From f65c425786044d9ffdd5aaf835f6b84a6894f329 Mon Sep 17 00:00:00 2001
From: Daniel Lockyer <hi@daniellockyer.com>
Date: Mon, 6 Jul 2020 09:09:08 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fixed=20searching=20for=20free/p?=
 =?UTF-8?q?aid=20members?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

no issue

- when searching for paid/free members, the `members_stripe_customers`
  table would be joined into the query on `members`
- this table also has a `name` and `email` field, so both MySQL and
  SQLite would complain about ambiguous fields in the query
- the result of this would be a 500 error thrown inside Ghost, and no
  useful response to the user
- this commit explicitly chooses the `members` table to check against,
  and also adds a test for this
---
 core/server/models/member.js                  |  4 ++--
 .../api/canary/admin/members_spec.js          | 20 +++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/core/server/models/member.js b/core/server/models/member.js
index 7fd50aec84..7595933cc1 100644
--- a/core/server/models/member.js
+++ b/core/server/models/member.js
@@ -155,8 +155,8 @@ const Member = ghostBookshelf.Model.extend({
     },
 
     searchQuery: function searchQuery(queryBuilder, query) {
-        queryBuilder.where('name', 'like', `%${query}%`);
-        queryBuilder.orWhere('email', 'like', `%${query}%`);
+        queryBuilder.where('members.name', 'like', `%${query}%`);
+        queryBuilder.orWhere('members.email', 'like', `%${query}%`);
     },
 
     // TODO: hacky way to filter by members with an active subscription,
diff --git a/test/regression/api/canary/admin/members_spec.js b/test/regression/api/canary/admin/members_spec.js
index ecc85d8515..ea614e9f9f 100644
--- a/test/regression/api/canary/admin/members_spec.js
+++ b/test/regression/api/canary/admin/members_spec.js
@@ -70,6 +70,26 @@ describe('Members API', function () {
             });
     });
 
+    it('Can search for paid members', function () {
+        return request
+            .get(localUtils.API.getApiQuery('members/?search=egon&paid=true'))
+            .set('Origin', config.get('url'))
+            .expect('Content-Type', /json/)
+            .expect('Cache-Control', testUtils.cacheRules.private)
+            .expect(200)
+            .then((res) => {
+                should.not.exist(res.headers['x-cache-invalidate']);
+                const jsonResponse = res.body;
+                should.exist(jsonResponse);
+                should.exist(jsonResponse.members);
+                jsonResponse.members.should.have.length(1);
+                jsonResponse.members[0].email.should.equal('paid@test.com');
+                localUtils.API.checkResponse(jsonResponse, 'members');
+                localUtils.API.checkResponse(jsonResponse.members[0], 'member', 'stripe');
+                localUtils.API.checkResponse(jsonResponse.meta.pagination, 'pagination');
+            });
+    });
+
     it('Add should fail when passing incorrect email_type query parameter', function () {
         const member = {
             name: 'test',