diff options
| author | Michael Vogel <icarus@dabo.de> | 2012-06-04 08:09:15 +0200 |
|---|---|---|
| committer | Michael Vogel <icarus@dabo.de> | 2012-06-04 08:09:15 +0200 |
| commit | 0353410cd4b8153fd2b6e9d3524c6e46ad4acd68 (patch) | |
| tree | e93cc7977a7367eb6281c733d9a34730dae3bf95 /mod/search.php | |
| parent | 5de91c2a7c924ac6067828a0e5bfbef5572c1f39 (diff) | |
| parent | ca105f1c669950768a1f4cd6b93f471cabbc5114 (diff) | |
| download | volse-hubzilla-0353410cd4b8153fd2b6e9d3524c6e46ad4acd68.tar.gz volse-hubzilla-0353410cd4b8153fd2b6e9d3524c6e46ad4acd68.tar.bz2 volse-hubzilla-0353410cd4b8153fd2b6e9d3524c6e46ad4acd68.zip | |
Merge remote branch 'upstream/master'
Diffstat (limited to 'mod/search.php')
| -rw-r--r-- | mod/search.php | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/mod/search.php b/mod/search.php index d4cd9d967..320ffddce 100644 --- a/mod/search.php +++ b/mod/search.php @@ -110,18 +110,19 @@ function search_content(&$a) { if (get_config('system','use_fulltext_engine')) { if($tag) - $sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.preg_quote($search)); + $sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.dbesc(protect_sprintf($search))); else - $sql_extra = sprintf(" AND MATCH (`item`.`body`) AGAINST ('".'"%s"'."' in boolean mode) ", dbesc(preg_quote($search))); + $sql_extra = sprintf(" AND MATCH (`item`.`body`) AGAINST ('".'"%s"'."' in boolean mode) ", dbesc(protect_sprintf($search))); } else { if($tag) - $sql_extra = sprintf(" AND `item`.`tag` REGEXP '%s' ", dbesc('\\]' . preg_quote($search) . '\\[')); + $sql_extra = sprintf(" AND `item`.`tag` REGEXP '%s' ", dbesc('\\]' . protect_sprintf(preg_quote($search)) . '\\[')); else - $sql_extra = sprintf(" AND `item`.`body` REGEXP '%s' ", dbesc(preg_quote($search))); + $sql_extra = sprintf(" AND `item`.`body` REGEXP '%s' ", dbesc(protect_sprintf(preg_quote($search)))); } + // Here is the way permissions work in the search module... // Only public posts can be shown // OR your own posts if you are a logged in member @@ -145,7 +146,7 @@ function search_content(&$a) { } $r = q("SELECT distinct(`item`.`uri`), `item`.*, `item`.`id` AS `item_id`, - `contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`, + `contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`alias`, `contact`.`rel`, `contact`.`network`, `contact`.`thumb`, `contact`.`self`, `contact`.`writable`, `contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`, `user`.`nickname` |