handle escaped file chars in display and search

diff --git a/include/contact_widgets.php b/include/contact_widgets.php
index 1f70e536f2461b6872634e2894b5da5d1a4bd462..7346b95afab009d96a98ad0195e04b2dafc8ed16 100755 (executable)
--- a/include/contact_widgets.php
+++ b/include/contact_widgets.php
@@ -87,7 +87,7 @@ function fileas_widget($baseurl,$selected = '') {
     $cnt = preg_match_all('/\[(.*?)\]/',$saved,$matches,PREG_SET_ORDER);
     if($cnt) {
                foreach($matches as $mtch) {
-                       $unescaped = file_tag_decode($mtch[1]);
+                       $unescaped = xmlify(file_tag_decode($mtch[1]));
                        $terms[] = array('name' => $unescaped,'selected' => (($selected == $unescaped) ? 'selected' : ''));
                }
        }

diff --git a/include/text.php b/include/text.php
index 64f6f72a8c8244d556067b5a4d6f01e480d1071f..191f4fca8ab5d04b4d4218fbabbefa84a61973dd 100644 (file)
--- a/include/text.php
+++ b/include/text.php
@@ -920,7 +920,7 @@ function prepare_body($item,$attach = false) {
                foreach($matches as $mtch) {
                        if(strlen($x))
                                $x .= ',';
-                       $x .= file_tag_decode($mtch[1]);
+                       $x .= xmlify(file_tag_decode($mtch[1]));
                }
                if(strlen($x))
                        $s .= '<div class="categorytags"><span>' . t('Categories:') . ' </span>' . $x . '</div>'; 
@@ -935,7 +935,7 @@ function prepare_body($item,$attach = false) {
                foreach($matches as $mtch) {
                        if(strlen($x))
                                $x .= '&nbsp;&nbsp;&nbsp;';
-                       $x .= file_tag_decode($mtch[1]). ' <a href="' . $a->get_baseurl() . '/filerm/' . $item['id'] . '?f=&term=' . file_tag_decode($mtch[1]) . '" title="' . t('remove') . '" >' . t('[remove]') . '</a>';
+                       $x .= xmlify(file_tag_decode($mtch[1])) . ' <a href="' . $a->get_baseurl() . '/filerm/' . $item['id'] . '?f=&term=' . xmlify(file_tag_decode($mtch[1])) . '" title="' . t('remove') . '" >' . t('[remove]') . '</a>';
                }
                if(strlen($x) && (local_user() == $item['uid']))
                        $s .= '<div class="filesavetags"><span>' . t('Filed under:') . ' </span>' . $x . '</div>'; 
@@ -1307,13 +1307,10 @@ function file_tag_decode($s) {
 
 function file_tag_file_query($table,$s,$type = 'file') {
 
-       // this is ultimately going into a vsprintf
-       $s = str_replace('%','%%',$s);
-
        if($type == 'file')
-               $str = preg_quote( '[' . file_tag_encode($s) . ']' );
+               $str = preg_quote( '[' . str_replace('%','%%',file_tag_encode($s)) . ']' );
        else
-               $str = preg_quote( '<' . file_tag_encode($s) . '>' );
+               $str = preg_quote( '<' . str_replace('%','%%',file_tag_encode($s)) . '>' );
        return " AND " . (($table) ? dbesc($table) . '.' : '') . "file regexp '" . dbesc($str) . "' ";
 }
 

diff --git a/mod/filer.php b/mod/filer.php
index 3b3a379310aa0b800653d753202126d88182bd11..3cd1bfe22ff7a67306ef8a67b73e7687bf0b382d 100755 (executable)
--- a/mod/filer.php
+++ b/mod/filer.php
@@ -11,8 +11,8 @@ function filer_content(&$a) {
                killme();
        }
 
-       $term = notags(trim($_GET['term']));
-       $item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
+       $term = unxmlify(trim($_GET['term']));
+       $item_id = (($a->argc > 1) ? intval($a->argv[1]) : 0);
 
        logger('filer: tag ' . $term . ' item ' . $item_id);
 

diff --git a/mod/filerm.php b/mod/filerm.php
index 66b684dc964b69cb5a140d8dc176e0172feb59a7..c520fec7ac0f48a5adcdf13630f76a1026bd611c 100644 (file)
--- a/mod/filerm.php
+++ b/mod/filerm.php
@@ -6,8 +6,8 @@ function filerm_content(&$a) {
                killme();
        }
 
-       $term = notags(trim($_GET['term']));
-       $item_id = (($a->argc > 1) ? notags(trim($a->argv[1])) : 0);
+       $term = unxmlify(trim($_GET['term']));
+       $item_id = (($a->argc > 1) ? intval($a->argv[1]) : 0);
 
        logger('filerm: tag ' . $term . ' item ' . $item_id);
 

diff --git a/mod/network.php b/mod/network.php
index 5ca0a8c7d6ced49fb4cdb21defca7402c75b65e5..d27945a860d6cdd43ad65a85097047573c3dc4ab 100755 (executable)
--- a/mod/network.php
+++ b/mod/network.php
@@ -393,7 +393,7 @@ function network_content(&$a, $update = 0) {
                );
        }
        if(strlen($file)) {
-               $sql_extra .= file_tag_file_query('item',$file);
+               $sql_extra .= file_tag_file_query('item',unxmlify($file));
        }
 
        if($conv) {