Changeset 3511

Timestamp:

12/04/2010 11:41:28 PM (14 years ago)

Author:

djpaul

Message:

Fix double-escaping of search string when performing search from the site-wide search box. Partially addresses #2776.

Location:

trunk

Files:

• bp-blogs/bp-blogs-templatetags.php (modified) (1 diff)
• bp-core.php (modified) (1 diff)
• bp-core/bp-core-templatetags.php (modified) (1 diff)
• bp-forums/bp-forums-templatetags.php (modified) (1 diff)
• bp-groups/bp-groups-templatetags.php (modified) (1 diff)

trunk/bp-blogs/bp-blogs-templatetags.php

@@ -503 +503 @@
 
 function bp_directory_blogs_search_form() {
-    global $bp; ?>
+    global $bp;
+
+    $search_value = __( 'Search anything...', 'buddypress' );
+    if ( !empty( $_GET['s'] ) )
+        $search_value = stripslashes( $_GET['s'] );
+
+    ?>
     <form action="" method="get" id="search-blogs-form">
-        <label><input type="text" name="s" id="blogs_search" value="<?php if ( isset( $_GET['s'] ) ) { echo $_GET['s']; } else { _e( 'Search anything...', 'buddypress' ); } ?>"  onfocus="if (this.value == '<?php _e( 'Search anything...', 'buddypress' ) ?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e( 'Search anything...', 'buddypress' ) ?>';}" /></label>
+        <label><input type="text" name="s" id="blogs_search" value="<?php echo esc_attr( $search_value ) ?>"  onfocus="if (this.value == '<?php _e( 'Search anything...', 'buddypress' ) ?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e( 'Search anything...', 'buddypress' ) ?>';}" /></label>
         <input type="submit" id="blogs_search_submit" name="blogs_search_submit" value="<?php _e( 'Search', 'buddypress' ) ?>" />
     </form>

trunk/bp-core.php

@@ -1679 +1679 @@
  * @package BuddyPress Core
  * @global $bp The global BuddyPress settings variable created in bp_core_setup_globals()
- * @param $slug The slug to redirect to for searching.
- */
-function bp_core_action_search_site( $slug = false ) {
-    global $bp;
-
-    if ( $bp->current_component == BP_SEARCH_SLUG ) {
-        $search_terms = $_POST['search-terms'];
-        $search_which = $_POST['search-which'];
-
-        if ( !$slug || empty( $slug ) ) {
-            switch ( $search_which ) {
-                case 'members': default:
-                    $slug = $bp->members->slug;
-                    $var = '/?s=';
-                    break;
-                case 'groups':
-                    $slug = BP_GROUPS_SLUG;
-                    $var = '/?s=';
-                    break;
-                case 'forums':
-                    $slug = BP_FORUMS_SLUG;
-                    $var = '/?fs=';
-                    break;
-                case 'blogs':
-                    $slug = BP_BLOGS_SLUG;
-                    $var = '/?s=';
-                    break;
-            }
+ * @param string $slug The slug to redirect to for searching.
+ */
+function bp_core_action_search_site( $slug = '' ) {
+    global $bp;
+
+    if ( BP_SEARCH_SLUG != $bp->current_component )
+        return;
+
+    if ( empty( $_POST['search-terms'] ) ) {
+        bp_core_redirect( $bp->root_domain );
+        return;
+    }
+
+    $search_terms = stripslashes( $_POST['search-terms'] );
+    $search_which = !empty( $_POST['search-which'] ) ? $_POST['search-which'] : '';
+    $query_string = '/?s=';
+
+    if ( empty( $slug ) ) {
+        switch ( $search_which ) {
+            case 'blogs':
+                $slug = bp_is_active( 'blogs' )  ? $bp->blogs->slug  : '';
+                break;
+            case 'forums':
+                $slug = bp_is_active( 'forums' ) ? $bp->forums->slug : '';
+                $query_string = '/?fs=';
+                break;
+            case 'groups':
+                $slug = bp_is_active( 'groups' ) ? $bp->groups->slug : '';
+                break;
+            case 'members':
+            default:
+                $slug = $bp->members->slug;
+                break;
         }
 
-        $search_url = apply_filters( 'bp_core_search_site', site_url( $slug . $var . urlencode($search_terms) ), $search_terms );
-
-        bp_core_redirect( $search_url );
-    }
+        if ( empty( $slug ) ) {
+            bp_core_redirect( $bp->root_domain );
+            return;
+        }
+    }
+
+    bp_core_redirect( apply_filters( 'bp_core_search_site', site_url( $slug . $query_string . urlencode( $search_terms ) ), $search_terms ) );
 }
 add_action( 'init', 'bp_core_action_search_site', 5 );

trunk/bp-core/bp-core-templatetags.php

@@ -457 +457 @@
     $search_value = __( 'Search anything...', 'buddypress' );
     if ( !empty( $_GET['s'] ) )
-        $search_value = $_GET['s'];
+        $search_value = stripslashes( $_GET['s'] );
 
     ?>

trunk/bp-forums/bp-forums-templatetags.php

@@ -1031 +1031 @@
     $search_value = __( 'Search anything...', 'buddypress' );
     if ( !empty( $_REQUEST['fs'] ) )
-        $search_value = $_REQUEST['fs'];
+        $search_value = stripslashes( $_REQUEST['fs'] );
 
 ?>
     <form action="" method="get" id="search-forums-form">
-        <label><input type="text" name="s" id="forums_search" value="<?php echo esc_attr($search_value) ?>"  onfocus="if (this.value == '<?php _e( 'Search anything...', 'buddypress' ) ?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e( 'Search anything...', 'buddypress' ) ?>';}" /></label>
+        <label><input type="text" name="s" id="forums_search" value="<?php echo esc_attr( $search_value ) ?>"  onfocus="if (this.value == '<?php _e( 'Search anything...', 'buddypress' ) ?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e( 'Search anything...', 'buddypress' ) ?>';}" /></label>
         <input type="submit" id="forums_search_submit" name="forums_search_submit" value="<?php _e( 'Search', 'buddypress' ) ?>" />
     </form>

trunk/bp-groups/bp-groups-templatetags.php

@@ -1836 +1836 @@
 
     $search_value = __( 'Search anything...', 'buddypress' );
-    if ( isset( $_REQUEST['s'] ) && !empty( $_REQUEST['s'] ) )
-        $search_value = $_REQUEST['s'];
+    if ( !empty( $_REQUEST['s'] ) )
+        $search_value = stripslashes( $_REQUEST['s'] );
 
 ?>
     <form action="" method="get" id="search-groups-form">
-        <label><input type="text" name="s" id="groups_search" value="<?php echo esc_attr($search_value) ?>"  onfocus="if (this.value == '<?php _e( 'Search anything...', 'buddypress' ) ?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e( 'Search anything...', 'buddypress' ) ?>';}" /></label>
+        <label><input type="text" name="s" id="groups_search" value="<?php echo esc_attr( $search_value ) ?>"  onfocus="if (this.value == '<?php _e( 'Search anything...', 'buddypress' ) ?>') {this.value = '';}" onblur="if (this.value == '') {this.value = '<?php _e( 'Search anything...', 'buddypress' ) ?>';}" /></label>
         <input type="submit" id="groups_search_submit" name="groups_search_submit" value="<?php _e( 'Search', 'buddypress' ) ?>" />
     </form>