diff --git a/ecrire/inc/surligne.php b/ecrire/inc/surligne.php index 8d3ee89499cb96cbaece119a359e5ba774c1e71a..3bc4bf5dcf689a00e1965c04106b530a4b993cc3 100644 --- a/ecrire/inc/surligne.php +++ b/ecrire/inc/surligne.php @@ -40,26 +40,29 @@ function surligner_mots($page) { $ref = $_SERVER['HTTP_REFERER']; + //avoid a js injection + $surcharge_surligne = preg_replace(",(?<!\\\\)',","\'",$_GET["var_recherche"]); foreach($surlignejs_engines as $engine) - if(preg_match($engine[0],$ref)) - if(preg_match($engine[1],$ref,$match)) { - //good referrer found - $script = "<script src='".find_in_path("javascript/SearchHighlight.js")."'></script> - <script type='text/javascript'> - jQuery(function(){ - jQuery(document).SearchHighlight({ - style_name:'spip_surligne', - exact:'whole', - style_name_suffix:false, - engines:[/^".str_replace(array("/","."),array("\/","\."),$GLOBALS['meta']['adresse_site'])."/i,/recherche=([^&]+)/i], - startHighlightComment:'".MARQUEUR_SURLIGNE."', - stopHighlightComment:'".MARQUEUR_FSURLIGNE."' - }) - }); - </script>"; - $page = preg_replace(",</head>,",$script."\n</head>",$page); - break; - } + if($surcharge_surligne || (preg_match($engine[0],$ref) && preg_match($engine[1],$ref))) { + //good referrer found or var_recherche is not null + $script = "<script src='".find_in_path("javascript/SearchHighlight.js")."'></script> + <script type='text/javascript'> + jQuery(function(){ + jQuery(document).SearchHighlight({ + style_name:'spip_surligne', + exact:'whole', + style_name_suffix:false, + engines:[/^".str_replace(array("/","."),array("\/","\."),$GLOBALS['meta']['adresse_site'])."/i,/recherche=([^&]+)/i], + startHighlightComment:'".MARQUEUR_SURLIGNE."', + stopHighlightComment:'".MARQUEUR_FSURLIGNE."'". + ($surcharge_surligne?", + keys:'$surcharge_surligne'":"")." + }) + }); + </script>"; + $page = preg_replace(",</head>,",$script."\n</head>",$page); + break; + } return $page; } diff --git a/ecrire/public/assembler.php b/ecrire/public/assembler.php index d90b5428cdd0c8d1773a8807bbb5555d3e0ea990..8cc3b5299441b0a4641c801cd278410d43d3084e 100644 --- a/ecrire/public/assembler.php +++ b/ecrire/public/assembler.php @@ -297,10 +297,10 @@ function inclure_balise_dynamique($texte, $echo=true, $ligne=0) { } -// Traiter var_recherche pour surligner les mots +// Traiter var_recherche ou le referrer pour surligner les mots // http://doc.spip.org/@f_surligne function f_surligne ($texte) { - if (isset($_SERVER['HTTP_REFERER'])) { + if (isset($_SERVER['HTTP_REFERER']) || $_GET['var_recherche']) { include_spip('inc/surligne'); $texte = surligner_mots($texte); }