cvs: php-bugs-web / bugs.sql search.php style.css /include functions.inc layout.inc

jimw Thu Jun 20 00:33:21 2002 EDT Modified files: /php-bugs-web bugs.sql search.php style.css /php-bugs-web/include functions.inc layout.inc Log: - apply patch to display warnings for search words that will be ignored from Melvyn Sopacua <msopacua@idg.nl>, with some style tweaks and correct output encoding of words to avoid xss issue - plug a few (old) possible sql injection holes - rip out prevsearch stuff, doesn't play nice with caching (and was incomplete) Index: php-bugs-web/bugs.sql diff -u php-bugs-web/bugs.sql:1.6 php-bugs-web/bugs.sql:1.7 --- php-bugs-web/bugs.sql:1.6 Sat Apr 27 18:43:14 2002 +++ php-bugs-web/bugs.sql Thu Jun 20 00:32:39 2002 @@ -2,7 +2,7 @@ # # Host: localhost Database: php3 #-------------------------------------------------------- -DROP table bugdb; +DROP table IF EXISTS bugdb; CREATE TABLE bugdb ( id int(8) NOT NULL AUTO_INCREMENT, @@ -22,6 +22,8 @@ FULLTEXT (email,sdesc,ldesc) ); +DROP TABLE IF EXISTS bugdb_comments; + CREATE TABLE bugdb_comments ( id int(8) NOT NULL AUTO_INCREMENT, bug int(8) NOT NULL, @@ -31,6 +33,8 @@ PRIMARY KEY (id), FULLTEXT (comment) ); + +DROP TABLE IF EXISTS bugdb_votes; CREATE TABLE bugdb_votes ( bug int(8) NOT NULL, Index: php-bugs-web/search.php diff -u php-bugs-web/search.php:1.20 php-bugs-web/search.php:1.21 --- php-bugs-web/search.php:1.20 Tue Jun 18 05:33:35 2002 +++ php-bugs-web/search.php Thu Jun 20 00:32:39 2002 @@ -14,6 +14,7 @@ commonHeader("Search"); $errors = array(); +$warnings = array(); if (isset($cmd) && $cmd == "display") { @mysql_pconnect("localhost","nobody","") @@ -45,9 +46,14 @@ } if (strlen($search_for)) { - $where_clause .= " AND MATCH (email,sdesc,ldesc) AGAINST ('$search_for')"; + list($sql_search, $ignored) = format_search_string($search_for); + $where_clause .= $sql_search; + if (count($ignored) > 0 ) { + array_push($warnings, "The following words were ignored: " . implode(', ', htmlentities(stripslashes(array_unique($ignored))))); + } } + $bug_age = (int)$bug_age; if ($bug_age) { $where_clause .= " AND ts1 >= DATE_SUB(NOW(), INTERVAL $bug_age DAY)"; } @@ -73,10 +79,12 @@ $query .= "$where_clause "; + $allowed_order = array("id", "bug_type", "status", "php_version", "php_os", "sdesc", "assign"); + /* we avoid adding an order by clause if using the full text search */ if ($order_by || $reorder_by || !strlen($search_for)) { - if (!$order_by) $order_by = "id"; - if (!$direction) $direction = "ASC"; + if (!in_array($order_by,$allowed_order)) $order_by = "id"; + if ($direction != "DESC") $direction = "ASC"; if ($reorder_by) { if ($order_by == $reorder_by) { @@ -90,8 +98,8 @@ $query .= " ORDER BY $order_by $direction"; } - if (!$begin) $begin = 0; - if (!isset($limit)) $limit = 30; + if (!(int)$begin) $begin = 0; + if ($limit != 'All' && !(int)$limit) $limit = 30; if($limit!='All') $query .= " LIMIT $begin,$limit"; @@ -123,6 +131,7 @@ <th><a href="<?php echo $link;?>&amp;reorder_by=assign">Assigned</a></th> </tr> <?php + if ($warnings) display_warnings($warnings); while ($row = mysql_fetch_array($res)) { echo '<tr bgcolor="', get_row_color($row), '">'; @@ -158,18 +167,23 @@ } if ($errors) display_errors($errors); +if ($warnings) display_warnings($warnings); ?> <form id="asearch" method="post" action="<?php echo $PHP_SELF?>"> <table id="primary" width="95%"> <tr> <th>Find bugs</th> <td nowrap="nowrap">with <b>any</b> of the words</td> - <td><input type="text" name="search_for" value="<?echo htmlspecialchars(stripslashes($search_for));?>" size="20" maxlength="255" /></td> + <td><input type="text" name="search_for" value="<?php echo htmlspecialchars(stripslashes($search_for));?>" size="20" maxlength="255" /></td> <td rowspan="2"> <select name="limit"><?php show_limit_options($limit);?></select> <br /> <select name="order_by"><?php show_order_options($limit);?></select> <br /> + <input type="radio" name="direction" value="ASC" <?php if($direction != "DESC") { echo('checked="checked"'); }?>/>Ascending + &nbsp; + <input type="radio" name="direction" value="DESC" <?php if($direction == "DESC") { echo('checked="checked"'); }?>/>Descending + <br /> <input type="hidden" name="cmd" value="display" /> <input type="submit" value="Search" /> </td> @@ -189,17 +203,17 @@ <tr> <th>OS</th> <td nowrap="nowrap">Return bugs with <b>operating system</b></td> - <td><input type="text" name="php_os" value="<?echo htmlspecialchars(stripslashes($php_os));?>" /></td> + <td><input type="text" name="php_os" value="<?php echo htmlspecialchars(stripslashes($php_os));?>" /></td> </tr> <tr> <th>Version</th> <td nowrap="nowrap">Return bugs reported with <b>PHP version</b></td> - <td><input type="text" name="phpver" value="<?echo htmlspecialchars(stripslashes($phpver));?>" /></td> + <td><input type="text" name="phpver" value="<?php echo htmlspecialchars(stripslashes($phpver));?>" /></td> </tr> <tr> <th>Assigned</th> <td nowrap="nowrap">Return only bugs <b>assigned</b> to</td> - <td><input type="text" name="assign" value="<?echo htmlspecialchars(stripslashes($assign));?>" /> + <td><input type="text" name="assign" value="<?php echo htmlspecialchars(stripslashes($assign));?>" /> <?php if (!empty($user)) { $u = stripslashes($user); Index: php-bugs-web/style.css diff -u php-bugs-web/style.css:1.15 php-bugs-web/style.css:1.16 --- php-bugs-web/style.css:1.15 Sat Feb 9 22:00:51 2002 +++ php-bugs-web/style.css Thu Jun 20 00:32:47 2002 @@ -117,6 +117,13 @@ margin: 4px; padding: 6px; } +div.warnings { + border: 1px dashed #ff8c00; + background: #ffa; + color: #ff8c00; + margin: 4px; + padding: 6px; +} div.explain { border: 1px dashed #000066; color: #000066; Index: php-bugs-web/include/functions.inc diff -u php-bugs-web/include/functions.inc:1.33 php-bugs-web/include/functions.inc:1.34 --- php-bugs-web/include/functions.inc:1.33 Wed Jun 19 10:10:05 2002 +++ php-bugs-web/include/functions.inc Thu Jun 20 00:33:06 2002 @@ -130,6 +130,22 @@ echo '</div>'; } +function display_warnings($warnings) +{ + echo '<div class="warnings">'; + if (count($warnings) > 1) { + echo "Please notice the following:<ul>\n"; + foreach ($warnings as $warning) { + echo "<li>$warning</li>\n"; + } + echo "</ul>"; + } + else { + echo $warnings[0]; + } + echo '</div>'; +} + function show_types($current,$show_any,$default="") { include 'bugtypes.inc'; @@ -415,3 +431,25 @@ break; } } + +function format_search_string($search) +{ + // Function will be updated to make results more relevant. + // Quick hack for indicating ignored words. + + $min_word_len=4; + + $ok = preg_match_all("/\w+/", $search, $matches); + $ignored = array(); + foreach($matches[0] AS $match) + { + if(strlen($match) < $min_word_len) + { + array_push($ignored, $match); + } + } + + return array(" AND MATCH (email,sdesc,ldesc) AGAINST ('$search')", $ignored); +} + +?> Index: php-bugs-web/include/layout.inc diff -u php-bugs-web/include/layout.inc:1.14 php-bugs-web/include/layout.inc:1.15 --- php-bugs-web/include/layout.inc:1.14 Sat Feb 9 22:00:53 2002 +++ php-bugs-web/include/layout.inc Thu Jun 20 00:33:06 2002 @@ -208,7 +208,7 @@ <input type="hidden" name="cmd" value="display" /> <td align="right" valign="top" colspan="2" nowrap><font color="#ffffff"> <small>go to bug id or search bugs for</small> -<input class="small" type="text" name="search_for" value="<?php echo htmlspecialchars($prevsearch) ?>" size="30" /> + <input class="small" type="text" name="search_for" value="" size="30" /> <?php echo make_submit('small_submit_white.gif', 'search', 'bottom');?>&nbsp;<br> </font></td> </form>