Changeset 601 for branches/stable/cgi-bin/search.cgi

Timestamp:

10/04/13 16:47:32 (11 years ago)

Author:

Kris Deugau

Message:

/branches/stable

File off the last few rough edges (make sure webpath is used everywhere

appropriate)

Update copyright dates
Bump the version for release

File:

• branches/stable/cgi-bin/search.cgi (modified) (3 diffs)

branches/stable/cgi-bin/search.cgi

@@ -9 +9 @@
 # Last update by $Author$
 ###
-# Copyright 2005-2011 - Kris Deugau
+# Copyright (C) 2005-2013 Kris Deugau <kdeugau@deepnet.cx>
 
 use strict;             
@@ -76 +76 @@
 if (!defined($webvar{stype})) {
   $webvar{stype} = "<NULL>";   #shuts up the warnings.
-  $page = HTML::Template->new(filename => "search/compsearch.tmpl");
+  $page = HTML::Template->new(filename => "search/compsearch.tmpl",
+        global_vars => 1);
 } else {
-  $page = HTML::Template->new(filename => "search/sresults.tmpl");
+  $page = HTML::Template->new(filename => "search/sresults.tmpl",
+        global_vars => 1);
 }
+$page->param(webpath => $IPDB::webpath);
 
 my $header = HTML::Template->new(filename => "header.tmpl");
 $header->param(version => $IPDB::VERSION);
 $header->param(addperm => $IPDBacl{$authuser} =~ /a/);
+$header->param(webpath => $IPDB::webpath);
 print "Content-type: text/html\n\n", $header->output;
 
@@ -355 +359 @@
     queryResults($sql, $webvar{page}, $count);
 
-  } elsif ($category eq 'cust') {
+  } elsif ($category eq 'cust' || $category eq 'desc') {
 
 ##fixme:  this and other quick-search areas;  fix up page heading title similar to first grouping above
-    print qq(<div class="heading">Searching for Customer IDs containing '$query'</div><br>\n);
-
+    print qq(<div class="heading">Searching for Customer IDs or Descriptions containing '$query'</div><br>\n);
+
+# head off the worst of SQL injection.  search really needs a big rewrite...
+$query =~ s/'/''/g;
     # Query for a customer ID.  Note that we can't restrict to "numeric-only"
     # as we have non-numeric custIDs in the legacy data.  :/
-    $sql = "select $cols from searchme where custid ilike '%$query%' or description like '%$query%'";
-    my $count = countRows($sql);
-    $sql .= " order by cidr limit $RESULTS_PER_PAGE offset $offset";
-    queryResults($sql, $webvar{page}, $count);
-
-  } elsif ($category eq 'desc') {
-
-    print qq(<div class="heading">Searching for descriptions containing '$query'</div><br>\n);
-    # Query based on description (includes "name" from old DB).
-    $sql = "select $cols from searchme where description ilike '%$query%'".
-        " or custid ilike '%$query%'";
+    $sql = "select $cols from searchme where custid ilike '%$query%' or description ilike '%$query%'";
     my $count = countRows($sql);
     $sql .= " order by cidr limit $RESULTS_PER_PAGE offset $offset";