Merge remote branch 'upstream/master'

2 files changed, 22 insertions, 15 deletions

diff --git a/mod/message.php b/mod/message.php
index 867f199c4..b8695fdd9 100644
--- a/mod/message.php
+++ b/mod/message.php
@@ -173,15 +173,22 @@ function message_content(&$a) {
 	
 		$preselect = (isset($a->argv[2])?array($a->argv[2]):false);
 	
-		$select = contact_select('messageto','message-to-select', $preselect, 4, true, false, false, 10);
+		if(defined('EMAIL_AUTOCOMP')) {
 
-// here's sort of where we want to do contact autocomplete
-// comment out the contact selector line just above and use the following one instead,
-// then figure out how to make it do the right thing
-// pictures would be nice, but that didn't seem to work when I tried it 
-// (the json backend is found in mod/acl.php)
+			// here's where we want to do contact autocomplete
+			// just figure out how to make it do the right thing
+			// pictures would be nice, but that didn't work when I tried.
+			// It sort of barely works, but needs help
+			// (the json backend is found in mod/acl.php)
 
-//		$select = '<input type="text" id="recip" name="messageto" value="' . $preselect .'" />';
+			$select = '<input type="text" id="recip" name="messageto" value="' . $preselect .'" />';
+		}
+		else {
+
+			// the ugly select box
+
+			$select = contact_select('messageto','message-to-select', $preselect, 4, true, false, false, 10);
+		}
 
 		$tpl = get_markup_template('prv_message.tpl');
 		$o .= replace_macros($tpl,array(
diff --git a/mod/network.php b/mod/network.php
index 5655f1bfa..e59839ccc 100644
--- a/mod/network.php
+++ b/mod/network.php
@@ -340,7 +340,7 @@ function network_content(&$a, $update = 0) {
 				info( t('Group is empty'));
 		}
 
-		$sql_extra = " AND `item`.`parent` IN ( SELECT DISTINCT(`parent`) FROM `item` WHERE 1 $sql_options AND ( `contact-id` IN ( $contact_str ) OR `allow_gid` REGEXP '<" . intval($group) . ">' ) and deleted = 0 ) ";
+		$sql_extra = " AND `item`.`parent` IN ( SELECT DISTINCT(`parent`) FROM `item` WHERE 1 $sql_options AND ( `contact-id` IN ( $contact_str ) OR `allow_gid` like '" . protect_sprintf('%<' . intval($group) . '>%') . "' ) and deleted = 0 ) ";
 		$o = '<h2>' . t('Group: ') . $r[0]['name'] . '</h2>' . $o;
 	}
 	elseif($cid) {
@@ -398,9 +398,9 @@ function network_content(&$a, $update = 0) {
 
 	if(x($_GET,'search')) {
 		$search = escape_tags($_GET['search']);
-		$sql_extra .= sprintf(" AND ( `item`.`body` REGEXP '%s' OR `item`.`tag` REGEXP '%s' ) ",
-			dbesc(preg_quote($search)),
-			dbesc('\\]' . preg_quote($search) . '\\[')
+		$sql_extra .= sprintf(" AND ( `item`.`body` like '%s' OR `item`.`tag` like '%s' ) ",
+			dbesc(protect_sprintf('%' . $search . '%')),
+			dbesc(protect_sprintf('%]' . $search . '[%'))
 		);
 	}
 	if(strlen($file)) {
@@ -412,10 +412,10 @@ function network_content(&$a, $update = 0) {
 		$myurl = substr($myurl,strpos($myurl,'://')+3);
 		$myurl = str_replace(array('www.','.'),array('','\\.'),$myurl);
 		$diasp_url = str_replace('/profile/','/u/',$myurl);
-		$sql_extra .= sprintf(" AND `item`.`parent` IN (SELECT distinct(`parent`) from item where ( `author-link` regexp '%s' or `tag` regexp '%s' or tag regexp '%s' )) ",
-			dbesc($myurl . '$'),
-			dbesc($myurl . '\\]'),
-			dbesc($diasp_url . '\\]')
+		$sql_extra .= sprintf(" AND `item`.`parent` IN (SELECT distinct(`parent`) from item where ( `author-link` like '%s' or `tag` like '%s' or tag like '%s' )) ",
+			dbesc(protect_sprintf('%s' . $myurl)),
+			dbesc(protect_sprintf('%' . $myurl . '\\]%')),
+			dbesc(protect_sprintf('%' . $diasp_url . '\\]%'))
 		);
 	}