Pass clean dict to solr containing only allowed params

ckan/logic/action/get.py

@@ -17,6 +17,7 @@
 import ckan.model.misc as misc
 import ckan.plugins as plugins
 import ckan.lib.search as search
+import ckan.lib.search.query as search_query
 import ckan.lib.plugins as lib_plugins
 import ckan.lib.activity_streams as activity_streams
 
@@ -1140,29 +1141,35 @@ def package_search(context, data_dict):
 
         # filters get converted to solr query params
         # value can be a single string value or a list of strings
-        # FIXME we are destructively removing data_dict['filters'] so it is
-        # no longer available.  Is this what we want.  We do it to keep SOLR
-        # happy.
-        filters = data_dict.pop('filters', {})
+        filters = data_dict.get('filters', {})
         for key, values in filters.iteritems():
             if isinstance(values, basestring):
                 fq += ' %s:"%s"' % (key, urllib.unquote(values))
             else:
                 for value in values:
                     fq += ' %s:"%s"' % (key, urllib.unquote(value))
-        # update the data_dict
-        data_dict['fq'] = fq
 
         # If this query hasn't come from a controller that has set this flag
         # then we should remove any mention of capacity from the fq and
         # instead set it to only retrieve public datasets
         if not context.get('ignore_capacity_check',False):
             fq = ' '.join(p for p in fq.split(' ')
                             if not 'capacity:' in p)
-            data_dict['fq'] = fq + ' capacity:"public"'
+            fq += ' capacity:"public"'
+
+        # NOTE: We store this amended 'fq' in the data_dict but maybe we
+        # should not.
+        data_dict['fq'] = fq
+
+        # Create a clean dict for solr containing only valid fields from
+        # data_dict
+        solr_dict = {}
+        for key in search_query.VALID_SOLR_PARAMETERS :
+            if key in data_dict:
+                solr_dict[key] = data_dict[key]
 
         query = search.query_for(model.Package)
-        query.run(data_dict)
+        query.run(solr_dict)
 
         for package in query.results:
             # get the package object