Peter M. Groen / knowledgetree

Commit a0e8d4c390049b01278f3e9031d81dc0ea55aa94

Authored by Megan Watson
1 parent e86fa378

KTS-4009 - Tags are now stripped from the search query. 

"Pop-up alert when using the test XSS string in a Search field and running the Search against the DMS."

Committed by: Megan Watson
Reviewed by: Tohir Solomons



git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@9696 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 1 changed file with 1 additions and 0 deletions
search2.php
  View file @a0e8d4c
@@ -298,6 +298,7 @@ class SearchDispatcher extends KTStandardDispatcher { @@ -298,6 +298,7 @@ class SearchDispatcher extends KTStandardDispatcher {
298 298
299 // Strip out returns - they cause a js error [unterminated string literal] 299 // Strip out returns - they cause a js error [unterminated string literal]
300 $query = str_replace(array("\r\n", "\r", "\n"), array(' ', ' ', ' '), $query); 300 $query = str_replace(array("\r\n", "\r", "\n"), array(' ', ' ', ' '), $query);
  301 + $query = strip_tags($query);
301 302
302 $_SESSION['search2_quick'] = 0; 303 $_SESSION['search2_quick'] = 0;
303 $_SESSION['search2_general'] = 0; 304 $_SESSION['search2_general'] = 0;