archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bug 3020 and bug 3021 fixed: additionnal checks in search inputs

Browse source 
git-svn-id: http://piwigo.org/svn/trunk@26825 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall 2014-01-17 12:50:14 +00:00
commit 7f39d5b695
3 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/functions_search.inc.php
View file

@ -113,6 +113,12 @@ function get_sql_search_clause($search)
create_function('&$s','$s="(".$s.")";')
);
// make sure the "mode" is either OR or AND
if ($search['fields']['allwords']['mode'] != 'AND' and $search['fields']['allwords']['mode'] != 'OR')
{
$search['fields']['allwords']['mode'] = 'AND';
}
$clauses[] = "\n ".
implode(
"\n ". $search['fields']['allwords']['mode']. "\n ",

5
search.php
View file

@ -47,6 +47,8 @@ if (isset($_POST['submit']))
if (isset($_POST['search_allwords'])
and !preg_match('/^\s*$/', $_POST['search_allwords']))
{
check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
$drop_char_match = array(
'-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
'?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*');
@ -73,6 +75,7 @@ if (isset($_POST['submit']))
if (isset($_POST['tags']))
{
check_input_parameter('tags', $_POST, true, PATTERN_ID);
check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/');
$search['fields']['tags'] = array(
'words' => $_POST['tags'],
@ -85,7 +88,7 @@ if (isset($_POST['submit']))
$search['fields']['author'] = array(
'words' => preg_split(
'/\s+/',
$_POST['search_author']
strip_tags($_POST['search_author'])
),
'mode' => 'OR',
);

2
search_rules.php
View file

@ -107,7 +107,7 @@ if (isset($search['fields']['author']))
'search_words',
l10n(
'author(s) : %s',
join(', ', $search['fields']['author']['words'])
join(', ', array_map('strip_tags', $search['fields']['author']['words']))
)
);
}