From a6035f0cc1751f1312838539ed3c18619d66f31e Mon Sep 17 00:00:00 2001
From: Roman Kelesidis <roman25052006.kelesh@gmail.com>
Date: Sat, 21 Dec 2024 19:05:32 +0700
Subject: [PATCH] Fixed searching by username in `memberlist.php` (#1721)

* Fixed searching by username in `memberlist.php`

* Update memberlist.php

* Update memberlist.php

* Update CHANGELOG.md

* Update memberlist.php
---
 CHANGELOG.md   |  1 +
 memberlist.php | 17 ++++++++++++-----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f38692684..b410dfe88 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@
 - Show torrent's announcers list in `filelist.php` page [\#1708](https://github.com/torrentpier/torrentpier/pull/1708) ([belomaxorka](https://github.com/belomaxorka))
 - [PHP 8.4] Fixed some deprecations [\#1718](https://github.com/torrentpier/torrentpier/pull/1718) ([belomaxorka](https://github.com/belomaxorka))
 - [Configurable] Show magnet-links for guests [\#1712](https://github.com/torrentpier/torrentpier/pull/1712) ([belomaxorka](https://github.com/belomaxorka))
+- Fixed searching by username in `memberlist.php` [\#1721](https://github.com/torrentpier/torrentpier/pull/1721) ([belomaxorka](https://github.com/belomaxorka))
 - Set `cursor: pointer;` for buttons, inputs (buttons) [\#1710](https://github.com/torrentpier/torrentpier/pull/1710), [\#1711](https://github.com/torrentpier/torrentpier/pull/1711) ([belomaxorka](https://github.com/belomaxorka))
 - Minor improvements [\#1705](https://github.com/torrentpier/torrentpier/pull/1705), [\#1713](https://github.com/torrentpier/torrentpier/pull/1713), [\#1715](https://github.com/torrentpier/torrentpier/pull/1715), [\#1717](https://github.com/torrentpier/torrentpier/pull/1717), [\#1719](https://github.com/torrentpier/torrentpier/pull/1719), [\#1720](https://github.com/torrentpier/torrentpier/pull/1720) ([belomaxorka](https://github.com/belomaxorka))
 - New Crowdin updates [\#1704](https://github.com/torrentpier/torrentpier/pull/1704), [\#1706](https://github.com/torrentpier/torrentpier/pull/1706), [\#1714](https://github.com/torrentpier/torrentpier/pull/1714), [\#1716](https://github.com/torrentpier/torrentpier/pull/1716) ([Exileum](https://github.com/Exileum))
diff --git a/memberlist.php b/memberlist.php
index 3153ab345..281f0561a 100644
--- a/memberlist.php
+++ b/memberlist.php
@@ -16,7 +16,7 @@ $user->session_start(['req_login' => true]);
 $start = abs((int)request_var('start', 0));
 $mode = (string)request_var('mode', 'joined');
 $sort_order = (request_var('order', 'ASC') == 'ASC') ? 'ASC' : 'DESC';
-$username = request_var('username', '');
+$username = trim(request_var('username', ''));
 $role = (string)request_var('role', 'all');
 
 // Memberlist sorting
@@ -78,18 +78,25 @@ switch ($mode) {
 }
 
 $where_sql = '';
+
+// Search by role
 switch ($role) {
     case 'user':
-        $where_sql = ' AND user_level = ' . USER;
+        $where_sql .= ' AND user_level = ' . USER;
         break;
     case 'admin':
-        $where_sql = ' AND user_level = ' . ADMIN;
+        $where_sql .= ' AND user_level = ' . ADMIN;
         break;
     case 'moderator':
-        $where_sql = ' AND user_level = ' . MOD;
+        $where_sql .= ' AND user_level = ' . MOD;
         break;
 }
 
+// Search by username
+if (!empty($username)) {
+    $where_sql .= ' AND username LIKE "' . DB()->escape(str_replace('*', '%', clean_username($username))) . '"';
+}
+
 // Generate user information
 $sql = "SELECT username, user_id, user_rank, user_opt, user_posts, user_regdate, user_from, user_website, user_email, avatar_ext_id FROM " . BB_USERS . " WHERE user_id NOT IN(" . EXCLUDED_USERS . ") $where_sql ORDER BY $order_by";
 if ($result = DB()->fetch_rowset($sql)) {
@@ -118,7 +125,7 @@ if ($result = DB()->fetch_rowset($sql)) {
 
 // Pagination
 $paginationurl = "memberlist.php?mode=$mode&amp;order=$sort_order&amp;role=$role";
-$paginationurl .= $username ? "&amp;username=$username" : '';
+$paginationurl .= !empty($username) ? "&amp;username=$username" : '';
 
 if ($mode != 'topten') {
     $sql = "SELECT COUNT(*) AS total FROM " . BB_USERS . " WHERE user_id NOT IN(" . EXCLUDED_USERS . ") $where_sql";