X-Git-Url: http://p2p-next.cs.pub.ro/gitweb/?a=blobdiff_plain;f=application%2Fcontrollers%2Fcatalog.php;h=7d86d36474f810d114936d9a861f6f26879e0ac8;hb=e7bb29c6cc8d766a65ec34f257d110ed41364481;hp=95a6908c364e4d071f5db69d1ccb4f328eeb829b;hpb=85bae784f30d1777db15f43d2e3ce04a2c3e8653;p=living-lab-site.git

diff --git a/application/controllers/catalog.php b/application/controllers/catalog.php
index 95a6908..7d86d36 100644
--- a/application/controllers/catalog.php
+++ b/application/controllers/catalog.php
@@ -148,11 +148,12 @@ class Catalog extends CI_Controller {
 	{
 		// Redirect to an URL which contains search string if data was passed
 		// via POST method and not via URL segments.
-		$str_post_search = $this->input->post('search', TRUE);
+		$str_post_search = $this->input->post('search');
 		if ($search_query === "" && $str_post_search !== FALSE) 
-			redirect('catalog/search/'. $this->input->post('search', TRUE));
+			redirect('catalog/search/'. $str_post_search);
 
 		$this->load->model('videos_model');
+		$this->load->library('security');
 		
 		// **
 		// ** LOADING MODEL
@@ -160,6 +161,9 @@ class Catalog extends CI_Controller {
 		// Search query is encoded for URL and must be decoded.
 		$enc_search_query = $search_query;
 		$search_query = $this->videos_model->decode_search_query($search_query);
+		
+		// Security filtering
+		$search_query = $this->security->xss_clean($search_query);
 		$results_data['search_query'] = $search_query;
 
 		// Category
@@ -176,10 +180,10 @@ class Catalog extends CI_Controller {
 		}
 		
 		// Check if search string is valid.
-		if (strlen($search_query) < 4)
+		if (strlen($search_query) === 0)
 		{
 			//$results_data['videos'] = NULL;
-			$this->error($this->lang->line('error_search_query_too_short'),
+			$this->error($this->lang->line('error_search_query_empty'),
 				$header_data);
 			return;
 		}