aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--Zotlabs/Lib/Enotify.php14
-rw-r--r--Zotlabs/Module/Search.php6
-rw-r--r--include/text.php2
3 files changed, 16 insertions, 6 deletions
diff --git a/Zotlabs/Lib/Enotify.php b/Zotlabs/Lib/Enotify.php
index cfb0bd344..25c96d9cc 100644
--- a/Zotlabs/Lib/Enotify.php
+++ b/Zotlabs/Lib/Enotify.php
@@ -825,7 +825,7 @@ class Enotify {
// convert this logic into a json array just like the system notifications
- return array(
+ $x = array(
'notify_link' => $item['llink'],
'name' => $item['author']['xchan_name'],
'url' => $item['author']['xchan_url'],
@@ -835,9 +835,19 @@ class Enotify {
'b64mid' => ((in_array($item['verb'], [ACTIVITY_LIKE, ACTIVITY_DISLIKE])) ? 'b64.' . base64url_encode($item['thr_parent']) : 'b64.' . base64url_encode($item['mid'])),
'notify_id' => 'undefined',
'thread_top' => (($item['item_thread_top']) ? true : false),
- 'message' => strip_tags(bbcode($itemem_text))
+ 'message' => strip_tags(bbcode($itemem_text)),
+ // these are for the superblock addon
+ 'hash' => $item['author']['xchan_hash'],
+ 'uid' => local_channel(),
+ 'display' => true
);
+ call_hooks('enotify_format',$x);
+ if(! $x['display']) {
+ return [];
+ }
+
+ return $x;
}
}
diff --git a/Zotlabs/Module/Search.php b/Zotlabs/Module/Search.php
index e520c671d..272bbdac1 100644
--- a/Zotlabs/Module/Search.php
+++ b/Zotlabs/Module/Search.php
@@ -6,7 +6,7 @@ class Search extends \Zotlabs\Web\Controller {
function init() {
if(x($_REQUEST,'search'))
- \App::$data['search'] = $_REQUEST['search'];
+ \App::$data['search'] = escape_tags($_REQUEST['search']);
}
@@ -46,12 +46,12 @@ class Search extends \Zotlabs\Web\Controller {
if(x(\App::$data,'search'))
$search = trim(\App::$data['search']);
else
- $search = ((x($_GET,'search')) ? trim(rawurldecode($_GET['search'])) : '');
+ $search = ((x($_GET,'search')) ? trim(escape_tags(rawurldecode($_GET['search']))) : '');
$tag = false;
if(x($_GET,'tag')) {
$tag = true;
- $search = ((x($_GET,'tag')) ? trim(rawurldecode($_GET['tag'])) : '');
+ $search = ((x($_GET,'tag')) ? trim(escape_tags(rawurldecode($_GET['tag']))) : '');
}
$static = ((array_key_exists('static',$_REQUEST)) ? intval($_REQUEST['static']) : 0);
diff --git a/include/text.php b/include/text.php
index 076c98407..da18080dd 100644
--- a/include/text.php
+++ b/include/text.php
@@ -1075,7 +1075,7 @@ function micropro($contact, $redirect = false, $class = '', $mode = false) {
function search($s,$id='search-box',$url='/search',$save = false) {
return replace_macros(get_markup_template('searchbox.tpl'),array(
- '$s' => $s,
+ '$s' => htmlspecialchars($s),
'$id' => $id,
'$action_url' => z_root() . $url,
'$search_label' => t('Search'),