Prevent NUL characters in both suburl and query
authorMagnus Hagander <magnus@hagander.net>
Wed, 18 Nov 2020 15:39:24 +0000 (16:39 +0100)
committerMagnus Hagander <magnus@hagander.net>
Wed, 18 Nov 2020 15:39:24 +0000 (16:39 +0100)
Previous fix only prevented them in the search query, not in the suburl
parameter.

pgweb/search/views.py

index 49dbbfbd0dec778154c9e1417a7e169b8af79494..db26bf4b8e2bb5e9713c6c46f5e878bcbb13c980 100644 (file)
@@ -130,7 +130,7 @@ def search(request):
                 'search_error': "No search term specified.",
             })
     query = request.GET['q'].strip()
-    if '\0' in query:
+    if '\0' in query or '\0' in suburl:
         return render(request, 'search/sitesearch.html', {
             'search_error': "Invalid character in search.",
         })