aboutsummaryrefslogtreecommitdiffstats
path: root/search.php
diff options
context:
space:
mode:
authorplegall <plg@piwigo.org>2014-03-25 12:53:10 +0000
committerplegall <plg@piwigo.org>2014-03-25 12:53:10 +0000
commit9ce59f1af3895ea827e90ceb3f6a9a27ec4357fb (patch)
tree70aaf45b8fbafcd6ce8a5172151f3d6e11d874b8 /search.php
parent3e09f3ea83f4203cbb7f76fd1b9fb086073a353e (diff)
merge r26825 from trunk to branch 2.5
bug 3020 and bug 3021 fixed: additionnal checks in search inputs git-svn-id: http://piwigo.org/svn/branches/2.5@27933 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'search.php')
-rw-r--r--search.php5
1 files changed, 4 insertions, 1 deletions
diff --git a/search.php b/search.php
index 3e4c0ab3a..84bf8a126 100644
--- a/search.php
+++ b/search.php
@@ -47,6 +47,8 @@ if (isset($_POST['submit']))
if (isset($_POST['search_allwords'])
and !preg_match('/^\s*$/', $_POST['search_allwords']))
{
+ check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
+
$drop_char_match = array(
'-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
'?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*');
@@ -73,6 +75,7 @@ if (isset($_POST['submit']))
if (isset($_POST['tags']))
{
check_input_parameter('tags', $_POST, true, PATTERN_ID);
+ check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/');
$search['fields']['tags'] = array(
'words' => $_POST['tags'],
@@ -85,7 +88,7 @@ if (isset($_POST['submit']))
$search['fields']['author'] = array(
'words' => preg_split(
'/\s+/',
- $_POST['search_author']
+ strip_tags($_POST['search_author'])
),
'mode' => 'OR',
);