Changeset 26825


Ignore:
Timestamp:
01/17/14 13:50:14 (6 years ago)
Author:
plg
Message:

bug 3020 and bug 3021 fixed: additionnal checks in search inputs

Location:
trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/include/functions_search.inc.php

    r26649 r26825  
    114114      ); 
    115115 
     116    // make sure the "mode" is either OR or AND 
     117    if ($search['fields']['allwords']['mode'] != 'AND' and $search['fields']['allwords']['mode'] != 'OR') 
     118    { 
     119      $search['fields']['allwords']['mode'] = 'AND'; 
     120    } 
     121 
    116122    $clauses[] = "\n         ". 
    117123      implode( 
  • trunk/search.php

    r26461 r26825  
    4848      and !preg_match('/^\s*$/', $_POST['search_allwords'])) 
    4949  { 
     50    check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/'); 
     51     
    5052    $drop_char_match = array( 
    5153      '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_', 
     
    7476  { 
    7577    check_input_parameter('tags', $_POST, true, PATTERN_ID); 
     78    check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/'); 
    7679     
    7780    $search['fields']['tags'] = array( 
     
    8689      'words' => preg_split( 
    8790        '/\s+/', 
    88         $_POST['search_author'] 
     91        strip_tags($_POST['search_author']) 
    8992        ), 
    9093      'mode' => 'OR', 
  • trunk/search_rules.php

    r26461 r26825  
    108108      l10n( 
    109109        'author(s) : %s', 
    110         join(', ', $search['fields']['author']['words']) 
     110        join(', ', array_map('strip_tags', $search['fields']['author']['words'])) 
    111111        ) 
    112112      ); 
Note: See TracChangeset for help on using the changeset viewer.