }
     }
 
+    console.log(query);
+
     let members = await User
       .find(query)
       .select(['profile.name', 'contributor', 'auth.local.username'])