1
0
mirror of https://github.com/flarum/core.git synced 2025-08-07 17:07:19 +02:00

Prevent MySQL search operators from taking effect

We do not want to inherit MySQL's fulltext query language, so let's
just drop all non-word characters from the search term.

Fixes #1498.
This commit is contained in:
Franz Liedke
2019-07-23 23:55:06 +02:00
parent ed97989ca2
commit 1502fc98d8
2 changed files with 52 additions and 3 deletions

View File

@@ -29,9 +29,10 @@ class FulltextGambit implements GambitInterface
throw new LogicException('This gambit can only be applied on a DiscussionSearch');
}
// The @ character crashes fulltext searches on InnoDB tables.
// See https://bugs.mysql.com/bug.php?id=74042
$bit = str_replace('@', '*', $bit);
// Replace all non-word characters with spaces.
// We do this to prevent MySQL fulltext search boolean mode from taking
// effect: https://dev.mysql.com/doc/refman/5.7/en/fulltext-boolean.html
$bit = preg_replace('/[^\p{L}\p{N}_]+/u', ' ', $bit);
$query = $search->getQuery();
$grammar = $query->getGrammar();