From 9ce59f1af3895ea827e90ceb3f6a9a27ec4357fb Mon Sep 17 00:00:00 2001 From: plegall Date: Tue, 25 Mar 2014 12:53:10 +0000 Subject: merge r26825 from trunk to branch 2.5 bug 3020 and bug 3021 fixed: additionnal checks in search inputs git-svn-id: http://piwigo.org/svn/branches/2.5@27933 68402e56-0260-453c-a942-63ccdbb3a9ee --- search.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'search.php') diff --git a/search.php b/search.php index 3e4c0ab3a..84bf8a126 100644 --- a/search.php +++ b/search.php @@ -47,6 +47,8 @@ if (isset($_POST['submit'])) if (isset($_POST['search_allwords']) and !preg_match('/^\s*$/', $_POST['search_allwords'])) { + check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/'); + $drop_char_match = array( '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_', '?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*'); @@ -73,6 +75,7 @@ if (isset($_POST['submit'])) if (isset($_POST['tags'])) { check_input_parameter('tags', $_POST, true, PATTERN_ID); + check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/'); $search['fields']['tags'] = array( 'words' => $_POST['tags'], @@ -85,7 +88,7 @@ if (isset($_POST['submit'])) $search['fields']['author'] = array( 'words' => preg_split( '/\s+/', - $_POST['search_author'] + strip_tags($_POST['search_author']) ), 'mode' => 'OR', ); -- cgit v1.2.3