Commit a0e8d4c390049b01278f3e9031d81dc0ea55aa94
1 parent
e86fa378
KTS-4009 - Tags are now stripped from the search query.
"Pop-up alert when using the test XSS string in a Search field and running the Search against the DMS." Committed by: Megan Watson Reviewed by: Tohir Solomons git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@9696 c91229c3-7414-0410-bfa2-8a42b809f60b
Showing
1 changed file
with
1 additions
and
0 deletions
search2.php
| ... | ... | @@ -298,6 +298,7 @@ class SearchDispatcher extends KTStandardDispatcher { |
| 298 | 298 | |
| 299 | 299 | // Strip out returns - they cause a js error [unterminated string literal] |
| 300 | 300 | $query = str_replace(array("\r\n", "\r", "\n"), array(' ', ' ', ' '), $query); |
| 301 | + $query = strip_tags($query); | |
| 301 | 302 | |
| 302 | 303 | $_SESSION['search2_quick'] = 0; |
| 303 | 304 | $_SESSION['search2_general'] = 0; | ... | ... |