aboutsummaryrefslogtreecommitdiffstats
path: root/search.php
diff options
context:
space:
mode:
authorplegall <plg@piwigo.org>2014-01-17 12:50:14 +0000
committerplegall <plg@piwigo.org>2014-01-17 12:50:14 +0000
commit7f39d5b695f90f5d622f9b070a5a4815c584e707 (patch)
tree2f71e73ffe6d37c818b10cc891b766865f14022b /search.php
parent787089742d1d8e29f4d0d46c4458f43902d8fec7 (diff)
bug 3020 and bug 3021 fixed: additionnal checks in search inputs
git-svn-id: http://piwigo.org/svn/trunk@26825 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
-rw-r--r--search.php5
1 files changed, 4 insertions, 1 deletions
diff --git a/search.php b/search.php
index 43451cb7c..6feee2780 100644
--- a/search.php
+++ b/search.php
@@ -47,6 +47,8 @@ if (isset($_POST['submit']))
if (isset($_POST['search_allwords'])
and !preg_match('/^\s*$/', $_POST['search_allwords']))
{
+ check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
+
$drop_char_match = array(
'-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
'?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*');
@@ -73,6 +75,7 @@ if (isset($_POST['submit']))
if (isset($_POST['tags']))
{
check_input_parameter('tags', $_POST, true, PATTERN_ID);
+ check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/');
$search['fields']['tags'] = array(
'words' => $_POST['tags'],
@@ -85,7 +88,7 @@ if (isset($_POST['submit']))
$search['fields']['author'] = array(
'words' => preg_split(
'/\s+/',
- $_POST['search_author']
+ strip_tags($_POST['search_author'])
),
'mode' => 'OR',
);