Changeset 27933 for branches

Timestamp:

Mar 25, 2014, 1:53:10 PM (11 years ago)

Author:

plg

Message:

merge r26825 from trunk to branch 2.5

bug 3020 and bug 3021 fixed: additionnal checks in search inputs

Location:

branches/2.5

Files:

• include/functions_search.inc.php (modified) (1 diff)
• search.php (modified) (3 diffs)
• search_rules.php (modified) (1 diff)

branches/2.5/include/functions_search.inc.php

@@ -118 +118 @@
       );
 
-    array_push(
-      $clauses,
-      "\n         ".
+    // make sure the "mode" is either OR or AND
+    if ($search['fields']['allwords']['mode'] != 'AND' and $search['fields']['allwords']['mode'] != 'OR')
+    {
+      $search['fields']['allwords']['mode'] = 'AND';
+    }
+
+    $clauses[] = "\n         ".
       implode(
         "\n         ".

branches/2.5/search.php

@@ -48 +48 @@
       and !preg_match('/^\s*$/', $_POST['search_allwords']))
   {
+    check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
+    
     $drop_char_match = array(
       '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
@@ -74 +76 @@
   {
     check_input_parameter('tags', $_POST, true, PATTERN_ID);
+    check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/');
     
     $search['fields']['tags'] = array(
@@ -86 +89 @@
       'words' => preg_split(
         '/\s+/',
-        $_POST['search_author']
+        strip_tags($_POST['search_author'])
         ),
       'mode' => 'OR',

branches/2.5/search_rules.php

@@ -107 +107 @@
      sprintf(
           l10n('author(s) : %s'),
-          join(', ', $search['fields']['author']['words'])
+          join(', ', array_map('strip_tags', $search['fields']['author']['words']))
         )
       );