Merge pull request #6191 from MrPetovan/task/urlencode-file-param

URL encode /network file query parameter

diff --git a/include/conversation.php b/include/conversation.php
index 1b7b34e71ad2938280b2e92f8fe89edb7cb92d1c..2d613f0f38ac5903d14e2698e8ec813ed8b70bfa 100644 (file)
--- a/include/conversation.php
+++ b/include/conversation.php
@@ -462,17 +462,17 @@ function conversation(App $a, array $items, Pager $pager, $mode, $update, $previ
                                . "<script> var profile_uid = " . $_SESSION['uid']
                                . "; var netargs = '" . substr($a->cmd, 8)
                                . '?f='
-                               . ((x($_GET, 'cid'))    ? '&cid='    . $_GET['cid']    : '')
-                               . ((x($_GET, 'search')) ? '&search=' . $_GET['search'] : '')
-                               . ((x($_GET, 'star'))   ? '&star='   . $_GET['star']   : '')
-                               . ((x($_GET, 'order'))  ? '&order='  . $_GET['order']  : '')
-                               . ((x($_GET, 'bmark'))  ? '&bmark='  . $_GET['bmark']  : '')
-                               . ((x($_GET, 'liked'))  ? '&liked='  . $_GET['liked']  : '')
-                               . ((x($_GET, 'conv'))   ? '&conv='   . $_GET['conv']   : '')
-                               . ((x($_GET, 'nets'))   ? '&nets='   . $_GET['nets']   : '')
-                               . ((x($_GET, 'cmin'))   ? '&cmin='   . $_GET['cmin']   : '')
-                               . ((x($_GET, 'cmax'))   ? '&cmax='   . $_GET['cmax']   : '')
-                               . ((x($_GET, 'file'))   ? '&file='   . $_GET['file']   : '')
+                               . ((x($_GET, 'cid'))    ? '&cid='    . rawurlencode($_GET['cid'])    : '')
+                               . ((x($_GET, 'search')) ? '&search=' . rawurlencode($_GET['search']) : '')
+                               . ((x($_GET, 'star'))   ? '&star='   . rawurlencode($_GET['star'])   : '')
+                               . ((x($_GET, 'order'))  ? '&order='  . rawurlencode($_GET['order'])  : '')
+                               . ((x($_GET, 'bmark'))  ? '&bmark='  . rawurlencode($_GET['bmark'])  : '')
+                               . ((x($_GET, 'liked'))  ? '&liked='  . rawurlencode($_GET['liked'])  : '')
+                               . ((x($_GET, 'conv'))   ? '&conv='   . rawurlencode($_GET['conv'])   : '')
+                               . ((x($_GET, 'nets'))   ? '&nets='   . rawurlencode($_GET['nets'])   : '')
+                               . ((x($_GET, 'cmin'))   ? '&cmin='   . rawurlencode($_GET['cmin'])   : '')
+                               . ((x($_GET, 'cmax'))   ? '&cmax='   . rawurlencode($_GET['cmax'])   : '')
+                               . ((x($_GET, 'file'))   ? '&file='   . rawurlencode($_GET['file'])   : '')
 
                                . "'; var profile_page = " . $pager->getPage() . "; </script>\r\n";
                }

diff --git a/mod/filerm.php b/mod/filerm.php
index 30a7f69df9a9e925468d18cd3e0e1ad70d61c5a6..d240c2d6a757927df98f1bf81134889c7e69da16 100644 (file)
--- a/mod/filerm.php
+++ b/mod/filerm.php
@@ -36,6 +36,6 @@ function filerm_content(App $a)
                info('Item was not deleted');
        }
 
-       $a->internalRedirect('/network?f=&file=' . $term);
+       $a->internalRedirect('/network?f=&file=' . rawurlencode($term));
        killme();
 }

diff --git a/mod/network.php b/mod/network.php
index 58f9484250f2cd8e8f41f808948b7b1be5bdd48f..594a557997c91352542e60eec9727a804518f08c 100644 (file)
--- a/mod/network.php
+++ b/mod/network.php
@@ -170,21 +170,17 @@ function network_init(App $a)
 
 function saved_searches($search)
 {
-       $a = get_app();
-
        $srchurl = '/network?f='
-               . ((x($_GET, 'cid'))   ? '&cid='   . $_GET['cid']   : '')
-               . ((x($_GET, 'star'))  ? '&star='  . $_GET['star']  : '')
-               . ((x($_GET, 'bmark')) ? '&bmark=' . $_GET['bmark'] : '')
-               . ((x($_GET, 'conv'))  ? '&conv='  . $_GET['conv']  : '')
-               . ((x($_GET, 'nets'))  ? '&nets='  . $_GET['nets']  : '')
-               . ((x($_GET, 'cmin'))  ? '&cmin='  . $_GET['cmin']  : '')
-               . ((x($_GET, 'cmax'))  ? '&cmax='  . $_GET['cmax']  : '')
-               . ((x($_GET, 'file'))  ? '&file='  . $_GET['file']  : '');
+               . ((x($_GET, 'cid'))   ? '&cid='   . rawurlencode($_GET['cid'])   : '')
+               . ((x($_GET, 'star'))  ? '&star='  . rawurlencode($_GET['star'])  : '')
+               . ((x($_GET, 'bmark')) ? '&bmark=' . rawurlencode($_GET['bmark']) : '')
+               . ((x($_GET, 'conv'))  ? '&conv='  . rawurlencode($_GET['conv'])  : '')
+               . ((x($_GET, 'nets'))  ? '&nets='  . rawurlencode($_GET['nets'])  : '')
+               . ((x($_GET, 'cmin'))  ? '&cmin='  . rawurlencode($_GET['cmin'])  : '')
+               . ((x($_GET, 'cmax'))  ? '&cmax='  . rawurlencode($_GET['cmax'])  : '')
+               . ((x($_GET, 'file'))  ? '&file='  . rawurlencode($_GET['file'])  : '');
        ;
 
-       $o = '';
-
        $terms = DBA::select('search', ['id', 'term'], ['uid' => local_user()]);
        $saved = [];
 
@@ -202,7 +198,7 @@ function saved_searches($search)
        $o = Renderer::replaceMacros($tpl, [
                '$title'     => L10n::t('Saved Searches'),
                '$add'       => L10n::t('add'),
-               '$searchbox' => HTML::search($search, 'netsearch-box', $srchurl, true),
+               '$searchbox' => HTML::search($search, 'netsearch-box', $srchurl),
                '$saved'     => $saved,
        ]);
 

diff --git a/mod/search.php b/mod/search.php
index 1ada76a9e6ee9d961d5d3da739e0d3836764c9c4..2810b23b1320e0db5eeaaeaf2e810a07ec61d5be 100644 (file)
--- a/mod/search.php
+++ b/mod/search.php
@@ -162,7 +162,7 @@ function search_content(App $a) {
                'name' => "search-header",
                '$title' => L10n::t("Search"),
                '$title_size' => 3,
-               '$content' => HTML::search($search,'search-box','search',((local_user()) ? true : false), false)
+               '$content' => HTML::search($search,'search-box','search', false)
        ]);
 
        if (strpos($search,'#') === 0) {

diff --git a/src/Content/Text/HTML.php b/src/Content/Text/HTML.php
index 544811536bc8e52577b3598be907ba4d49583316..6451b74faabaf2ab86e83d0feb5ec6ac533182d3 100644 (file)
--- a/src/Content/Text/HTML.php
+++ b/src/Content/Text/HTML.php
@@ -951,7 +951,7 @@ class HTML
         *
         * @return string Formatted HTML.
         */
-       public static function search($s, $id = 'search-box', $url = 'search', $save = false, $aside = true)
+       public static function search($s, $id = 'search-box', $url = 'search', $aside = true)
        {
                $mode = 'text';