inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-14 17:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

ALF-2014: Keyword Search web script can confuse search terms with operators

Browse Source 
- Because it didn't quote and escape the search terms

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@19780 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Dave Ward
2010-04-08 17:50:47 +00:00
parent 9ccb23af25
commit 54dc7f28ca
2 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/alfresco/templates/webscripts/org/alfresco/repository/search/keywordsearch.get.query_.ftl
View File

@@ -2,10 +2,10 @@
TYPE:"{http://www.alfresco.org/model/content/1.0}content" AND TYPE:"{http://www.alfresco.org/model/content/1.0}content" AND
( (
<#list 1..terms?size as i> <#list 1..terms?size as i>
@\{http\://www.alfresco.org/model/content/1.0\}name:${terms[i - 1]} @\{http\://www.alfresco.org/model/content/1.0\}name:"${terms[i - 1]}"
</#list> </#list>
<#list 1..terms?size as i> <#list 1..terms?size as i>
TEXT:${terms[i - 1]} TEXT:"${terms[i - 1]}"
</#list> </#list>
) )
) )

16
source/java/org/alfresco/repo/web/scripts/bean/KeywordSearch.java
View File

@@ -25,26 +25,25 @@ import java.util.HashMap;
import java.util.Locale; import java.util.Locale;
import java.util.Map; import java.util.Map;
import org.springframework.extensions.surf.util.I18NUtil;
import org.alfresco.repo.template.TemplateNode; import org.alfresco.repo.template.TemplateNode;
import org.alfresco.repo.web.scripts.RepositoryImageResolver; import org.alfresco.repo.web.scripts.RepositoryImageResolver;
import org.alfresco.service.ServiceRegistry; import org.alfresco.service.ServiceRegistry;
import org.alfresco.service.cmr.repository.NodeRef; import org.alfresco.service.cmr.repository.NodeRef;
import org.alfresco.service.cmr.repository.StoreRef; import org.alfresco.service.cmr.repository.StoreRef;
import org.alfresco.service.cmr.repository.TemplateException;
import org.alfresco.service.cmr.search.ResultSet; import org.alfresco.service.cmr.search.ResultSet;
import org.alfresco.service.cmr.search.SearchParameters; import org.alfresco.service.cmr.search.SearchParameters;
import org.alfresco.service.cmr.search.SearchService; import org.alfresco.service.cmr.search.SearchService;
import org.alfresco.util.GUID; import org.alfresco.util.GUID;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.lucene.queryParser.QueryParser;
import org.springframework.extensions.surf.util.I18NUtil;
import org.springframework.extensions.surf.util.ParameterCheck; import org.springframework.extensions.surf.util.ParameterCheck;
import org.springframework.extensions.surf.util.URLEncoder; import org.springframework.extensions.surf.util.URLEncoder;
import org.springframework.extensions.webscripts.DeclarativeWebScript; import org.springframework.extensions.webscripts.DeclarativeWebScript;
import org.springframework.extensions.webscripts.Status; import org.springframework.extensions.webscripts.Status;
import org.springframework.extensions.webscripts.WebScriptException; import org.springframework.extensions.webscripts.WebScriptException;
import org.springframework.extensions.webscripts.WebScriptRequest; import org.springframework.extensions.webscripts.WebScriptRequest;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.StringUtils;
/** /**
@@ -163,6 +162,13 @@ public class KeywordSearch extends DeclarativeWebScript
{ {
// construct search statement // construct search statement
String[] terms = searchTerms.split(" "); String[] terms = searchTerms.split(" ");
// Escape special characters in the terms, so that they can't confuse the parser
for (int i=0; i<terms.length; i++)
{
terms[i] = QueryParser.escape(terms[i]);
}
Map<String, Object> statementModel = new HashMap<String, Object>(7, 1.0f); Map<String, Object> statementModel = new HashMap<String, Object>(7, 1.0f);
statementModel.put("args", createArgs(req)); statementModel.put("args", createArgs(req));
statementModel.put("terms", terms); statementModel.put("terms", terms);