Bug 762934 - External search does not properly escape user supplied d…

…ata, resulting in vulnerability
doxygen · Mar 25, 2016 · 1cc1ada · 1cc1ada
1 parent 9abcad8
commit 1cc1ada
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/templates/html/search_opensearch.php b/templates/html/search_opensearch.php
@@ -3,6 +3,7 @@
 
 $mode = array_key_exists('v', $_GET)?$_GET['v']:"";
 $query = array_key_exists('query', $_GET)?$_GET['query']:"";
+$query = preg_replace("/[^a-zA-Z0-9\-\_\.\x80-\xFF]/i", " ", $query );
 
 $query_results = run_query($query);