[#3724] - com_search: blank page / fatal error when searching for e.g. "what's new" with IE
- Closed
- 2 Sep 2014
- Medium
- Build: master
- # 3724
With Joomla! 2.5.20 (3.x not tested) and an Internet Explorer (seems all versions) goto frontend Search page (com_search) and type in something like what's new. (apostrophe inbetween)
You will get a blank page / fatal error in libraries/joomla/environment/uri.php(194) where the request is interpreted as injection. Other browsers like Firefox work fine.
Cause:
IE sends searchword=what's%20new&ordering... whereas other browsers convert the apostroph into %27.
I think that's a bug in IE but also I think Joomla! should find a way to tolerate such wrong browsers. 
Can you test it with 3.x please?
Tested with a simple 3.3.0 site. There it works, I get a result page.
Looks like in 3.3 JURI doesn't throw an exception anymore and just cleans the URL instead:
https://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/uri/uri.php#L195
compared to the 2.5 counterpart:
https://github.com/joomla/joomla-cms/blob/2.5.x/libraries/joomla/environment/uri.php#L192
Can you test that and maybe do a PullRequest for it?
Not sure. At the moment I'm very busy but mainly I don't understand the complete way through all the code. It would be no problem to change the code so that the apostrophe is accepted and the search works. But I don't know if then also bad injections would work too and we become a security issue.
zero-24
- | Status | New | ⇒ | Closed |
Closing in favour of #4200 so the conversation is in one place
This comment was created with the J!Tracker Application at http://issues.joomla.org/.
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2014-09-02 09:40:04 |
| Labels |
Added:
?
Removed: ? |
||
Hi all, any statement?