FIX #17671 TIME 0:05 checking hardDelete privilege before search

src/app/search/controllers/SearchController.php

@@ -36,7 +36,7 @@ class SearchController
         $queryParams['softDeleted'] = empty($queryParams['softDeleted']) ? false : $queryParams['softDeleted'] == 'true';
         $queryParams['hardDeleted'] = empty($queryParams['hardDeleted']) ? false : $queryParams['hardDeleted'] == 'true';
 
-        if ($queryParams['softDeleted'] && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'can_purge'])) {
+        if (($queryParams['softDeleted'] || $queryParams['softDeleted']) && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'can_purge'])) {
             return $response->withStatus(403)->withJson(['errors' => 'Privilege forbidden']);
         }