From 705be7fa38cbe1eaebf3d52eca88af604dd488d2 Mon Sep 17 00:00:00 2001 From: Melissa Draper Date: Fri, 16 Nov 2012 15:49:00 +1300 Subject: [PATCH] Sanitise group member search query (Bug #1079498) The query string was neither validated nor had dodgy stuff stripped. The clean_html() method is now run on the query string. Change-Id: I5e0fde75eebcda2c9518ad8f777fb1b135af8eeb --- htdocs/group/members.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/group/members.php b/htdocs/group/members.php index 98a848a..d8238ca 100644 --- a/htdocs/group/members.php +++ b/htdocs/group/members.php @@ -74,7 +74,7 @@ if ($remove && $member) { } // Search related stuff for member pager -$query = trim(param_variable('query', '')); +$query = clean_html(trim(param_variable('query', ''))); // pagination params $setlimit = true; //Enable choosing page size; list of page sizes has been predefined in function build_pagination() $offset = param_integer('offset', 0); -- 1.7.11.3