From b3157cbfd859c914911b114d4edbba4654758b57 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Thu, 17 Nov 2016 13:43:40 +0100
Subject: [PATCH 1/2] fixes #547, strong checks on url format

---
 include/functions.inc.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/functions.inc.php b/include/functions.inc.php
index 018747817..39b618d81 100644
--- a/include/functions.inc.php
+++ b/include/functions.inc.php
@@ -2055,6 +2055,16 @@ function mobile_theme()
  */
 function url_check_format($url)
 {
+  if (strpos($url, '"') !== false)
+  {
+    return false;
+  }
+
+  if (strncmp($url, 'http://', 7) !== 0 and strncmp($url, 'https://', 8) !== 0)
+  {
+    return false;
+  }
+
   return filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED | FILTER_FLAG_HOST_REQUIRED)!==false;
 }
 

From 9a93d1f44b06605af84520509e7a0e8b64ab0c05 Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Thu, 17 Nov 2016 14:10:27 +0100
Subject: [PATCH 2/2] fixes #548, escape HTML chars from search expression

before sending them to HTML comment on frontend
---
 include/functions_search.inc.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/functions_search.inc.php b/include/functions_search.inc.php
index d8df4eea8..59fc97cac 100644
--- a/include/functions_search.inc.php
+++ b/include/functions_search.inc.php
@@ -1284,13 +1284,13 @@ function get_quick_search_results_no_cache($q, $options)
 
   $ids = qsearch_eval($expression, $qsr, $tmp, $search_results['qs']['unmatched_terms']);
 
-  $debug[] = "<!--\nparsed: ".$expression;
+  $debug[] = "<!--\nparsed: ".htmlspecialchars($expression);
   $debug[] = count($expression->stokens).' tokens';
   for ($i=0; $i<count($expression->stokens); $i++)
   {
-    $debug[] = $expression->stokens[$i].': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
+    $debug[] = htmlspecialchars($expression->stokens[$i]).': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
       .' modifier:'.dechex($expression->stoken_modifiers[$i])
-      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.implode(', ',$expression->stokens[$i]->variants): '');
+      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.htmlspecialchars(implode(', ',$expression->stokens[$i]->variants)): '');
   }
   $debug[] = 'before perms '.count($ids);