View | Details | Raw Unified | Return to bug 40980
Collapse All | Expand All

(-)a/catalogue/search.pl (-4 / +4 lines)
Lines 263-269 $template->param( advancedsearchesloop => $advancedsearchesloop ); Link Here
263
263
264
$template->param( searchid => scalar $cgi->param('searchid'), );
264
$template->param( searchid => scalar $cgi->param('searchid'), );
265
265
266
my $default_sort_by = C4::Context->default_catalog_sort_by;
266
my $default_sort_by     = C4::Context->default_catalog_sort_by;
267
my @sanitized_operators = grep { $_ ne 'cud-login' } $cgi->multi_param('op');
267
268
268
# The following should only be loaded if we're bringing up the advanced search template
269
# The following should only be loaded if we're bringing up the advanced search template
269
if ( $template_type eq 'advsearch' ) {
270
if ( $template_type eq 'advsearch' ) {
Lines 274-280 if ( $template_type eq 'advsearch' ) { Link Here
274
    my $expanded = $cgi->param('expanded_options');
275
    my $expanded = $cgi->param('expanded_options');
275
    if ( $cgi->param('edit_search') ) {
276
    if ( $cgi->param('edit_search') ) {
276
        @operands  = $cgi->multi_param('q');
277
        @operands  = $cgi->multi_param('q');
277
        @operators = $cgi->multi_param('op');
278
        @operators = @sanitized_operators;
278
        @indexes   = $cgi->multi_param('idx');
279
        @indexes   = $cgi->multi_param('idx');
279
        $template->param(
280
        $template->param(
280
            sort => scalar $cgi->param('sort_by'),
281
            sort => scalar $cgi->param('sort_by'),
Lines 370-376 $template->param( 'sort_by' => $sort_by[0] ); Link Here
370
371
371
# operators include boolean and proximity operators and are used
372
# operators include boolean and proximity operators and are used
372
# to evaluate multiple operands
373
# to evaluate multiple operands
373
my @operators = map uri_unescape($_), $cgi->multi_param('op');
374
my @operators = map uri_unescape($_), @sanitized_operators;
374
375
375
# indexes are query qualifiers, like 'title', 'author', etc. They
376
# indexes are query qualifiers, like 'title', 'author', etc. They
376
# can be single or multiple parameters separated by comma: kw,right-Truncation
377
# can be single or multiple parameters separated by comma: kw,right-Truncation
377
- 

Return to bug 40980