Search is not filtered based on device permissions

Search is not filtered based on device permissions. This leads to a info leak when providing restricted access for users on specific devices. Search results will include devices, sensors and other resources on devices which the user should not be able to see.

This appears to be because of using $GLOBALS['cache']['where']['device_permitted'] to generate the WHERE-clause, while the correct variable is $GLOBALS['cache']['where']['devices_permitted'].

I've attached a proposed patch.