diff options
| author | plegall <plg@piwigo.org> | 2014-03-25 12:53:10 +0000 |
|---|---|---|
| committer | plegall <plg@piwigo.org> | 2014-03-25 12:53:10 +0000 |
| commit | 9ce59f1af3895ea827e90ceb3f6a9a27ec4357fb (patch) | |
| tree | 70aaf45b8fbafcd6ce8a5172151f3d6e11d874b8 /search.php | |
| parent | 3e09f3ea83f4203cbb7f76fd1b9fb086073a353e (diff) | |
merge r26825 from trunk to branch 2.5
bug 3020 and bug 3021 fixed: additionnal checks in search inputs
git-svn-id: http://piwigo.org/svn/branches/2.5@27933 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'search.php')
| -rw-r--r-- | search.php | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/search.php b/search.php index 3e4c0ab3a..84bf8a126 100644 --- a/search.php +++ b/search.php @@ -47,6 +47,8 @@ if (isset($_POST['submit'])) if (isset($_POST['search_allwords']) and !preg_match('/^\s*$/', $_POST['search_allwords'])) { + check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/'); + $drop_char_match = array( '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_', '?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*'); @@ -73,6 +75,7 @@ if (isset($_POST['submit'])) if (isset($_POST['tags'])) { check_input_parameter('tags', $_POST, true, PATTERN_ID); + check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/'); $search['fields']['tags'] = array( 'words' => $_POST['tags'], @@ -85,7 +88,7 @@ if (isset($_POST['submit'])) $search['fields']['author'] = array( 'words' => preg_split( '/\s+/', - $_POST['search_author'] + strip_tags($_POST['search_author']) ), 'mode' => 'OR', ); |