Changeset 2727:30bcbc3f4d95

Timestamp:

07/10/14 10:35:26 (11 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.6

Message:

Sanitize search request.

File:

• admin/search.php (modified) (2 diffs)

admin/search.php

@@ -29 +29 @@
 if ($q)
 {
+     $q = html::escapeHTML($q);
+
      $params = array();
 
@@ -94 +96 @@
 '<form action="search.php" method="get">'.
 '<div class="fieldset"><h3>'.__('Search options').'</h3>'.
-'<p><label for="q">'.__('Query:').' </label>'.form::field('q',30,255,html::escapeHTML($q)).'</p>'.
+'<p><label for="q">'.__('Query:').' </label>'.form::field('q',30,255,$q).'</p>'.
 '<p><label for="qtype1" class="classic">'.form::radio(array('qtype','qtype1'),'p',$qtype == 'p').' '.__('Search in entries').'</label> '.
 '<label for="qtype2" class="classic">'.form::radio(array('qtype','qtype2'),'c',$qtype == 'c').' '.__('Search in comments').'</label></p>'.