fix for another XSS bug

11 years ago · f4172cbb3d
parent ff86cb683f
commit f4172cbb3d
1 changed files with 2 additions and 1 deletions
--- a/htroot/portalsearch/yacy-portalsearch.js
+++ b/htroot/portalsearch/yacy-portalsearch.js
@ -242,6 +242,7 @@ function yacysearch(clear) {
 		param[i] = item;
 	});
 	param[param.length] = { name : 'startRecord', value : startRecord };
+	ycurr = ycurr.replace("<"," ").replace(">"," ");
 	
 	$.ajaxSetup({ 
        timeout: 10000,
@ -274,7 +275,7 @@ function yacysearch(clear) {
 			else data = json;			
 			
 			var searchTerms = "";
-			searchTerms = data.channels[0].searchTerms;			
+			searchTerms = data.channels[0].searchTerms.replace("<"," ").replace(">"," ");;			
 						
 			if($.trim(ycurr.replace(/ /g,"+")) != searchTerms) {
 				return false;