View | Details | Raw Unified | Return to bug 5131
Collapse All | Expand All

(-)a/opac/opac-search.pl (-2 / +4 lines)
Lines 285-294 if ( C4::Context->preference('OPACdefaultSortField') Link Here
285
      . C4::Context->preference('OPACdefaultSortOrder');
285
      . C4::Context->preference('OPACdefaultSortOrder');
286
}
286
}
287
287
288
my @allowed_sortby = qw /acqdate_asc acqdate_dsc author_az author_za call_number_asc call_number_dsc popularity_asc popularity_dsc pubdate_asc pubdate_dsc relevance title_az title_za/; 
288
@sort_by = split("\0",$params->{'sort_by'}) if $params->{'sort_by'};
289
@sort_by = split("\0",$params->{'sort_by'}) if $params->{'sort_by'};
289
$sort_by[0] = $default_sort_by if !$sort_by[0] && defined($default_sort_by);
290
$sort_by[0] = $default_sort_by if !$sort_by[0] && defined($default_sort_by);
290
foreach my $sort (@sort_by) {
291
foreach my $sort (@sort_by) {
291
    $template->param($sort => 1);   # FIXME: security hole.  can set any TMPL_VAR here
292
    if ( $sort ~~ @allowed_sortby ) {
293
        $template->param($sort => 1);
294
    }
292
}
295
}
293
$template->param('sort_by' => $sort_by[0]);
296
$template->param('sort_by' => $sort_by[0]);
294
297
295
- 

Return to bug 5131