diff --git a/inc/SP/Account/AccountSearch.class.php b/inc/SP/Account/AccountSearch.class.php index 1895e9cd..7e60e984 100644 --- a/inc/SP/Account/AccountSearch.class.php +++ b/inc/SP/Account/AccountSearch.class.php @@ -33,6 +33,7 @@ use SP\Mgmt\Users\User; use SP\Storage\DB; use SP\Storage\QueryData; use SP\Util\Checks; +use SP\Util\Filter; defined('APP_ROOT') || die(); @@ -188,7 +189,7 @@ class AccountSearch */ public function setTxtSearch($txtSearch) { - $this->txtSearch = (string)$txtSearch; + $this->txtSearch = Filter::safeSearchString($txtSearch); return $this; } diff --git a/inc/SP/DataModel/ItemSearchData.class.php b/inc/SP/DataModel/ItemSearchData.class.php index 67b39a13..a405a8a9 100644 --- a/inc/SP/DataModel/ItemSearchData.class.php +++ b/inc/SP/DataModel/ItemSearchData.class.php @@ -2,8 +2,8 @@ /** * sysPass * - * @author nuxsmin - * @link http://syspass.org + * @author nuxsmin + * @link http://syspass.org * @copyright 2012-2017, Rubén Domínguez nuxsmin@$syspass.org * * This file is part of sysPass. @@ -23,6 +23,7 @@ */ namespace SP\DataModel; +use SP\Util\Filter; /** @@ -65,7 +66,7 @@ class ItemSearchData */ public function setSeachString($seachString) { - $this->seachString = $seachString; + $this->seachString = Filter::safeSearchString($seachString); } /** diff --git a/inc/SP/Util/Filter.class.php b/inc/SP/Util/Filter.class.php new file mode 100644 index 00000000..b18a220f --- /dev/null +++ b/inc/SP/Util/Filter.class.php @@ -0,0 +1,48 @@ +. + */ + +namespace SP\Util; + +defined('APP_ROOT') || die(); + + +/** + * Class Filter para el filtrado de datos + * + * @package SP\Util + */ +class Filter +{ + /** + * Limpiar una cadena de búsqueda de carácteres utilizados en expresiones regulares + * + * @param $string + * @return mixed + */ + public static function safeSearchString($string) + { + return preg_replace(/** @lang RegExp */ + '/[\[\]%{}*$]+/', '', (string)$string); + } +} \ No newline at end of file diff --git a/inc/SP/Util/Util.class.php b/inc/SP/Util/Util.class.php index c0f29b17..b4b3191e 100644 --- a/inc/SP/Util/Util.class.php +++ b/inc/SP/Util/Util.class.php @@ -25,7 +25,6 @@ namespace SP\Util; use Defuse\Crypto\Core; -use Defuse\Crypto\Crypto; use Defuse\Crypto\Encoding; use SP\Config\Config; use SP\Config\ConfigDB; @@ -383,7 +382,7 @@ class Util */ public static function getVersion($retBuild = false, $normalized = false) { - $build = 17061502; + $build = 17061503; $version = [2, 1, 11]; if ($normalized === true) {