Fixes FS#37317. Signed-off-by: Johannes Löthberg <johannes@kyriasis.com> --- web/lib/aurjson.class.php | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index 7b77da4..6c90ebd 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -16,6 +16,9 @@ class AurJSON { 'search', 'info', 'multiinfo', 'msearch', 'suggest', 'suggest-pkgbase' ); + private static $exposed_fields = array( + 'name', 'name_and_desc' + ); private static $fields_v1 = array( 'Packages.ID', 'Packages.Name', 'PackageBases.ID AS PackageBaseID', @@ -80,11 +83,14 @@ class AurJSON { if (!in_array($http_data['type'], self::$exposed_methods)) { return $this->json_error('Incorrect request type specified.'); } + if ($http_data['search_by'] !== null && !in_array($http_data['search_by'], self::$exposed_fields)) { + return $this->json_error('Incorrect search_by field specified.'); + } $this->dbh = DB::connect(); $type = str_replace('-', '_', $http_data['type']); - $json = call_user_func(array(&$this, $type), $http_data['arg']); + $json = call_user_func(array(&$this, $type), $http_data['arg'], $http_data['search_by']); $etag = md5($json); header("Etag: \"$etag\""); @@ -319,15 +325,19 @@ class AurJSON { * * @return mixed Returns an array of package matches. */ - private function search($keyword_string) { + private function search($keyword_string, $search_by) { if (strlen($keyword_string) < 2) { return $this->json_error('Query arg too small'); } $keyword_string = $this->dbh->quote("%" . addcslashes($keyword_string, '%_') . "%"); - $where_condition = "(Packages.Name LIKE $keyword_string OR "; - $where_condition .= "Description LIKE $keyword_string)"; + if ($search_by === 'name') { + $where_condition = "(Packages.Name LIKE $keyword_string)"; + } else if ($search_by === 'name_and_desc' || $search_by === null) { + $where_condition = "(Packages.Name LIKE $keyword_string OR "; + $where_condition .= "Description LIKE $keyword_string)"; + } return $this->process_query('search', $where_condition); } -- 2.4.4