merge r30864 from trunk to branch 2.5

bug 3186: improved security on search.php


git-svn-id: http://piwigo.org/svn/branches/2.5@30865 68402e56-0260-453c-a942-63ccdbb3a9ee

1 files changed, 4 insertions, 2 deletions

diff --git a/search.php b/search.php
index 84bf8a126..f1acf9701 100644
--- a/search.php
+++ b/search.php
@@ -48,7 +48,7 @@ if (isset($_POST['submit']))
       and !preg_match('/^\s*$/', $_POST['search_allwords']))
   {
     check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
-    
+
     $drop_char_match = array(
       '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
       '?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*');
@@ -105,6 +105,8 @@ if (isset($_POST['submit']))
   }
 
   // dates
+  check_input_parameter('date_type', $_POST, false, '/^date_(creation|available)$/');
+  
   $type_date = $_POST['date_type'];
 
   if (!empty($_POST['start_year']))
@@ -144,7 +146,7 @@ if (isset($_POST['submit']))
 INSERT INTO '.SEARCH_TABLE.'
   (rules, last_seen)
   VALUES
-  (\''.serialize($search).'\', NOW())
+  (\''.pwg_db_real_escape_string(serialize($search)).'\', NOW())
 ;';
     pwg_query($query);