From 8ef8885d7f24b0ed6a7c3cab9d1b2c1b19200d44 Mon Sep 17 00:00:00 2001 From: Seth Date: Sat, 25 Sep 2021 15:19:16 -0400 Subject: [PATCH] Filter tags to avoid HTML rendering in returned display (and the quick search doesn't handle html search in any event). --- app/controllers/find/QuickSearchController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/find/QuickSearchController.php b/app/controllers/find/QuickSearchController.php index f3908863e6..32638d65a5 100644 --- a/app/controllers/find/QuickSearchController.php +++ b/app/controllers/find/QuickSearchController.php @@ -56,7 +56,7 @@ public function __construct(&$po_request, &$po_response, $pa_view_paths=null) { * */ public function Index($pa_options=null) { - $ps_search = $this->request->getParameter('search', pString, null, ['forcePurify' => true]); + $ps_search = strip_tags($this->request->getParameter('search', pString, null, ['forcePurify' => true])); $ps_sort = $this->request->getParameter('sort', pString, null, ['forcePurify' => true]); if (!$ps_search) { $ps_search = Session::getVar('quick_search_last_search'); }